Restrict duplicate netscape certificate type extensions f-10626

[JacobBarthelmeh]

No description provided.

[Copilot]

Pull request overview

This PR tightens X.509 extension parsing by rejecting duplicate occurrences of the Netscape Certificate Type extension, aligning it with existing duplicate-extension detection behavior used for other extensions.

Changes:

• Added a DecodedCert bitfield (extNetscapeCertTypeSet) to track whether the Netscape Certificate Type extension has already been seen (when not compiled with IGNORE_NETSCAPE_CERT_TYPE).
• Enforced “no duplicate extension” behavior for NETSCAPE_CT_OID via the existing VERIFY_AND_SET_OID() mechanism in DecodeExtensionType().

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
wolfssl/wolfcrypt/asn.h	Adds a decode-time “seen” flag for Netscape Cert Type to support duplicate detection.
wolfcrypt/src/asn.c	Rejects repeated NETSCAPE_CT_OID by verifying/setting the new “seen” flag before decoding.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +28 B (+0.0%, 66,883 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m3

• FLASH: .text +20 B (+0.0%, 125,671 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 204,335 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +64 B (+0.1%, 69,411 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 185,660 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 241,057 B / 262,144 B, total: 92% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 204,335 B / 262,144 B, total: 78% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 241,121 B / 262,144 B, total: 92% used)
  No memory changes detected for:
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7-pq
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11236

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

No new issues found in the changed files. ✅