Skip to content

Conversation

@cconlon
Copy link
Member

@cconlon cconlon commented Dec 18, 2025

Description

wolfSSL failed to parse PKCS#7 SignedData bundles where the encapsulated content was a SEQUENCE (per PKCS#7 "ANY" type) rather than OCTET_STRING (per CMS spec). This affected parsing of Microsoft Authenticode signatures.

This PR fixes the issue by correctly setting the content size for non OCTET_STRING encapsulated contents. It also fixes a degenerate bundle detection issue that showed up when testing the primary issue.

Testing

Tested by building a reproducer based on Issue #9213, then creating a unit test that reproduced the same issue (included here in tests/api/test_pkcs7.c).

Checklist

  • added tests
  • updated/added doxygen
  • updated appropriate READMEs
  • Updated manual and documentation

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a bug in wolfSSL's PKCS#7 SignedData parsing that prevented correct parsing of bundles where the encapsulated content is a SEQUENCE (per original PKCS#7 spec) rather than an OCTET_STRING (per CMS spec). This issue specifically affected Microsoft Authenticode signatures.

  • Adds streaming variable initialization for non-OCTET_STRING content types to properly track content size and position
  • Fixes degenerate bundle detection by checking signerInfos SET size in addition to the earlier digestAlgorithms check
  • Includes comprehensive test coverage for both streaming and non-streaming parsing of PKCS#7 content with SEQUENCE-based encapsulation

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File Description
wolfcrypt/src/pkcs7.c Initializes streaming variables for PKCS#7 type content, updates degenerate flag detection based on signerInfos SET, and includes minor formatting fixes
tests/api/test_pkcs7.h Adds declaration and test macro for new test function test_wc_PKCS7_VerifySignedData_PKCS7ContentSeq
tests/api/test_pkcs7.c Implements comprehensive test with hand-crafted PKCS#7 SignedData bundle containing SEQUENCE content, testing both streaming and non-streaming verification paths

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@cconlon
Copy link
Member Author

cconlon commented Dec 19, 2025

Retest this please Jenkins. Caused by PRB-generic-config-parser (Unable to create live FilePath for wolf-linux-cloud-node-knyag5; wolf-linux-cloud-node-knyag5 was marked offline: Connection was broken).

@cconlon cconlon assigned wolfSSL-Bot and unassigned cconlon Dec 19, 2025
@JacobBarthelmeh JacobBarthelmeh merged commit 8153ea6 into wolfSSL:master Dec 19, 2025
377 of 378 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants