pkcs1: reject an empty otherPrimeInfos (#2457)

RFC 8017 A.1.2:

    OtherPrimeInfos ::= SEQUENCE SIZE(1..MAX) OF OtherPrimeInfo

    otherPrimeInfos ... SHALL be omitted if version is 0 and SHALL
    contain at least one instance of OtherPrimeInfo if version is 1.

The decoder checked that `otherPrimeInfos` is present exactly when the
version is multi (#111, #115), but accepted an empty `SEQUENCE {}`, so a
version-1 key with no additional primes decoded as `Version::Multi` with
`Some(vec![])`. pyca/cryptography's rust-asn1 schema declares the same
field as `SequenceOf<.., 1>` and rejects it.

Reject an empty `otherPrimeInfos` on decode.

Author: yuxi-liu-wired

pkcs1/src/private_key.rs

@@ -43,6 +43,8 @@ pub type RsaPrivateKeyOwned = RsaPrivateKey<Uint>;
 ///     coefficient       INTEGER,  -- (inverse of q) mod p
 ///     otherPrimeInfos   OtherPrimeInfos OPTIONAL
 /// }
+///
+/// OtherPrimeInfos ::= SEQUENCE SIZE(1..MAX) OF OtherPrimeInfo
 /// ```
 ///
 /// Note: the `version` field is selected automatically based on the absence or
@@ -133,6 +135,17 @@ where
             return Err(reader.error(der::ErrorKind::Value { tag: Tag::Integer }));
         }
 
+        // `OtherPrimeInfos ::= SEQUENCE SIZE(1..MAX) OF OtherPrimeInfo`
+        // (without `alloc`, `OtherPrimeInfos` never decodes, so there is nothing to check)
+        #[cfg(feature = "alloc")]
+        if result
+            .other_prime_infos
+            .as_ref()
+            .is_some_and(|infos| infos.is_empty())
+        {
+            return Err(reader.error(der::ErrorKind::Value { tag: Tag::Sequence }));
+        }
+
         Ok(result)
     }
 }

pkcs1/tests/private_key.rs

@@ -202,6 +202,16 @@ fn decode_rsa2048_multi_prime_der() {
     );
 }
 
+/// RFC 8017 A.1.2: `OtherPrimeInfos ::= SEQUENCE SIZE(1..MAX) OF OtherPrimeInfo`, so a
+/// multi-prime key with an empty `otherPrimeInfos` is malformed.
+#[cfg(feature = "alloc")]
+#[test]
+fn reject_empty_other_prime_infos() {
+    // version 1 (multi), eight one-byte INTEGERs, otherPrimeInfos = SEQUENCE {}
+    let der = hex!("301d 020101 020107 020103 020105 02010b 02010d 020102 020104 020106 3000");
+    assert!(RsaPrivateKeyRef::try_from(der.as_slice()).is_err());
+}
+
 #[test]
 fn private_key_to_public_key() {
     let private_key = RsaPrivateKeyRef::try_from(RSA_2048_DER_EXAMPLE).unwrap();