X.509 AttributeTypeAndValue parsing doesn't respect bounds

[hanno-becker]

Context: This is about the parsing of the X.509 structure

   AttributeTypeAndValue ::= SEQUENCE {
     type     AttributeType,
     value    AttributeValue }

in x509_get_attr_type_and_value() from library/x509.c:
https://github.com/ARMmbed/mbedtls/blob/f352f75f6bd5734c8f671323dd6ab32472d5da34/library/x509.c#L344-L370

Issue: The function doesn't obey the len bound for the outer SEQUENCE. Instead, it only makes sure that the parsing doesn't read past the surrounding

   RelativeDistinguishedName ::=
     SET SIZE (1..MAX) OF AttributeTypeAndValue

the end of which is passed to the function as end. For example, if the length of the outer SEQUENCE is 0 but there's more space remaining in the current SET, the function won't fail. This situation is actually exercised by the test https://github.com/ARMmbed/mbedtls/blob/development/tests/suites/test_suite_x509parse.data#L1001 which wrongly expects MBEDTLS_ERR_X509_INVALID_NAME + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG, where it should be MBEDTLS_ERR_X509_INVALID_NAME + MBEDTLS_ERR_ASN1_OUT_OF_DATA.

This is not a security issue because the bounds of the surrounding SET are obeyed.

[ciarmcom]

ARM Internal Ref: IOTSSL-2780

[hanno-becker]

There is an analogous issue with the v3 extension parsing function x509_get_crt_ext():
https://github.com/ARMmbed/mbedtls/blob/f352f75f6bd5734c8f671323dd6ab32472d5da34/library/x509_crt.c#L694-L714
The call to mbedtls_x509_get_ext() reads the extensions header but doesn't update the end pointer, so that the subsequent parsing of extensions will treat everything until the end of the TBSCertificate as a potential extension. In fact, in the existing X.509 test "X509 Certificate ASN1 (SubjectAltName repeated)" the duplicated SubjectAltName extension is added outside of the Extensions block, but it still parsed; here we should fail with a MBEDTLS_ERR_ASN1_LENGTH_MISMATCH instead.