While reviewing the changes between der 0.8.0 and 0.8.1, I noticed that SliceReader::read_nested in src/reader/slice.rs no longer appears to call nested_reader.finish() after the callback returns.
Previously, finish() ensured that the callback consumed the complete contents of the nested value. In the new implementation, the outer reader is restored after the callback, but I could not find an equivalent check for unconsumed bytes in the nested reader.
This appears to mean that a callback could return Ok after consuming only part of the nested value, with the remaining bytes being silently skipped. That could weaken strict DER validation and potentially allow malformed nested values containing trailing data to be accepted.
While reviewing the changes between
der0.8.0 and 0.8.1, I noticed thatSliceReader::read_nestedinsrc/reader/slice.rsno longer appears to callnested_reader.finish()after the callback returns.Previously,
finish()ensured that the callback consumed the complete contents of the nested value. In the new implementation, the outer reader is restored after the callback, but I could not find an equivalent check for unconsumed bytes in the nested reader.This appears to mean that a callback could return
Okafter consuming only part of the nested value, with the remaining bytes being silently skipped. That could weaken strict DER validation and potentially allow malformed nested values containing trailing data to be accepted.