From 799252f3b67d0429e64736f922a3c2860135facb Mon Sep 17 00:00:00 2001 From: dannyward630 Date: Mon, 15 Jun 2026 19:46:57 +0200 Subject: [PATCH] Document trailing data handling for DER input Commands that read a single DER object may stop after decoding that object and leave trailing input unchecked. Document that successful decoding is therefore not a full-input validity check. Fixes #31495 CLA: trivial Reviewed-by: Jakub Zelenka Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/31524) --- doc/man1/openssl-format-options.pod | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/doc/man1/openssl-format-options.pod b/doc/man1/openssl-format-options.pod index 2da9bef5efc..1bdb82efad5 100644 --- a/doc/man1/openssl-format-options.pod +++ b/doc/man1/openssl-format-options.pod @@ -60,6 +60,11 @@ is described in each command documentation. A binary format, encoded or parsed according to Distinguished Encoding Rules (DER) of the ASN.1 data language. +When a command reads a single DER object, it may stop after successfully +decoding that object. Any trailing data in the input is not necessarily +examined or rejected. Therefore, a successful command does not by itself +confirm that the entire input consists of one valid DER object. + =item B A DER-encoded file containing a PKCS#12 object. @@ -124,7 +129,7 @@ Note that the parsing is simple and might fail to parse some legal data. =head1 COPYRIGHT -Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2000-2026 The OpenSSL Project Authors. All Rights Reserved. Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy -- 2.47.3