@blamejs/pki 0.1.21 → 0.1.23

package/lib/asn1-der.js

@@ -10,7 +10,7 @@
  * @slug       asn1
  *
  * @intro
- *   A strict DER (Distinguished Encoding Rules) codec — the byte layer
+ *   A strict DER (Distinguished Encoding Rules) codec -- the byte layer
  *   every X.509 / PKCS / CMS structure is built on. The decoder is
  *   fail-closed: it rejects the BER shapes DER forbids (indefinite
  *   length, non-minimal length or integer encodings, trailing garbage,
@@ -22,8 +22,8 @@
  *   turn a node into a JS value (BigInt, dotted OID, Date, string); the
  *   `build.*` helpers construct canonical DER from JS values. Because DER
  *   is canonical, each value the `build.*` helpers emit has exactly one
- *   valid encoding — byte-identical to any other conformant DER encoder's
- *   output — and decoding it reproduces the value it was built from.
+ *   valid encoding -- byte-identical to any other conformant DER encoder's
+ *   output -- and decoding it reproduces the value it was built from.
  *
  * @card
  *   Strict, fail-closed DER decode / encode with a navigable node tree
@@ -38,10 +38,10 @@ var OidError = frameworkError.OidError;
 
 // ---- Tag constants (universal class) --------------------------------
 
-// L1 — the ASN.1 universal-type descriptor registry: the single source of
-// truth for the codec's type metadata. Each entry is DECLARATIVE DATA —
+// L1 -- the ASN.1 universal-type descriptor registry: the single source of
+// truth for the codec's type metadata. Each entry is DECLARATIVE DATA --
 // { tag, form } where form is the DER encoding form ("primitive" or
-// "constructed", X.690 §8/§10.2). TAGS and the two structural type-sets below
+// "constructed", X.690 sec. 8/sec. 10.2). TAGS and the two structural type-sets below
 // are all DERIVED from it, so registering a universal type is one descriptor
 // entry and the decoder's form checks (below) cover it automatically.
 var UNIVERSAL_TYPES = {
@@ -51,7 +51,9 @@ var UNIVERSAL_TYPES = {
   OCTET_STRING:      { tag: 0x04, form: "primitive" },
   NULL:              { tag: 0x05, form: "primitive" },
   OBJECT_IDENTIFIER: { tag: 0x06, form: "primitive" },
+  EXTERNAL:          { tag: 0x08, form: "constructed" },
   ENUMERATED:        { tag: 0x0a, form: "primitive" },
+  EMBEDDED_PDV:      { tag: 0x0b, form: "constructed" },
   UTF8_STRING:       { tag: 0x0c, form: "primitive" },
   SEQUENCE:          { tag: 0x10, form: "constructed" },
   SET:               { tag: 0x11, form: "constructed" },
@@ -62,10 +64,11 @@ var UNIVERSAL_TYPES = {
   GENERALIZED_TIME:  { tag: 0x18, form: "primitive" },
   VISIBLE_STRING:    { tag: 0x1a, form: "primitive" },
   UNIVERSAL_STRING:  { tag: 0x1c, form: "primitive" },
+  CHARACTER_STRING:  { tag: 0x1d, form: "constructed" },
   BMP_STRING:        { tag: 0x1e, form: "primitive" },
 };
 
-// TAGS { name: tag } — derived from the registry; the public constant consumers
+// TAGS { name: tag } -- derived from the registry; the public constant consumers
 // read (pki.asn1.TAGS.INTEGER, ...).
 var TAGS = {};
 Object.keys(UNIVERSAL_TYPES).forEach(function (k) { TAGS[k] = UNIVERSAL_TYPES[k].tag; });
@@ -76,17 +79,19 @@ var CLASS_CONTEXT     = 0x80;
 var CLASS_PRIVATE     = 0xc0;
 var CONSTRUCTED_BIT   = 0x20;
 
