bpo-35746: Fix segfault in ssl's cert parser (GH-11569) (#11868) · python/cpython@6c655ce

Original file line numberDiff line numberDiff line change

@@ -64,6 +64,7 @@ def data_file(*name):

6464

BADKEY = data_file("badkey.pem")

6565

NOKIACERT = data_file("nokia.pem")

6666

NULLBYTECERT = data_file("nullbytecert.pem")

67+

TALOS_INVALID_CRLDP = data_file("talos-2019-0758.pem")

6768
6869

DHFILE = data_file("dh1024.pem")

6970

BYTES_DHFILE = os.fsencode(DHFILE)

@@ -231,6 +232,27 @@ def test_parse_cert(self):

231232

self.assertEqual(p['crlDistributionPoints'],

232233

('http://SVRIntl-G3-crl.verisign.com/SVRIntlG3.crl',))

233234
235+

def test_parse_cert_CVE_2019_5010(self):

236+

p = ssl._ssl._test_decode_cert(TALOS_INVALID_CRLDP)

237+

if support.verbose:

238+

sys.stdout.write("\n" + pprint.pformat(p) + "\n")

239+

self.assertEqual(

240+

p,

241+

{

242+

'issuer': (

243+

(('countryName', 'UK'),), (('commonName', 'cody-ca'),)),

244+

'notAfter': 'Jun 14 18:00:58 2028 GMT',

245+

'notBefore': 'Jun 18 18:00:58 2018 GMT',

246+

'serialNumber': '02',

247+

'subject': ((('countryName', 'UK'),),

248+

(('commonName',

249+

'codenomicon-vm-2.test.lal.cisco.com'),)),

250+

'subjectAltName': (

251+

('DNS', 'codenomicon-vm-2.test.lal.cisco.com'),),

252+

'version': 3

253+

}

254+

)

255+
234256

def test_parse_cert_CVE_2013_4238(self):

235257

p = ssl._ssl._test_decode_cert(NULLBYTECERT)

236258

if support.verbose: