mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-28 12:08:46 -06:00
5ec14155ff
pkcs12::open demanded clean DER at the first byte, so a file with one extra newline, PEM armour or a bare base64 body (the shapes OpenSSL wraps, editors and government portals emit) was refused before any crypto ran, with "malformed data: PKCS #12: not a PKCS #12 file" and no reason. open now runs the bytes through normalize(): ASCII whitespace is trimmed, "-----BEGIN" takes the base64 body between the armour markers (byte offsets, so a marker glued to the body line works too), and a bare base64 body is decoded — a real DER PFX always contains bytes outside the base64 alphabet, so the fast path can't swallow one. The exact parse reason is carried into the error instead of being dropped. Truncated or empty files still fail, now saying why. Test: crypto.rs::opens_wrapped_pkcs12_files_and_still_rejects_broken_ones (a wrapped copy of rsa-aes.p12 yields the same certificate through trailing whitespace, PEM armour and bare base64; truncated and empty files error with the reason). It failed on all three wrapped forms before the fix. Co-authored-by: Mawfyy <mawfy12@gmail.com> Co-authored-by: Brandon Thomas <echelon@gmail.com>