-// X.690 §8.9.1 / §8.11.1 / §10.2 (DER), the mirror rules — a constructed-only
-// universal type (SEQUENCE/SET) MUST be encoded constructed, and a
-// primitive-only type (every other universal type the codec handles) MUST be
-// encoded primitive. Both sets are DERIVED from the registry above and keyed by
-// tag for an O(1) decode-time form check; a new descriptor is covered with no
-// code change here.
-var PRIMITIVE_ONLY_UNIVERSAL_TAGS   = Object.create(null);
+// X.690 sec. 8.9.1 / sec. 8.11.1 / sec. 10.2 (DER), the mirror rules -- an
+// always-constructed universal type (SEQUENCE, SET, and the SEQUENCE-based
+// EXTERNAL / EMBEDDED PDV / unrestricted CHARACTER STRING) MUST be encoded
+// constructed, and every other universal type MUST be encoded primitive. The
+// constructed-capable set is DERIVED from the registry above and keyed by tag
+// for an O(1) decode-time form check. It is a WHITELIST: a universal tag
+// outside it -- a registered primitive type and an unregistered one
+// (NumericString, GeneralString, ObjectDescriptor, REAL, ...) alike -- has no
+// DER constructed form, so the default is reject.
 var CONSTRUCTED_ONLY_UNIVERSAL_TAGS = Object.create(null);
 Object.keys(UNIVERSAL_TYPES).forEach(function (k) {
   var d = UNIVERSAL_TYPES[k];
-  (d.form === "constructed" ? CONSTRUCTED_ONLY_UNIVERSAL_TAGS : PRIMITIVE_ONLY_UNIVERSAL_TAGS)[d.tag] = true;
+  if (d.form === "constructed") CONSTRUCTED_ONLY_UNIVERSAL_TAGS[d.tag] = true;
 });
 
 function _className(bits) {
@@ -118,7 +123,7 @@ function _asBuffer(input, who) {
  *
  * Parse DER into a node tree. Each node is
  * `{ tagClass, constructed, tagNumber, header, length, content, children,
- * bytes }` — `content` is the primitive value slice, `children` the
+ * bytes }` -- `content` is the primitive value slice, `children` the
  * decoded sub-nodes of a constructed node, and `bytes` the full TLV slice
  * (all zero-copy views over the input).
  *
@@ -130,26 +135,39 @@ function _asBuffer(input, who) {
  * `ber: true` is a scoped relaxation for formats whose content regions are
  * normatively BER (RFC 7292 PKCS#12): it accepts an indefinite length on a
  * constructed value and a constructed OCTET STRING, whose segments are
- * reassembled into one primitive `content`. Nothing else is relaxed —
+ * reassembled into one primitive `content`. Nothing else is relaxed --
  * definite lengths stay minimal, an indefinite length on a primitive value
  * and a foreign-type segment still reject, and the size / depth caps hold.
  *
  * @opts
  *   maxBytes:       number,   // default: C.LIMITS.DER_MAX_BYTES (16 MiB)
  *   maxDepth:       number,   // default: C.LIMITS.DER_MAX_DEPTH (64)
- *   allowTrailing:  boolean,  // default: false — allow bytes after the top TLV
- *   ber:            boolean,  // default: false — accept indefinite lengths +
+ *   allowTrailing:  boolean,  // default: false -- allow bytes after the top TLV
+ *   ber:            boolean,  // default: false -- accept indefinite lengths +
  *                             // constructed OCTET STRINGs (BER content regions)
  *
  * @example
  *   var node = pki.asn1.decode(der);
  *   node.tagNumber === pki.asn1.TAGS.SEQUENCE;
  */
+// A size/depth cap opt: absent means the constants.LIMITS default; a provided
+// value must be a non-negative finite integer. A non-finite cap (NaN, Infinity)
+// silently DISABLES the guard -- every `>` compare against it is false -- so a
+// deeply nested input would run to a bare RangeError instead of the typed
+// asn1/too-deep verdict. A bad cap is a config fault: throw at entry.
+function _capOpt(v, key, dflt) {
+  if (v === undefined) return dflt;
+  if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) {
+    throw new TypeError("decode: " + key + " must be a non-negative integer");
+  }
+  return v;
+}
+
 function decode(input, opts) {
   opts = opts || {};
   var buf = _asBuffer(input, "decode");
-  var maxBytes = typeof opts.maxBytes === "number" ? opts.maxBytes : constants.LIMITS.DER_MAX_BYTES;
-  var maxDepth = typeof opts.maxDepth === "number" ? opts.maxDepth : constants.LIMITS.DER_MAX_DEPTH;
+  var maxBytes = _capOpt(opts.maxBytes, "maxBytes", constants.LIMITS.DER_MAX_BYTES);
+  var maxDepth = _capOpt(opts.maxDepth, "maxDepth", constants.LIMITS.DER_MAX_DEPTH);
   if (buf.length > maxBytes) {
     throw new Asn1Error("asn1/too-large", "input " + buf.length + " bytes exceeds cap " + maxBytes);
   }
@@ -191,26 +209,30 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth) {
     }
   }
 
