tests: add tests for parsing invalid der sigs
What the developer wrote
Authored by Jon Griffiths
tests: add tests for parsing invalid der sigs
What changed, and why it matters
This commit only adds new test cases to check that the library correctly rejects malformed cryptographic signatures. It does not change any production code, so by itself it cannot introduce or fix a security vulnerability. It may be related to earlier work that hardened signature parsing, but the diff only contains tests.
No action required for this commit alone. If reviewing a series, verify that any related production-code hardening for DER parsing is present in adjacent commits.
Security signals we found
DER signature parsing validation is being exercised
Test vectors include R/S overflow and zero R/S cases
No functional code change in this commit
Evidence from the diff
The change adds a unit test test_der_convert in src/test/test_sign.py that feeds three invalid DER-encoded ECDSA signatures to wally_ec_sig_from_der and asserts each returns WALLY_EINVAL. The test vectors cover R/S overflow and R or S equal to zero. No library implementation code is modified.
Changed components
src/test/test_sign.pyInspect captured patch +11 / −0
diff --git a/src/test/test_sign.py b/src/test/test_sign.py
index 6319935..4aec728 100755
--- a/src/test/test_sign.py
+++ b/src/test/test_sign.py
@@ -92,6 +92,17 @@ class SignTests(unittest.TestCase):
set_fake_ec_nonce(None)
+ def test_der_convert(self):
+ out_buf, out_len = make_cbuffer('00' * EC_SIGNATURE_LEN)
+ long_der = '3081c4026001aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa026001bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
+ for bad_der in [
+ long_der, # R or S overflow
+ '3006020100020101', # R = 0
+ '3006020101020100' # S = 0
+ ]:
+ der, der_len = make_cbuffer(bad_der)
+ ret = wally_ec_sig_from_der(der, der_len, out_buf, out_len)
+ self.assertEqual(ret, WALLY_EINVAL)
def test_invalid_inputs(self):
out_buf, out_len = make_cbuffer('00' * EC_SIGNATURE_LEN)
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.