[kojo1]

Description

WOLFSSL_NO_CRL_NEXT_DATE is documented as "Do not fail if CRL next date is
missing" and is implemented in asn_orig.c, but it had no effect when the
template decoder is used.

Fixes zd#22281

Testing

local test with WOLFSSL_NO_CRL_NEXT_DATE
and certs/crl/crl_no_next_update.pem

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,560 B (+0.5%, 284,008 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11166

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-bugs

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Optional nextUpdate choice accepts two date values · X.509 and ASN.1 parsing vulnerabilities

crlASN makes UTCTime and GeneralizedTime independent optionals, so date-check-disabled builds accept both when the second value is no longer than the first and retain it with the first tag. This is distinct from #7520's duplicate extensions.

Suggested fix: After decoding, reject CRLs where both CRLASN_IDX_TBS_NEXTUPDATE_UTC and CRLASN_IDX_TBS_NEXTUPDATE_GT have nonzero tags.
Basis: RFC 5280 §§4.1 and 5.1 defines Time as a CHOICE and nextUpdate as one optional Time.

[kojo1]

Fixed in . As suggested, ParseCRL now returns ASN_PARSE_E after decoding when both CRLASN_IDX_TBS_NEXTUPDATE_UTC and CRLASN_IDX_TBS_NEXTUPDATE_GT have nonzero tags. The check is inside #ifdef WOLFSSL_NO_CRL_NEXT_DATE, the only build where these are separate optional items.

test_wolfSSL_X509_CRL_no_next_update now covers this with certs/crl/crl_dup_next_update.pem, which has both forms of nextUpdate and must be rejected.

[wolfSSL-Fenrir-bot]

Optional nextUpdate permits omission of mandatory thisUpdate · Logic errors

crlASN reuses global choice 2 for PSS parameters and mandatory thisUpdate, so PSS marks an absent date satisfied. Making nextUpdate optional removes choice 3's fallback rejection, allowing CRLs with neither date. Distinct from #9961's certificate encoding defect.

Suggested fix: Use a distinct mandatory choice for thisUpdate, independent of PSS parameters, and add a missing-thisUpdate rejection test.
Basis: RFC 5280 §5.1 defines thisUpdate Time as mandatory in TBSCertList.

[kojo1]

Fixed in , using a different approach from the suggestion. Instead of adding a distinct choice for thisUpdate, ParseCRL now returns ASN_PARSE_E after decoding when both CRLASN_IDX_TBS_THISUPDATE_UTC and CRLASN_IDX_TBS_THISUPDATE_GT have zero tags.

This enforces the same RFC 5280 requirement while leaving the template's choice numbering unchanged. The check is inside #ifdef WOLFSSL_NO_CRL_NEXT_DATE, because other builds still have choice 3 as the fallback rejection.

test_wolfSSL_X509_CRL_no_next_update now covers this with certs/crl/crl_rsapss_no_dates.pem, an RSA-PSS signed CRL with neither date, which must be rejected.

[Copilot]

🔵 Needs a closer look

Address the test feature-guard issues before approval.

Pull request overview

Adds template ASN.1 decoder support for CRLs missing nextUpdate when WOLFSSL_NO_CRL_NEXT_DATE is enabled.

Changes:

• Makes CRL date fields optional under the feature flag.
• Adds regression coverage and a CRL fixture.
• Includes the fixture in distribution files.

File summaries

File	Summary	Review notes
wolfcrypt/src/asn.c	Updates CRL template handling.	—
tests/api.c	Adds regression coverage.	Moderate (1 vote): adjust feature guards. Nit (1 vote): ensure the test exercises the template decoder.
certs/crl/include.am	Packages the fixture.	—
certs/crl/crl_no_next_update.pem	Provides a CRL without nextUpdate.	—

Review details

Suppressed comments (2)

tests/api.c:28244

• The feature guard is inconsistent with the API used here: NO_BIO does not affect file-based PEM_read_X509_CRL (the implementation is outside the NO_BIO block), so excluding it loses coverage in supported builds, while omitting WOLFSSL_PEM_TO_DER allows the test to run in configurations where src/x509.c:13952-13958 cannot decode PEM and returns NULL. Require WOLFSSL_PEM_TO_DER and drop the NO_BIO condition.
  tests/api.c:28244
• This regression test is gated on WOLFSSL_NO_CRL_NEXT_DATE but not WOLFSSL_ASN_TEMPLATE, so an original-decoder build can pass it without executing the new template entries. Gate it on the template macro (or add a template-configured test run) so this change is actually covered.

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[philljj]

Please review fenrir and copilot issues.