-  // X.690 8.9.1 / 8.11.1 — a universal constructed-only type (SEQUENCE / SET)
-  // is always constructed; a primitive-tagged one is not valid DER (and would
-  // decode to a leaf that constructed-structure consumers dereference as a
-  // parent). Driven by the registry-derived set, not a hardcoded tag list.
+  // X.690 8.9.1 / 8.11.1 -- an always-constructed universal type (SEQUENCE, SET,
+  // EXTERNAL, EMBEDDED PDV, CHARACTER STRING) is always constructed; a
+  // primitive-tagged one is not valid DER (and would decode to a leaf that
+  // constructed-structure consumers dereference as a parent). Driven by the
+  // registry-derived set, not a hardcoded tag list.
   if (tagClassBits === CLASS_UNIVERSAL && CONSTRUCTED_ONLY_UNIVERSAL_TAGS[tagNumber] && !constructed) {
-    throw new Asn1Error("asn1/bad-tlv", "a universal constructed-only type (SEQUENCE/SET) must be constructed");
+    throw new Asn1Error("asn1/bad-tlv", "a universal constructed-only type (SEQUENCE/SET/EXTERNAL/EMBEDDED PDV/CHARACTER STRING) must be constructed");
   }
 
-  // X.690 §8.x / §10.2 — the mirror rule: a universal primitive-only type
-  // (INTEGER, OID, BOOLEAN, the restricted strings, times, BIT/OCTET STRING)
-  // encoded constructed is not valid DER. Without this a constructed string
-  // tag decodes to a childless node that later paths (an X.509 DN attribute
-  // value) would hex-render or dereference instead of failing closed.
-  // The ber mode licenses exactly one constructed primitive-only type — the
-  // OCTET STRING (the streamed content carrier RFC 7292 §4.1 permits); its
+  // X.690 sec. 8.x / sec. 10.2 -- the mirror rule: a universal type other than
+  // SEQUENCE/SET (INTEGER, OID, BOOLEAN, every restricted string type --
+  // registered or not -- times, BIT/OCTET STRING, REAL, ...) encoded
+  // constructed is not valid DER. Without this a constructed string tag
+  // decodes to a childless node that later paths (an X.509 DN attribute
+  // value) would hex-render or dereference instead of failing closed; the
+  // constructed-capable set is a whitelist so an UNREGISTERED string type
+  // (a constructed GeneralString) cannot slip past the form check either.
+  // The ber mode licenses exactly one constructed primitive-only type -- the
+  // OCTET STRING (the streamed content carrier RFC 7292 sec. 4.1 permits); its
   // segments are reassembled below. Every other primitive-only type stays
   // primitive even in BER. Reassembly re-copies each nesting level's payload,
   // so nesting is capped on the way down: real producers segment one level
   // deep, and a deep chain multiplies transient memory without carrying data.
-  if (tagClassBits === CLASS_UNIVERSAL && constructed && PRIMITIVE_ONLY_UNIVERSAL_TAGS[tagNumber]) {
+  if (tagClassBits === CLASS_UNIVERSAL && constructed && !CONSTRUCTED_ONLY_UNIVERSAL_TAGS[tagNumber]) {
     if (!(ber && tagNumber === TAGS.OCTET_STRING)) {
       throw new Asn1Error("asn1/constructed-primitive-type", "a universal primitive-only type must be encoded primitive in DER");
     }
@@ -226,7 +248,7 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth) {
   if (lenByte < 0x80) {
     length = lenByte;
   } else if (lenByte === 0x80) {
-    // X.690 §8.1.3.6 — indefinite length is only defined for a constructed
