OCSPResp and OCSPReq now report any malformed encoding as CertIOException, the OCSP ASN.1 types refuse a short SEQUENCE or an element of the wrong type with IllegalArgumentException and accept a non-DER signature BIT STRING, and the provider's OCSP revocation checking reports a response that will not decode as a CertPathValidatorException, relates to github #2468.

Author: dghgit

CONTRIBUTORS.md

@@ -532,7 +532,7 @@ We also wish to acknowledge financial and collaborative support from [CISCO](htt
 - subbudvk \<https://github.com/subbudvk\> - initial author on S2K parser hardening work for OpenPGP API.
 - mkarasik \<https://github.com/mkarasik\> - initial work on EST server-side key generation (RFC 7030 4.4).
 - Bernd Prünster (A-SIT Plus) \<bernd.pruenster&#064;a-sit.at\> - reported lenient ASN.1 UTCTime/GeneralizedTime parsing accepting structurally malformed content, with fuzzing-derived test cases. Additional fuzzing around date validity as well.
-- Naveed Khan \<https://github.com/rootvector2\> - constant time comparison of membership and confirmation tags in the MLS API. Reported unbounded array allocation in the BKS/UBER keystore load path (OutOfMemoryError DoS from a crafted keystore) and introduction of a capped decompression limit in PGPCompressedData.getDataStream(), both with POC. Original submission creating S/MIME backing temp files with owner-only permissions (PR #2326). Rejecting empty sequences in the X.509 extension parsers whose RFC 5280 syntax is SEQUENCE SIZE (1..MAX) - CRLDistPoint, CertificatePolicies, ExtendedKeyUsage, PolicyMappings, and SubjectDirectoryAttributes (PR #2331). Hardening asn1.cms.SignerInfo decode to reject a non-INTEGER version or non-tagged unsignedAttrs via getInstance rather than leaking a ClassCastException (PR #2342). Fixing an off-by-4 header-length guard in the OpenPGP NotationData signature subpacket parser (PR #2346). Rejecting CR/LF in the S/MIME streaming writer header names and values (SMIMEEnvelopedWriter/SMIMESignedWriter withHeader) to prevent MIME header injection (PR #2348). Adding minimum-length guards to the SM2 decrypt and GOST28147/DSTU7624/DESede/RC2 key-wrap unwrap paths (PR #2359). Guarding the ECDH session-key length in the JCE OpenPGP decryptor (PR #2383). Fixing the identity fast-path type guards in the OER getInstance factories and the transposed isInstance arguments in OEROptional.getObject (PR #2373). Requiring the signature handed to AIMerSigner.verifySignature to be exactly the parameter set's signature size (PR #2401). Constant time comparison of the SRP-6a evidence messages (PR #2406). Surfacing a malformed TSTInfo in a time-stamp token as TSPException rather than an unchecked exception out of the TimeStampResponse constructors (PR #2415). Rejecting a PKCS#12 PBMAC1 KDF keyLength below the RFC 9579 sec. 9 floor of 20 octets (PR #2431). Initial implementation of the empty-label guard on name-constraint host matching, having found that the canonicalisation removed only one RFC 1034 root-label dot, so a dNSName, rfc822Name host or URI host carrying more than one matched no constraint at all (PR #2436). Initial implementation of the lookup of indirect CRL entries by issuer and serial number, having found that the certification path validators compared only the issuer of the first entry carrying a certificate's serial number (PR #2464).
+- Naveed Khan \<https://github.com/rootvector2\> - constant time comparison of membership and confirmation tags in the MLS API. Reported unbounded array allocation in the BKS/UBER keystore load path (OutOfMemoryError DoS from a crafted keystore) and introduction of a capped decompression limit in PGPCompressedData.getDataStream(), both with POC. Original submission creating S/MIME backing temp files with owner-only permissions (PR #2326). Rejecting empty sequences in the X.509 extension parsers whose RFC 5280 syntax is SEQUENCE SIZE (1..MAX) - CRLDistPoint, CertificatePolicies, ExtendedKeyUsage, PolicyMappings, and SubjectDirectoryAttributes (PR #2331). Hardening asn1.cms.SignerInfo decode to reject a non-INTEGER version or non-tagged unsignedAttrs via getInstance rather than leaking a ClassCastException (PR #2342). Fixing an off-by-4 header-length guard in the OpenPGP NotationData signature subpacket parser (PR #2346). Rejecting CR/LF in the S/MIME streaming writer header names and values (SMIMEEnvelopedWriter/SMIMESignedWriter withHeader) to prevent MIME header injection (PR #2348). Adding minimum-length guards to the SM2 decrypt and GOST28147/DSTU7624/DESede/RC2 key-wrap unwrap paths (PR #2359). Guarding the ECDH session-key length in the JCE OpenPGP decryptor (PR #2383). Fixing the identity fast-path type guards in the OER getInstance factories and the transposed isInstance arguments in OEROptional.getObject (PR #2373). Requiring the signature handed to AIMerSigner.verifySignature to be exactly the parameter set's signature size (PR #2401). Constant time comparison of the SRP-6a evidence messages (PR #2406). Surfacing a malformed TSTInfo in a time-stamp token as TSPException rather than an unchecked exception out of the TimeStampResponse constructors (PR #2415). Rejecting a PKCS#12 PBMAC1 KDF keyLength below the RFC 9579 sec. 9 floor of 20 octets (PR #2431). Initial implementation of the empty-label guard on name-constraint host matching, having found that the canonicalisation removed only one RFC 1034 root-label dot, so a dNSName, rfc822Name host or URI host carrying more than one matched no constraint at all (PR #2436). Initial implementation of the lookup of indirect CRL entries by issuer and serial number, having found that the certification path validators compared only the issuer of the first entry carrying a certificate's serial number (PR #2464). Initial implementation of the malformed-input handling of the OCSPResp and OCSPReq parsers (PR #2468).
 - suraj0208 \<https://github.com/suraj0208\> - initial work on auto-detecting private key reader (JcaPrivateKeyReader).
 - liamgilligan \<https://github.com/liamgilligan\> - noticing the BIP-340 step numbering in the BIP340Signer signing comments was incorrect (PR #2340).
 - digi-scrypt \<https://github.com/digi-scrypt\> - disabling DTD and external-entity resolution in KMIPInputStream to close an XXE (local file disclosure / SSRF) exposure in KMIP XML parsing (PR #2315).

