Skip to content

Conversation

@Mario-Klebsch
Copy link

Description

Fix for Ticket #4894:

  • The buffer size is increased to 32
  • An asseretion is added to check for buffer to small in development builds

PR checklist

@mpg
Copy link
Contributor

mpg commented Oct 2, 2025

Thanks for your contribution!

However it needs to include an automated non-regression test, as part of test_suite_x509parse. See https://mbed-tls.readthedocs.io/en/latest/kb/development/test_suites/ and please feel free to ask questions if anything's not clear enough.

@mpg mpg added component-x509 size-s Estimated task size: small (~2d) priority-medium Medium priority - this can be reviewed as time permits labels Oct 2, 2025
/* Key size */
if ((ret = mbedtls_x509_key_size_helper(key_size_str, MBEDTLS_BEFORE_COLON,
mbedtls_pk_get_name(&crt->pk))) != 0) {
assert(ret != MBEDTLS_ERR_X509_BUFFER_TOO_SMALL);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't use assert in the library.

Copy link
Author

@Mario-Klebsch Mario-Klebsch Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The purpose of assert()ions is to signal errors in the internal logic of some software. In this case, supplying an insuffently sized buffer to mbedtls_x509_key_size_helper() in an error in the program logic. This is the reason, why I added an assertion.

Just remove it from my contribution, if you don't want to use this extra instrumentation in your code.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Like several libraries, we have a rule not to use assert(), but instead return an error and let the program decide what to do with it (termination may not be the best response).

Just remove it from my contribution, if you don't want to use this extra instrumentation in your code.

The way our review process works is that PR authors are supposed to make changes if needed. We don't normally merge patches that will need to be modified later.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

component-x509 priority-medium Medium priority - this can be reviewed as time permits size-s Estimated task size: small (~2d)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants