From ffcba2f0781f15a1c70948dfd13bfdeecbed298e Mon Sep 17 00:00:00 2001
From: dmitri <deemok@gmail.com>
Date: Mon, 2 Oct 2017 16:04:09 -0700
Subject: [PATCH] ValidateCertificateChain: account for possible invalid PEM
 data block.

---
 lib/utils/certs.go      |  3 +++
 lib/utils/certs_test.go | 42 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 lib/utils/certs_test.go

diff --git a/lib/utils/certs.go b/lib/utils/certs.go
index d82ed840fbf..3768d352a76 100644
--- a/lib/utils/certs.go
+++ b/lib/utils/certs.go
@@ -168,6 +168,9 @@ func VerifyCertificateChain(certificateBytes []byte) error {
 
 	for {
 		certificateBlock, remainingBytes = pem.Decode(remainingBytes)
+		if certificateBlock == nil {
+			return trace.NotFound("no PEM data found")
+		}
 		certificateChain = append(certificateChain, certificateBlock.Bytes)
 
 		if len(remainingBytes) == 0 {
diff --git a/lib/utils/certs_test.go b/lib/utils/certs_test.go
new file mode 100644
index 00000000000..2d1be0b0a44
--- /dev/null
+++ b/lib/utils/certs_test.go
@@ -0,0 +1,42 @@
+/*
+Copyright 2015 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package utils
+
+import (
+	"io/ioutil"
+
+	"github.com/gravitational/trace"
+	. "gopkg.in/check.v1"
+)
+
+type CertsSuite struct {
+}
+
+var _ = Suite(&CertsSuite{})
+
+func (_ *CertsSuite) TestRejectsInvalidPEMData(c *C) {
+	err := VerifyCertificateChain([]byte("no data"))
+	c.Assert(trace.Unwrap(err), FitsTypeOf, &trace.NotFoundError{})
+}
+
+func (_ *CertsSuite) TestRejectsSelfSignedCertificate(c *C) {
+	cert, err := ioutil.ReadFile("../../fixtures/certs/ca.pem")
+	c.Assert(err, IsNil)
+
+	err = VerifyCertificateChain(cert)
+	c.Assert(err, ErrorMatches, "x509: certificate signed by unknown authority")
+}