From: Sergey Matveev <stargrave@stargrave.org>
Date: Sat, 8 Feb 2020 09:54:39 +0000 (+0300)
Subject: All OID arcs must be non-negative numbers
X-Git-Tag: 6.1~14
X-Git-Url: http://www.git.cypherpunks.ru/?p=pyderasn.git;a=commitdiff_plain;h=333d098f0af80eae5481c99b86419d25ea927d22

All OID arcs must be non-negative numbers
---

diff --git a/VERSION b/VERSION
index e0ea36f..a435f5a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-6.0
+6.1
diff --git a/doc/install.rst b/doc/install.rst
index 074a774..bd3adc8 100644
--- a/doc/install.rst
+++ b/doc/install.rst
@@ -4,11 +4,11 @@ Install
 Preferable way is to :ref:`download <download>` tarball with the
 signature from `official website <http://pyderasn.cypherpunks.ru/>`__::
 
-    $ [fetch|wget] http://pyderasn.cypherpunks.ru/pyderasn-6.0.tar.xz
-    $ [fetch|wget] http://pyderasn.cypherpunks.ru/pyderasn-6.0.tar.xz.sig
-    $ gpg --verify pyderasn-6.0.tar.xz.sig pyderasn-6.0.tar.xz
-    $ xz --decompress --stdout pyderasn-6.0.tar.xz | tar xf -
-    $ cd pyderasn-6.0
+    $ [fetch|wget] http://pyderasn.cypherpunks.ru/pyderasn-6.1.tar.xz
+    $ [fetch|wget] http://pyderasn.cypherpunks.ru/pyderasn-6.1.tar.xz.sig
+    $ gpg --verify pyderasn-6.1.tar.xz.sig pyderasn-6.1.tar.xz
+    $ xz --decompress --stdout pyderasn-6.1.tar.xz | tar xf -
+    $ cd pyderasn-6.1
     $ python setup.py install
     # or copy pyderasn.py (+six.py, possibly termcolor.py) to your PYTHONPATH
 
@@ -19,7 +19,7 @@ You can also find it mirrored on :ref:`download <download>` page.
 You could use pip (**no** OpenPGP authentication is performed!) with PyPI::
 
     $ cat > requirements.txt <<EOF
-    pyderasn==6.0 --hash=sha256:TODO
+    pyderasn==6.1 --hash=sha256:TO-BE-FILLED
     six==1.14.0 --hash=sha256:236bdbdce46e6e6a3d61a337c0f8b763ca1e8717c03b369e87a7ec7ce1319c0a
     EOF
     $ pip install --requirement requirements.txt
diff --git a/doc/news.rst b/doc/news.rst
index a454284..b6b3e1b 100644
--- a/doc/news.rst
+++ b/doc/news.rst
@@ -1,6 +1,12 @@
 News
 ====
 
+.. _release6.1:
+
+6.1
+---
+* Explicitly Check that all ObjectIdentifier arcs are non-negative
+
 .. _release6.0:
 
 6.0
diff --git a/pyderasn.py b/pyderasn.py
index 5adc5b0..5597563 100755
--- a/pyderasn.py
+++ b/pyderasn.py
@@ -687,7 +687,7 @@ except ImportError:  # pragma: no cover
     def colored(what, *args, **kwargs):
         return what
 
-__version__ = "6.0"
+__version__ = "6.1"
 
 __all__ = (
     "Any",
@@ -3420,6 +3420,13 @@ ObjectIdentifierState = namedtuple("ObjectIdentifierState", (
 ))
 
 
+def pureint(value):
+    i = int(value)
+    if (value[0] in "+- ") or (value[-1] == " "):
+        raise ValueError("non-pure integer")
+    return i
+
+
 class ObjectIdentifier(Obj):
     """``OBJECT IDENTIFIER`` OID type
 
@@ -3497,7 +3504,7 @@ class ObjectIdentifier(Obj):
             return value._value
         if isinstance(value, string_types):
             try:
-                value = tuple(int(arc) for arc in value.split("."))
+                value = tuple(pureint(arc) for arc in value.split("."))
             except ValueError:
                 raise InvalidOID("unacceptable arcs values")
         if isinstance(value, tuple):
@@ -3511,6 +3518,8 @@ class ObjectIdentifier(Obj):
                 pass
             else:
                 raise InvalidOID("unacceptable first arc value")
+            if not all(arc >= 0 for arc in value):
+                raise InvalidOID("negative arc value")
             return value
         raise InvalidValueType((self.__class__, str, tuple))
 
diff --git a/tests/test_pyderasn.py b/tests/test_pyderasn.py
index 6f30b5d..29a3cb2 100644
--- a/tests/test_pyderasn.py
+++ b/tests/test_pyderasn.py
@@ -2819,6 +2819,28 @@ class TestObjectIdentifier(CommonMixin, TestCase):
         with assertRaisesRegex(self, DecodeError, "non normalized arc encoding"):
             ObjectIdentifier().decode(tampered)
 
+    @given(data_strategy())
+    def test_negative_arcs(self, d):
+        oid = list(d.draw(oid_strategy()))
+        if len(oid) == 2:
+            return
+        idx = d.draw(integers(min_value=3, max_value=len(oid)))
+        oid[idx - 1] *= -1
+        if oid[idx - 1] == 0:
+            oid[idx - 1] = -1
+        with self.assertRaises(InvalidOID):
+            ObjectIdentifier(tuple(oid))
+        with self.assertRaises(InvalidOID):
+            ObjectIdentifier(".".join(str(i) for i in oid))
+
+    @given(data_strategy())
+    def test_plused_arcs(self, d):
+        oid = [str(arc) for arc in d.draw(oid_strategy())]
+        idx = d.draw(integers(min_value=0, max_value=len(oid)))
+        oid[idx - 1] = "+" + oid[idx - 1]
+        with self.assertRaises(InvalidOID):
+            ObjectIdentifier(".".join(str(i) for i in oid))
+
     @given(data_strategy())
     def test_nonnormalized_arcs(self, d):
         arcs = d.draw(lists(