Avoid panicking when the contents of a CT poison extension are truncated (#478)

robstradling · phillip-stephens · web-flow · commit 0e3c42de5a13 · 2026-03-09T17:48:58.000Z
Co-authored-by: Phillip Stephens &lt;phillip@cs.stanford.edu&gt;
diff --git a/x509/x509.go b/x509/x509.go
@@ -2112,7 +2112,7 @@ func parseCertificate(in *certificate) (*Certificate, error) {
 				return nil, err
 			}
 		} else if e.Id.Equal(oidExtensionCTPrecertificatePoison) {
-			if e.Value[0] == 5 && e.Value[1] == 0 {
+			if len(e.Value) == 2 && e.Value[0] == 5 && e.Value[1] == 0 {
 				out.IsPrecert = true
 				continue
 			} else {

Original file line number	Diff line number	Diff line change
`@@ -2112,7 +2112,7 @@ func parseCertificate(in certificate) (Certificate, error) {`
`2112`	`2112`	`return nil, err`
`2113`	`2113`	`}`
`2114`	`2114`	`} else if e.Id.Equal(oidExtensionCTPrecertificatePoison) {`
`2115`		`- if e.Value[0] == 5 && e.Value[1] == 0 {`
	`2115`	`+ if len(e.Value) == 2 && e.Value[0] == 5 && e.Value[1] == 0 {`
`2116`	`2116`	`out.IsPrecert = true`
`2117`	`2117`	`continue`
`2118`	`2118`	`} else {`