From c21f3ed15976421f8bfd125da34f3b15fbeb05e7 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Sun, 30 Aug 2026 16:55:41 +0000
Subject: Add test case causing an OOB access in PKCS7_stream

Test case originally from openssl/openssl#31681, exercised via a direct
call to PKCS7_stream() as in a report from Acts1631.
To be fixed in pk7_lib.c r1.33
---
 src/regress/lib/libcrypto/pkcs7/pkcs7test.c | 62 ++++++++++++++++++++++++++++-
 1 file changed, 61 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/regress/lib/libcrypto/pkcs7/pkcs7test.c b/src/regress/lib/libcrypto/pkcs7/pkcs7test.c
index ae7c41299b..6a3bcce3d1 100644
--- a/src/regress/lib/libcrypto/pkcs7/pkcs7test.c
+++ b/src/regress/lib/libcrypto/pkcs7/pkcs7test.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pkcs7test.c,v 1.7 2026/08/30 16:52:07 tb Exp $	*/
+/*	$OpenBSD: pkcs7test.c,v 1.8 2026/08/30 16:55:41 tb Exp $	*/
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2026 Theo Buehler <tb@openbsd.org>
@@ -399,6 +399,65 @@ pkcs7_stream_missing_content(void)
 	return failed;
 }
 
+/*
+ * SEQUENCE {
+ *   # signedData
+ *   OBJECT_IDENTIFIER { 1.2.840.113549.1.7.2 }
+ *   [0] {
+ *     SEQUENCE {
+ *       INTEGER { 1 }
+ *       SET {}
+ *       SEQUENCE {
+ *         # id-ct-TSTInfo
+ *         OBJECT_IDENTIFIER { 1.2.840.113549.1.9.16.1.4 }
+ *         [0] {
+ *           SEQUENCE {
+ *             INTEGER { 1 }
+ *             OCTET_STRING { `deadbeef` }
+ *           }
+ *         }
+ *       }
+ *       SET {}
+ *     }
+ *   }
+ * }
+ */
+static const uint8_t pkcs7_malformed_der[] = {
+	 0x30, 0x32, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
+	 0xf7, 0x0d, 0x01, 0x07, 0x02, 0xa0, 0x25, 0x30,
+	 0x23, 0x02, 0x01, 0x01, 0x31, 0x00, 0x30, 0x1a,
+	 0x06, 0x0b, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
+	 0x01, 0x09, 0x10, 0x01, 0x04, 0xa0, 0x0b, 0x30,
+	 0x09, 0x02, 0x01, 0x01, 0x04, 0x04, 0xde, 0xad,
+	 0xbe, 0xef, 0x31, 0x00,
+};
+static int pkcs7_malformed_der_len = sizeof(pkcs7_malformed_der);
+
+static int
+pkcs7_stream_signedData_oob(void)
+{
+	PKCS7 *p7 = NULL;
+	const unsigned char *p;
+	unsigned char **boundary = NULL;
+	int ret;
+	int failed = 1;
+
+	p = pkcs7_malformed_der;
+	if ((p7 = d2i_PKCS7(NULL, &p, pkcs7_malformed_der_len)) == NULL)
+		fatal("d2i_PKCS7 malformed");
+
+	if ((ret = PKCS7_stream(&boundary, p7)) != 0) {
+		fprintf(stderr, "FAILURE: PKCS7_stream want 0, got %d\n", ret);
+		goto out;
+	}
+
+	failed = 0;
+ out:
+	PKCS7_free(p7);
+
+	return failed;
+}
+
 int
 main(int argc, char **argv)
 {
@@ -406,6 +465,7 @@ main(int argc, char **argv)
 
 	failed |= pkcs7_basics();
 	failed |= pkcs7_stream_missing_content();
+	failed |= pkcs7_stream_signedData_oob();
 
 	return failed;
 }
-- 
cgit v1.2.3-55-g6feb