From a271385d5f190db4a53b427d7466363efab4dd4d Mon Sep 17 00:00:00 2001 From: lazerg Date: Mon, 12 Oct 2026 19:48:22 +0500 Subject: [PATCH 1/3] crypto: fix X509 curve name crash for non-NIST curves Signed-off-by: lazerg Assisted-by: Claude Code --- src/crypto/crypto_x509.cc | 7 ++++--- test/parallel/test-crypto-x509.js | 21 +++++++++++++++++++++ 2 files changed, 25 insertions(+), 3 deletions(-) diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc index 14825742e986..a1cbeb794539 100644 --- a/src/crypto/crypto_x509.cc +++ b/src/crypto/crypto_x509.cc @@ -699,9 +699,10 @@ MaybeLocal GetECGroupBits(Environment* env, const EC_GROUP* group) { template MaybeLocal GetCurveName(Environment* env, const int nid) { - std::string_view name = nid2string(nid); - return name.size() ? MaybeLocal(OneByteString(env->isolate(), name)) - : MaybeLocal(Undefined(env->isolate())); + const char* name = nid2string(nid); + return name != nullptr + ? MaybeLocal(OneByteString(env->isolate(), name)) + : MaybeLocal(Undefined(env->isolate())); } MaybeLocal X509ToObject(Environment* env, const X509View& cert) { diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js index c8f44372f975..5c2c8c26586d 100644 --- a/test/parallel/test-crypto-x509.js +++ b/test/parallel/test-crypto-x509.js @@ -514,3 +514,24 @@ CQAAAAAAAAAAAA== assert.strictEqual(cert.signatureAlgorithm, undefined); assert.strictEqual(cert.signatureAlgorithmOid, '1.3.6.1.4.1.99999.1'); } + +{ + // EC certificate on a curve without a NIST name (brainpoolP256r1). + const certPem = `-----BEGIN CERTIFICATE----- +MIIBfzCCASagAwIBAgIUcZKohGvML9PeBwQtylddAdUU3nkwCgYIKoZIzj0EAwIw +FDESMBAGA1UEAwwJYnJhaW5wb29sMCAXDTI2MTAxMjE0NDczMVoYDzIxMjYwOTE4 +MTQ0NzMxWjAUMRIwEAYDVQQDDAlicmFpbnBvb2wwWjAUBgcqhkjOPQIBBgkrJAMD +AggBAQcDQgAEKnP14jKQEUyWxWhXrs+ql7OlMy0EW3mnYTvwkF8VyYsPB9dBUJOW +8IHqIik0kjQVSVhtLH0j+hveyZvGd0aQq6NTMFEwHQYDVR0OBBYEFNx4uQEsAiNZ +zcrKuAZ9/9d1eIeDMB8GA1UdIwQYMBaAFNx4uQEsAiNZzcrKuAZ9/9d1eIeDMA8G +A1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwIDRwAwRAIgHc4TOjOLOPXrvWXRQ44L +jEVmV959vS0DtFIIsrGT3moCIBBRZWdLdd0YjFHUQshMZFM9BN2INpjFNUUxqPAC +3qPo +-----END CERTIFICATE-----`; + + if (!isBoringSSL) { + const legacyObject = new X509Certificate(certPem).toLegacyObject(); + assert.strictEqual(legacyObject.asn1Curve, 'brainpoolP256r1'); + assert.strictEqual(legacyObject.nistCurve, undefined); + } +} From 7a58cc4cf9e44eb7d75d2768a87239baee68260e Mon Sep 17 00:00:00 2001 From: lazerg Date: Tue, 13 Oct 2026 15:47:38 +0500 Subject: [PATCH 2/3] test: skip brainpool assertion in FIPS builds Signed-off-by: lazerg Assisted-by: Claude Code --- test/parallel/test-crypto-x509.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js index 5c2c8c26586d..95a14abaf744 100644 --- a/test/parallel/test-crypto-x509.js +++ b/test/parallel/test-crypto-x509.js @@ -19,7 +19,7 @@ const { const assert = require('assert'); const fixtures = require('../common/fixtures'); -const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto'); const { readFileSync } = require('fs'); const cert = readFileSync(fixtures.path('keys', 'agent1-cert.pem')); @@ -531,7 +531,9 @@ jEVmV959vS0DtFIIsrGT3moCIBBRZWdLdd0YjFHUQshMZFM9BN2INpjFNUUxqPAC if (!isBoringSSL) { const legacyObject = new X509Certificate(certPem).toLegacyObject(); - assert.strictEqual(legacyObject.asn1Curve, 'brainpoolP256r1'); + if (!hasFIPS()) { + assert.strictEqual(legacyObject.asn1Curve, 'brainpoolP256r1'); + } assert.strictEqual(legacyObject.nistCurve, undefined); } } From 39981522c005514a5934b1e0f0b012465cddd4db Mon Sep 17 00:00:00 2001 From: lazerg Date: Tue, 13 Oct 2026 20:53:31 +0500 Subject: [PATCH 3/3] test: allow missing brainpool curve name Signed-off-by: lazerg Assisted-by: Claude Code --- test/parallel/test-crypto-x509.js | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js index 95a14abaf744..c26033548975 100644 --- a/test/parallel/test-crypto-x509.js +++ b/test/parallel/test-crypto-x509.js @@ -19,7 +19,7 @@ const { const assert = require('assert'); const fixtures = require('../common/fixtures'); -const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto'); +const { hasOpenSSL, isBoringSSL } = require('../common/crypto'); const { readFileSync } = require('fs'); const cert = readFileSync(fixtures.path('keys', 'agent1-cert.pem')); @@ -515,7 +515,7 @@ CQAAAAAAAAAAAA== assert.strictEqual(cert.signatureAlgorithmOid, '1.3.6.1.4.1.99999.1'); } -{ +if (!isBoringSSL) { // EC certificate on a curve without a NIST name (brainpoolP256r1). const certPem = `-----BEGIN CERTIFICATE----- MIIBfzCCASagAwIBAgIUcZKohGvML9PeBwQtylddAdUU3nkwCgYIKoZIzj0EAwIw @@ -529,11 +529,7 @@ jEVmV959vS0DtFIIsrGT3moCIBBRZWdLdd0YjFHUQshMZFM9BN2INpjFNUUxqPAC 3qPo -----END CERTIFICATE-----`; - if (!isBoringSSL) { - const legacyObject = new X509Certificate(certPem).toLegacyObject(); - if (!hasFIPS()) { - assert.strictEqual(legacyObject.asn1Curve, 'brainpoolP256r1'); - } - assert.strictEqual(legacyObject.nistCurve, undefined); - } + const legacyObject = new X509Certificate(certPem).toLegacyObject(); + assert.ok([undefined, 'brainpoolP256r1'].includes(legacyObject.asn1Curve)); + assert.strictEqual(legacyObject.nistCurve, undefined); }