+    // X.690 sec. 8.1.3.6 -- indefinite length is only defined for a constructed
     // encoding; the value runs to the end-of-contents octets.
     if (!ber || !constructed) {
       throw new Asn1Error("asn1/indefinite-length", "indefinite length is not valid DER");
@@ -296,7 +318,7 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth) {
   // single-segment encoding would carry; `bytes` keeps the original wire
   // range for raw round-trip surfaces. Nested constructed segments arrive
   // already reassembled by the recursion (their nesting depth is capped on
-  // the way down — see the strDepth check above).
+  // the way down -- see the strDepth check above).
   if (ber && constructed && tagClassBits === CLASS_UNIVERSAL && tagNumber === TAGS.OCTET_STRING) {
     var segments = [];
     for (var s = 0; s < children.length; s++) {
@@ -311,7 +333,7 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth) {
   }
   // A context-tagged constructed node from a ber decode may be an IMPLICIT
   // streamed string (the tag hides the underlying type), which only the
-  // schema-driven typed reader can identify — mark it so readers reassemble
+  // schema-driven typed reader can identify -- mark it so readers reassemble
   // exactly those nodes and a strict decode's verdicts never change.
   if (ber && constructed && tagClassBits === CLASS_CONTEXT && node.children) {
     node.ber = true;
@@ -345,7 +367,7 @@ function readBoolean(node) {
 }
 
 // INTEGER and ENUMERATED share DER content encoding (a two's-complement big-endian
-// value) but are DISTINCT universal types. This decodes that shared content — the
+// value) but are DISTINCT universal types. This decodes that shared content -- the
 // caller asserts the tag first. `typeName` names the type in error messages; the
 // stable error codes stay the integer family (a caller switching on `code` treats
 // both alike since the encoding is identical).
@@ -355,7 +377,7 @@ function _readIntegerLikeContent(node, typeName, who) {
   if (c.length === 0) throw new Asn1Error("asn1/bad-integer", typeName + " must have at least 1 content octet");
   // Defense-in-depth: refuse an over-cap magnitude before touching BigInt.
   // A one-shot hex parse is linear, but the length still bounds worst-case
-  // work — reject a hostile length prefix up front. The cap bounds the
+  // work -- reject a hostile length prefix up front. The cap bounds the
   // MAGNITUDE; a positive INTEGER whose top bit is set carries one leading
   // 0x00 DER sign octet, so allow cap + 1 content bytes (an RSA-131072
   // modulus is 16384 magnitude bytes plus that sign pad).
@@ -374,7 +396,7 @@ function _readIntegerLikeContent(node, typeName, who) {
 
 // read.integer is STRICT on the tag: an ENUMERATED node (which shares INTEGER's
 // content encoding) is NOT accepted here. Coercing an ENUMERATED to an INTEGER is a
-// type confusion — an INTEGER-pinned field (a certificate/CSR version, a serial
+// type confusion -- an INTEGER-pinned field (a certificate/CSR version, a serial
 // number, a cRLNumber) encoded as ENUMERATED would slip past a lenient reader.
 // Read ENUMERATED values with read.enumerated.
 function readInteger(node) {
@@ -389,7 +411,7 @@ function readEnumerated(node) {
   return _readIntegerLikeContent(node, "ENUMERATED", "readEnumerated");
 }
 
