// tls_x509_vuln.c
#include <stdio.h>
#include <string.h>
#include <stdint.h>
#include <stdlib.h>

// Vulnerable certificate parser
struct cert {
    uint8_t *data;
    size_t len;
};

int parse_san_extension(struct cert *cert, char *san_out, size_t out_size) {
    // Assume we are inside an extension with OID for SAN.
    uint8_t *p = cert->data + 10; // skip to extension value
    uint16_t ext_len = (p[0] << 8) | p[1];
    p += 2;
    // ext_len includes a sequence of GeneralNames. We only handle dNSName.
    while (p < cert->data + cert->len) {
        uint8_t name_type = *p++;
        uint16_t name_len = (p[0] << 8) | p[1];
        p += 2;
        if (name_type == 2) { // dNSName
            // Vulnerability: memcpy without bounds check to san_out
            memcpy(san_out, p, name_len); // STACK BUFFER OVERFLOW if name_len > out_size
            san_out[name_len] = '\0';
            return 0;
        }
        p += name_len;
    }
    return -1;
}

int main(int argc, char **argv) {
    // Malicious certificate payload: crafted SAN with oversized dNSName
    uint8_t malicious_cert[] = {
        // ... header, then extension:
        0x30, 0x12, // SEQUENCE extension
        0x06, 0x03, 0x55, 0x1d, 0x11, // OID SAN
        0x04, 0x0b, // octet string, length 11
        // ext_len (should be 0x0009 but we use 0x00ff to overflow)
        0x00, 0xff, // ext_len = 255 (overstated)
        // Then a dNSName: type 2, length huge
        0x02, 0x01, 0x41, // dNSName "A" but the parser will read massive length due to ext_len
    };
    struct cert cert;
    cert.data = malicious_cert;
    cert.len = sizeof(malicious_cert);

    char san[16]; // small buffer
    parse_san_extension(&cert, san, sizeof(san));
    printf("SAN: %s\n", san);
    return 0;
}