Nicola Murino
90f76b8ffe
parseCert parsed a certificate's SignatureKey by calling ParsePublicKey again, and only afterwards rejected a certificate used as a signing key. For a chain of nested certificates this recursed once per level, so a key with enough nesting exhausted the goroutine stack and crashed with a fatal stack overflow that recover cannot catch. Reject the signature key by its declared algorithm before parsing it, which bounds parsing. Fixes golang/go#80414 Change-Id: Id51401aae15bfbec006c03ab97635a3b68bd6058 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/802145 Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Carlos Amedee <carlos@golang.org> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org>
Go Cryptography
This repository holds supplementary Go cryptography packages.
Report Issues / Send Patches
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/crypto.
The main issue tracker for the crypto repository is located at https://go.dev/issues. Prefix your issue with "x/crypto:" in the subject line, so it is easy to find.
Note that contributions to the cryptography package receive additional scrutiny due to their sensitive nature. Patches may take longer than normal to receive feedback.