Simplify d2i_PKCS7 by removing redundant BER-to-DER conversion#3037
Merged
WillChilds-Klein merged 3 commits intoaws:mainfrom Feb 27, 2026
Merged
Simplify d2i_PKCS7 by removing redundant BER-to-DER conversion#3037WillChilds-Klein merged 3 commits intoaws:mainfrom
d2i_PKCS7 by removing redundant BER-to-DER conversion#3037WillChilds-Klein merged 3 commits intoaws:mainfrom
Conversation
samuel40791765
previously approved these changes
Feb 24, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3037 +/- ##
==========================================
- Coverage 78.36% 78.35% -0.01%
==========================================
Files 689 689
Lines 121042 121022 -20
Branches 16967 16965 -2
==========================================
- Hits 94851 94830 -21
- Misses 25295 25296 +1
Partials 896 896 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
d2i_PKCS7 by removing redundant BER-to-DER conversion
bd13390 to
4843dd6
Compare
WillChilds-Klein
previously approved these changes
Feb 26, 2026
samuel40791765
previously approved these changes
Feb 26, 2026
15cae8f
WillChilds-Klein
approved these changes
Feb 26, 2026
samuel40791765
approved these changes
Feb 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes:
d2i_PKCS7previously performed a manual BER-to-DER conversion usingCBS_asn1_ber_to_derbefore passing the result toASN1_item_d2i. Thismanual conversion had a bug: when BER input contained indefinite-length
elements, the converted DER encoding was shorter than the original BER, but
*inwas advanced by the DER byte count rather than the original BER bytecount. This caused
*into be under-advanced, violating the d2i API contract.Since
ASN1_item_d2ialready handles BER encoding natively (includingindefinite-length elements and constructed strings), the manual conversion
was redundant. This change removes it entirely and replaces
IMPLEMENT_ASN1_ALLOC_FUNCTIONS(PKCS7)plus the hand-writtend2i_PKCS7and
i2d_PKCS7with a singleIMPLEMENT_ASN1_FUNCTIONS(PKCS7)macro call,consistent with every other type defined in this file.
The now-unused
#include "../bytestring/internal.h"has also been removed.Call-outs:
The existing BER test in
TestCertReparsewas asserting the old (incorrect)pointer-advancement behavior for BER input, expecting
*into advance byonly the DER-converted length. This has been updated to expect full
advancement past the original input, consistent with the non-BER path.
Testing:
All 60 existing PKCS7 tests pass (
crypto_test --gtest_filter='*PKCS7*').By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.