-// Read a [tag] IMPLICIT INTEGER — a context-class PRIMITIVE node whose content is an
+// Read a [tag] IMPLICIT INTEGER -- a context-class PRIMITIVE node whose content is an
 // integer body (the IMPLICIT tag replaces the universal INTEGER tag). Same minimal
 // two's-complement content rules as a universal INTEGER. The integer counterpart of
 // readBitStringImplicit, for the RFC 3161 Accuracy millis [0] / micros [1] fields.
@@ -403,7 +425,7 @@ function readIntegerImplicit(node, tag) {
 
 // The BIT STRING content decoder (the leading unused-bit octet + body, with the
 // DER zero-pad rule). Shared by the universal reader and the IMPLICIT
-// context-tagged reader — the caller asserts the tag first.
+// context-tagged reader -- the caller asserts the tag first.
 function _readBitStringContent(node, who) {
   _expectPrimitive(node, who);
   var c = node.content;
@@ -411,7 +433,7 @@ function _readBitStringContent(node, who) {
   var unusedBits = c[0];
   if (unusedBits > 7) throw new Asn1Error("asn1/bad-bit-string", "unused-bit count " + unusedBits + " > 7");
   if (unusedBits > 0 && c.length === 1) throw new Asn1Error("asn1/bad-bit-string", "unused bits declared over an empty body");
-  // X.690 11.2.1 — the declared unused low bits of the final octet must be
+  // X.690 11.2.1 -- the declared unused low bits of the final octet must be
   // zero in DER.
   if (unusedBits > 0 && c.length > 1) {
     var mask = (1 << unusedBits) - 1;
@@ -425,10 +447,10 @@ function readBitString(node) {
   return _readBitStringContent(node, "readBitString");
 }
 
-// Read a [tag] IMPLICIT BIT STRING — a context-class PRIMITIVE node whose content
+// Read a [tag] IMPLICIT BIT STRING -- a context-class PRIMITIVE node whose content
 // is a bit-string body (identical content rules to a universal BIT STRING). The
 // IMPLICIT tag replaces the universal one, so there is no inner universal node.
-// Used for the PKCS#8 OneAsymmetricKey publicKey [1] (RFC 5958 §2).
+// Used for the PKCS#8 OneAsymmetricKey publicKey [1] (RFC 5958 sec. 2).
 function readBitStringImplicit(node, tag) {
   if (node.tagClass !== "context" || node.tagNumber !== tag) {
     throw new Asn1Error("asn1/unexpected-tag", "readBitStringImplicit: expected context tag [" + tag +
@@ -443,16 +465,16 @@ function readOctetString(node) {
   return node.content;
 }
 
-// Read a [tag] IMPLICIT OCTET STRING — a context-class PRIMITIVE node whose
+// Read a [tag] IMPLICIT OCTET STRING -- a context-class PRIMITIVE node whose
 // content is the octet-string body (the IMPLICIT tag replaces the universal one,
 // so there is no inner universal node). Primitive-only, like its universal
 // counterpart, so a strict decode's constructed/streamed form is rejected.
-// A node from a ber decode (the `ber` marker) may carry the streamed form —
+// A node from a ber decode (the `ber` marker) may carry the streamed form --
 // the context tag hides the underlying type from the decoder, so THIS reader
 // is where a [tag] IMPLICIT OCTET STRING's segments reassemble (the shape CMS
 // ciphertext streams as). Used for the CMS SignerIdentifier
-// subjectKeyIdentifier [0] (RFC 5652 §5.3) and EncryptedContentInfo
-// encryptedContent [0] (§6.1).
+// subjectKeyIdentifier [0] (RFC 5652 sec. 5.3) and EncryptedContentInfo
+// encryptedContent [0] (sec. 6.1).
 function readOctetStringImplicit(node, tag) {
   if (node.tagClass !== "context" || node.tagNumber !== tag) {
     throw new Asn1Error("asn1/unexpected-tag", "readOctetStringImplicit: expected context tag [" + tag +
@@ -480,10 +502,27 @@ function readNull(node) {
   return null;
 }
 
