From 986066c856d33a18703a06e6ccd01555aee44383 Mon Sep 17 00:00:00 2001 From: JacobBarthelmeh Date: Fri, 21 Aug 2026 13:19:09 -0600 Subject: [PATCH] Restrict duplicate netscape certificate type extensions f-10626 --- wolfcrypt/src/asn.c | 1 + wolfssl/wolfcrypt/asn.h | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c index ad2e09c14f..55c3feb9ef 100644 --- a/wolfcrypt/src/asn.c +++ b/wolfcrypt/src/asn.c @@ -22744,6 +22744,7 @@ WOLFSSL_TEST_VIS int DecodeExtensionType(const byte* input, word32 length, #ifndef IGNORE_NETSCAPE_CERT_TYPE /* Netscape's certificate type. */ case NETSCAPE_CT_OID: + VERIFY_AND_SET_OID(cert->extNetscapeCertTypeSet); if (DecodeNsCertType(input, (int)length, cert) < 0) ret = ASN_PARSE_E; break; diff --git a/wolfssl/wolfcrypt/asn.h b/wolfssl/wolfcrypt/asn.h index 308acc14d5..a1d042c83a 100644 --- a/wolfssl/wolfcrypt/asn.h +++ b/wolfssl/wolfcrypt/asn.h @@ -2182,7 +2182,10 @@ struct DecodedCert { WC_BITFIELD extPolicyConstIpmSet:1; /* inhibitPolicyMapping set */ WC_BITFIELD extSubjAltNameSet:1; WC_BITFIELD inhibitAnyOidSet:1; - WC_BITFIELD selfSigned:1; /* Indicates subject and issuer are same */ +#ifndef IGNORE_NETSCAPE_CERT_TYPE + WC_BITFIELD extNetscapeCertTypeSet:1; /* Netscape certificate type seen */ +#endif + WC_BITFIELD selfSigned:1; /* Indicates subject and issuer are same */ #if defined(WOLFSSL_SEP) || defined(WOLFSSL_CERT_EXT) WC_BITFIELD extCertPolicySet:1; #endif