Fix X509 DN comparisons

CVE-2017-2801

3 files changed, 70 insertions, 0 deletions

diff --git a/src/tests/data/fuzz/x509/cve_2017_2801.der b/src/tests/data/fuzz/x509/cve_2017_2801.der
new file mode 100644
index 000000000..fe615d2c4
--- /dev/null
+++ b/src/tests/data/fuzz/x509/cve_2017_2801.der
diff --git a/src/tests/data/x509_dn.vec b/src/tests/data/x509_dn.vec
new file mode 100644
index 000000000..ab9e2dec3
--- /dev/null
+++ b/src/tests/data/x509_dn.vec
@@ -0,0 +1,14 @@
+
+[Equal]
+DN1 = 301C310B3009060355040613025654310D300B0603550403130454455354
+DN2 = 301C310B3009060355040613025654310D300B0603550403130454455354
+
+[Unequal]
+DN1 = 301C310B3009060355040613025654310D300B0603550403130454450054
+DN2 = 301C310B3009060355040613025600310D300B0603550403130454455354
+
+DN1 = 3019311730150603550403140E4141200141414141414141414141
+DN2 = 3019311730150603550403130E4141202020202020202020202020
+
+DN1 = 3018311630140603550403130D41412041414141414141414141
+DN2 = 3019311730150603550403130E4141202020202020202020202020
diff --git a/src/tests/test_x509_dn.cpp b/src/tests/test_x509_dn.cpp
new file mode 100644
index 000000000..3a2fdf7d0
--- /dev/null
+++ b/src/tests/test_x509_dn.cpp
@@ -0,0 +1,56 @@
+/*
+* (C) 2017 Jack Lloyd
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include "tests.h"
+
+#if defined(BOTAN_HAS_ASN1)
+  #include <botan/x509_dn.h>
+  #include <botan/ber_dec.h>
+#endif
+
+namespace Botan_Tests {
+
+#if defined(BOTAN_HAS_ASN1)
+class X509_DN_Comparisons_Tests : public Text_Based_Test
+   {
+   public:
+      X509_DN_Comparisons_Tests() :
+         Text_Based_Test("x509_dn.vec", "DN1,DN2")
+         {}
+
+      Test::Result run_one_test(const std::string& type, const VarMap& vars) override
+         {
+         const std::vector<uint8_t> dn_bits1 = get_req_bin(vars, "DN1");
+         const std::vector<uint8_t> dn_bits2 = get_req_bin(vars, "DN2");
+         const bool dn_same = (type == "Equal");
+
+         Test::Result result("X509_DN comparisons");
+         try
+            {
+            Botan::X509_DN dn1;
+            Botan::BER_Decoder bd1(dn_bits1);
+            dn1.decode_from(bd1);
+
+            Botan::X509_DN dn2;
+            Botan::BER_Decoder bd2(dn_bits2);
+            dn2.decode_from(bd2);
+
+            const bool compared_same = (dn1 == dn2);
+            result.test_eq("Comparison matches expected", dn_same, compared_same);
+            }
+         catch(Botan::Exception& e)
+            {
+            result.test_failure(e.what());
+            }
+
+         return result;
+         }
+   };
+
+BOTAN_REGISTER_TEST("x509_dn_cmp", X509_DN_Comparisons_Tests);
+#endif
+
+}