core/src/main/java/org/bouncycastle/asn1/ocsp/BasicOCSPResponse.java

@@ -1,5 +1,6 @@
 package org.bouncycastle.asn1.ocsp;
 
+import org.bouncycastle.asn1.ASN1BitString;
 import org.bouncycastle.asn1.ASN1EncodableVector;
 import org.bouncycastle.asn1.ASN1Object;
 import org.bouncycastle.asn1.ASN1Primitive;
@@ -43,13 +44,18 @@ public BasicOCSPResponse(
     private BasicOCSPResponse(
         ASN1Sequence    seq)
     {
+        if (seq.size() < 3)
+        {
+            throw new IllegalArgumentException("Bad sequence size: " + seq.size());
+        }
+
         this.tbsResponseData = ResponseData.getInstance(seq.getObjectAt(0));
         this.signatureAlgorithm = AlgorithmIdentifier.getInstance(seq.getObjectAt(1));
-        this.signature = (DERBitString)seq.getObjectAt(2);
+        this.signature = DERBitString.convert(ASN1BitString.getInstance(seq.getObjectAt(2)));
 
         if (seq.size() > 3)
         {
-            this.certs = ASN1Sequence.getInstance((ASN1TaggedObject)seq.getObjectAt(3), true);
+            this.certs = ASN1Sequence.getInstance(ASN1TaggedObject.getInstance(seq.getObjectAt(3)), true);
         }
     }
 

core/src/main/java/org/bouncycastle/asn1/ocsp/CertID.java

@@ -41,9 +41,9 @@ private CertID(
         }
 
         hashAlgorithm = AlgorithmIdentifier.getInstance(seq.getObjectAt(0));
-        issuerNameHash = (ASN1OctetString)seq.getObjectAt(1);
-        issuerKeyHash = (ASN1OctetString)seq.getObjectAt(2);
-        serialNumber = (ASN1Integer)seq.getObjectAt(3);
+        issuerNameHash = ASN1OctetString.getInstance(seq.getObjectAt(1));
+        issuerKeyHash = ASN1OctetString.getInstance(seq.getObjectAt(2));
+        serialNumber = ASN1Integer.getInstance(seq.getObjectAt(3));
     }
 
     public static CertID getInstance(

core/src/main/java/org/bouncycastle/asn1/ocsp/OCSPRequest.java

@@ -25,12 +25,17 @@ public OCSPRequest(
     private OCSPRequest(
         ASN1Sequence    seq)
     {
+        if (seq.size() < 1)
+        {
+            throw new IllegalArgumentException("Bad sequence size: " + seq.size());
+        }
+
         tbsRequest = TBSRequest.getInstance(seq.getObjectAt(0));
 
         if (seq.size() == 2)
         {
             optionalSignature = Signature.getInstance(
-                                (ASN1TaggedObject)seq.getObjectAt(1), true);
+                                ASN1TaggedObject.getInstance(seq.getObjectAt(1)), true);
         }
     }
 

core/src/main/java/org/bouncycastle/asn1/ocsp/OCSPResponse.java

@@ -36,12 +36,17 @@ public OCSPResponse(
     private OCSPResponse(
         ASN1Sequence    seq)
     {
+        if (seq.size() < 1)
+        {
+            throw new IllegalArgumentException("Bad sequence size: " + seq.size());
+        }
+
         responseStatus = OCSPResponseStatus.getInstance(seq.getObjectAt(0));
 
         if (seq.size() == 2)
         {
             responseBytes = ResponseBytes.getInstance(
-                                (ASN1TaggedObject)seq.getObjectAt(1), true);
+                                ASN1TaggedObject.getInstance(seq.getObjectAt(1)), true);
         }
     }
 

core/src/main/java/org/bouncycastle/asn1/ocsp/Request.java

@@ -26,12 +26,17 @@ public Request(
     private Request(
         ASN1Sequence    seq)
     {
+        if (seq.size() < 1)
+        {
+            throw new IllegalArgumentException("Bad sequence size: " + seq.size());
+        }
+
         reqCert = CertID.getInstance(seq.getObjectAt(0));
 
         if (seq.size() == 2)
         {
             singleRequestExtensions = Extensions.getInstance(
-                                (ASN1TaggedObject)seq.getObjectAt(1), true);
+                                ASN1TaggedObject.getInstance(seq.getObjectAt(1)), true);
         }
     }
 

core/src/main/java/org/bouncycastle/asn1/ocsp/ResponseBytes.java

@@ -38,8 +38,8 @@ private ResponseBytes(
             throw new IllegalArgumentException("Bad sequence size: " + seq.size());
         }
 
-        responseType = (ASN1ObjectIdentifier)seq.getObjectAt(0);
-        response = (ASN1OctetString)seq.getObjectAt(1);
+        responseType = ASN1ObjectIdentifier.getInstance(seq.getObjectAt(0));
+        response = ASN1OctetString.getInstance(seq.getObjectAt(1));
     }
 
     public static ResponseBytes getInstance(

core/src/main/java/org/bouncycastle/asn1/ocsp/ResponseData.java

@@ -80,6 +80,11 @@ private ResponseData(
     {
         int index = 0;
 
+        if (seq.size() < 3)
+        {
+            throw new IllegalArgumentException("Bad sequence size: " + seq.size());
+        }
+
         if (seq.getObjectAt(0) instanceof ASN1TaggedObject)
         {
             ASN1TaggedObject    o = (ASN1TaggedObject)seq.getObjectAt(0);
@@ -101,14 +106,19 @@ private ResponseData(
             this.version = V1;
         }
 
+        if (seq.size() < index + 3)
+        {
+            throw new IllegalArgumentException("Bad sequence size: " + seq.size());
+        }
+
         this.responderID = ResponderID.getInstance(seq.getObjectAt(index++));
         this.producedAt = ASN1GeneralizedTime.getInstance(seq.getObjectAt(index++));
-        this.responses = (ASN1Sequence)seq.getObjectAt(index++);
+        this.responses = ASN1Sequence.getInstance(seq.getObjectAt(index++));
 
         if (seq.size() > index)
         {
             this.responseExtensions = Extensions.getInstance(
-                                (ASN1TaggedObject)seq.getObjectAt(index), true);
+                                ASN1TaggedObject.getInstance(seq.getObjectAt(index)), true);
         }
     }
 

core/src/main/java/org/bouncycastle/asn1/ocsp/RevokedInfo.java

@@ -43,7 +43,7 @@ private RevokedInfo(
         if (seq.size() > 1)
         {
             this.revocationReason = CRLReason.getInstance(ASN1Enumerated.getInstance(
-                (ASN1TaggedObject)seq.getObjectAt(1), true));
+                ASN1TaggedObject.getInstance(seq.getObjectAt(1)), true));
         }
     }
 

core/src/main/java/org/bouncycastle/asn1/ocsp/Signature.java

@@ -1,5 +1,6 @@
 package org.bouncycastle.asn1.ocsp;
 
+import org.bouncycastle.asn1.ASN1BitString;
 import org.bouncycastle.asn1.ASN1EncodableVector;
 import org.bouncycastle.asn1.ASN1Object;
 import org.bouncycastle.asn1.ASN1Primitive;
@@ -44,12 +45,12 @@ private Signature(
         }
 
         signatureAlgorithm  = AlgorithmIdentifier.getInstance(seq.getObjectAt(0));
-        signature = (DERBitString)seq.getObjectAt(1);
+        signature = DERBitString.convert(ASN1BitString.getInstance(seq.getObjectAt(1)));
 
         if (seq.size() == 3)
         {
             certs = ASN1Sequence.getInstance(
-                                (ASN1TaggedObject)seq.getObjectAt(2), true);
+                                ASN1TaggedObject.getInstance(seq.getObjectAt(2)), true);
         }
     }