-// Read a [tag] IMPLICIT NULL — a context-class PRIMITIVE node with empty content.
+// Read a [tag] IMPLICIT BOOLEAN -- a context-class PRIMITIVE node whose single
+// content octet obeys the DER BOOLEAN rules (0x00 FALSE / 0xFF TRUE; anything
+// else rejected). The IMPLICIT tag replaces the universal BOOLEAN tag. Used for
+// the RFC 5280 sec. 5.2.5 IssuingDistributionPoint scope flags.
+function readBooleanImplicit(node, tag) {
+  if (node.tagClass !== "context" || node.tagNumber !== tag) {
+    throw new Asn1Error("asn1/unexpected-tag", "readBooleanImplicit: expected context tag [" + tag +
+      "], got " + node.tagClass + "/" + node.tagNumber);
+  }
+  _expectPrimitive(node, "readBooleanImplicit");
+  if (node.content.length !== 1) throw new Asn1Error("asn1/bad-boolean", "BOOLEAN content must be 1 octet");
+  var v = node.content[0];
+  if (v === 0x00) return false;
+  if (v === 0xff) return true;
+  throw new Asn1Error("asn1/bad-boolean", "DER BOOLEAN must be 0x00 or 0xFF, got 0x" + v.toString(16));
+}
+
+// Read a [tag] IMPLICIT NULL -- a context-class PRIMITIVE node with empty content.
 // The IMPLICIT tag replaces the universal NULL tag, so there is no inner universal
 // node. The empty-content and primitive-form rules of a universal NULL still hold.
-// Used for the OCSP CertStatus good [0] / unknown [2] arms (RFC 6960 §4.2.1).
+// Used for the OCSP CertStatus good [0] / unknown [2] arms (RFC 6960 sec. 4.2.1).
 function readNullImplicit(node, tag) {
   if (node.tagClass !== "context" || node.tagNumber !== tag) {
     throw new Asn1Error("asn1/unexpected-tag", "readNullImplicit: expected context tag [" + tag +
@@ -500,7 +539,7 @@ function readNullImplicit(node, tag) {
  * @since      0.1.15
  * @originated 0.1.0
  * @status     stable
- * @spec       X.690 §8.19
+ * @spec       X.690 sec. 8.19
  * @related    pki.oid.name
  *
  * Decode an OBJECT IDENTIFIER node to its dotted-decimal string, enforcing
@@ -553,7 +592,7 @@ function _decodeText(buf, encoding) {
   return buf.toString(encoding);
 }
 
-// IA5String is 7-bit ASCII (T.50 / IA5) — every content octet is 0x00..0x7F.
+// IA5String is 7-bit ASCII (T.50 / IA5) -- every content octet is 0x00..0x7F.
 function _decodeIa5(buf) {
   for (var i = 0; i < buf.length; i++) {
     if (buf[i] > 0x7F) throw new Asn1Error("asn1/bad-ia5-string", "IA5String requires 7-bit ASCII");
@@ -562,7 +601,7 @@ function _decodeIa5(buf) {
 }
 
 // VisibleString (ISO 646 IRV / X.690) is the printable ASCII range 0x20..0x7E
-// — no control characters and no bytes with the high bit set.
+// -- no control characters and no bytes with the high bit set.
 function _decodeVisible(buf) {
   for (var i = 0; i < buf.length; i++) {
     if (buf[i] < 0x20 || buf[i] > 0x7E) throw new Asn1Error("asn1/bad-visible-string", "VisibleString must be 0x20..0x7E");
@@ -633,14 +672,14 @@ function _decodeUtf32be(buf) {
 
 var UTC_RE = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/;
 var GEN_RE = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/;
-// The X.690 §11.7 DER fractional-seconds GeneralizedTime profile: seconds present,
+// The X.690 sec. 11.7 DER fractional-seconds GeneralizedTime profile: seconds present,
 // a `.` decimal separator (never `,`), a non-empty fraction, Z-terminated. The
-// trailing-zeros rule (§11.7.3) is enforced separately. Used by RFC 3161 genTime.
+// trailing-zeros rule (sec. 11.7.3) is enforced separately. Used by RFC 3161 genTime.
 var GEN_FRAC_RE = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})\.(\d+)Z$/;
 
