Skip to content

Correctly handle CK_UNAVAILABLE_INFORMATION #200

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

minego
Copy link

@minego minego commented Jun 5, 2025

The PKCS#11 specification states

The constant CK_UNAVAILABLE_INFORMATION is used in the ulValueLen field to denote an invalid or unavailable value. See C_GetAttributeValue for further details.

This MR exposes the CK_UNAVAILABLE_INFORMATION constant definition (along with CK_EFFECTIVELY_INFINITE which is defined next to it, for completeness sake) and checks for that result after calling C_GetAttributeValue

This corrects a crash when a PKCS#11 module returns this. I believe this will fix the following issues:
#139
#60

Prior to this change the returned value was being interpreted as an actual size, which resulted in attempting to allocate an array of size -1 which causes an overflow:

  File "pkcs11/_pkcs11.pyx", line 726, in pkcs11._pkcs11.Object.__getitem__
  File "pkcs11/_utils.pyx", line 11, in pkcs11._pkcs11.CK_BYTE_buffer
  File "stringsource", line 152, in View.MemoryView.array.__cinit__
OverflowError: Python int too large to convert to C ssize_t

Micah N Gorrell added 2 commits June 4, 2025 16:25
… and properly handle a return value of CK_UNAVAILABLE_INFORMATION when requesting attribute values
@minego
Copy link
Author

minego commented Jun 5, 2025

On a related note, I ran into this while trying to use this library with the Venafi Code Signing Client PKCS#11 module. I'd love to get that added to the list of supported modules. What is needed to make this happen?

@jrripple
Copy link

jrripple commented Jun 5, 2025

Nice, I've also been using Venafi and had the same issue. I had a similar solution locally, but I tried out your commits and they fix the issue too.

@minego
Copy link
Author

minego commented Jun 5, 2025

Nice, I've also been using Venafi and had the same issue. I had a similar solution locally, but I tried out your commits and they fix the issue too.

Oh, good! I'm glad to hear that!

I'm one of the developers on the codesigning team at CyberArk (previously Venafi). Thanks for testing the change!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants