From b0e3910108870b4dae1e56b5f3afdbf574eeee4b Mon Sep 17 00:00:00 2001 From: Kazuki Yamaguchi Date: Tue, 10 Nov 2026 02:18:01 +0900 Subject: [PATCH] pkey: do not retry OSSL_DECODER_from_bio() for DER encoding Retries are only needed for PEM input, where they are used to skip PEM blocks that decode into something other than EVP_PKEY. Such cases should be treated as an error when decoding the input as DER. --- ext/openssl/ossl_pkey.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/ext/openssl/ossl_pkey.c b/ext/openssl/ossl_pkey.c index cc763b31a..50cc94e29 100644 --- a/ext/openssl/ossl_pkey.c +++ b/ext/openssl/ossl_pkey.c @@ -83,8 +83,9 @@ ossl_pkey_wrap(EVP_PKEY *pkey) # include static EVP_PKEY * -ossl_pkey_read(BIO *bio, const char *input_type, int selection, VALUE pass) +ossl_pkey_read(BIO *bio, int from_pem, int selection, VALUE pass) { + const char *input_type = from_pem ? "PEM" : "DER"; void *ppass = (void *)pass; OSSL_DECODER_CTX *dctx; EVP_PKEY *pkey = NULL; @@ -101,7 +102,7 @@ ossl_pkey_read(BIO *bio, const char *input_type, int selection, VALUE pass) while (1) { if (OSSL_DECODER_from_bio(dctx, bio) == 1) goto out; - if (BIO_eof(bio)) + if (!from_pem || BIO_eof(bio)) break; pos2 = BIO_tell(bio); if (pos2 < 0 || pos2 <= pos) @@ -119,9 +120,6 @@ EVP_PKEY * ossl_pkey_read_generic(BIO *bio, VALUE pass) { EVP_PKEY *pkey = NULL; - /* First check DER, then check PEM. */ - const char *input_types[] = {"DER", "PEM"}; - int input_type_num = (int)(sizeof(input_types) / sizeof(char *)); /* * Non-zero selections to try to decode. * @@ -169,9 +167,10 @@ ossl_pkey_read_generic(BIO *bio, VALUE pass) int selection_num = (int)(sizeof(selections) / sizeof(int)); int i, j; - for (i = 0; i < input_type_num; i++) { + /* First check DER, then check PEM. */ + for (i = 0; i <= 1; i++) { for (j = 0; j < selection_num; j++) { - pkey = ossl_pkey_read(bio, input_types[i], selections[j], pass); + pkey = ossl_pkey_read(bio, i, selections[j], pass); if (pkey) { goto out; }