-// readTime(node, opts?) — opts.allowFractional enables the RFC 3161 / X.690 §11.7
+// readTime(node, opts?) -- opts.allowFractional enables the RFC 3161 / X.690 sec. 11.7
 // fractional-seconds GeneralizedTime profile. Fractional is OFF by default because
-// most profiles (RFC 5280 certificate/CRL Validity, §4.1.2.5.2) require the integer-
+// most profiles (RFC 5280 certificate/CRL Validity, sec. 4.1.2.5.2) require the integer-
 // second YYYYMMDDHHMMSSZ form and MUST NOT include a fraction; only callers that
 // permit sub-second precision (TSP genTime) pass allowFractional.
 function readTime(node, opts) {
@@ -652,7 +691,7 @@ function readTime(node, opts) {
     m = UTC_RE.exec(s);
     if (!m) throw new Asn1Error("asn1/bad-utctime", "UTCTime must be YYMMDDHHMMSSZ, got " + JSON.stringify(s));
     year = parseInt(m[1], 10);
-    // RFC 5280 §4.1.2.5.1 — YY < 50 => 20YY, else 19YY.
+    // RFC 5280 sec. 4.1.2.5.1 -- YY < 50 => 20YY, else 19YY.
     year += (year < 50) ? 2000 : 1900;
   } else if (node.tagNumber === TAGS.GENERALIZED_TIME) {
     m = GEN_RE.exec(s);
@@ -660,9 +699,9 @@ function readTime(node, opts) {
       if (!(opts && opts.allowFractional)) throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime must be YYYYMMDDHHMMSSZ, got " + JSON.stringify(s));
       m = GEN_FRAC_RE.exec(s);
       if (!m) throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime must be YYYYMMDDHHMMSS[.fraction]Z, got " + JSON.stringify(s));
-      // X.690 §11.7.3 — the fractional part MUST NOT end in a zero (and is non-empty
+      // X.690 sec. 11.7.3 -- the fractional part MUST NOT end in a zero (and is non-empty
       // by the regex). ".5Z" is valid; ".50Z" and ".500Z" are non-canonical. X.690
-      // §11.7 places NO cap on the fraction length (RFC 3161 §2.4.2 gives the 5-digit
+      // sec. 11.7 places NO cap on the fraction length (RFC 3161 sec. 2.4.2 gives the 5-digit
       // example 19990609001326.34352Z), so a fraction of any length is accepted; the
       // returned Date is millisecond-precision, and a caller needing the exact fraction
       // reads it from node.content (the raw bytes, surfaced losslessly like the OID /
@@ -673,7 +712,9 @@ function readTime(node, opts) {
   } else {
     throw new Asn1Error("asn1/expected-time", "readTime: tag " + node.tagNumber + " is not a time type");
   }
-  var month = parseInt(m[node.tagNumber === TAGS.UTC_TIME ? 2 : 2], 10);
+  // The month is capture group 2 in UTC_RE, GEN_RE, and GEN_FRAC_RE alike
+  // (the groups diverge only at 1, the year, and 7, the fraction).
+  var month = parseInt(m[2], 10);
   var day   = parseInt(m[3], 10);
   var hour  = parseInt(m[4], 10);
   var min   = parseInt(m[5], 10);
@@ -727,11 +768,21 @@ function sequenceTlv(node) {
 }
 
 function encodeIdentifier(classBits, constructed, tagNumber) {
+  // Mirror encodeLength's input guard: a negative tag corrupts the identifier
+  // octet (-1 emits 0xff..), and a fractional tag is silently bit-truncated to
+  // a DIFFERENT tag -- an entry-point builder handed a bad tag throws instead
+  // of emitting malformed or non-round-trippable DER.
+  if (typeof tagNumber !== "number" || !isFinite(tagNumber) || tagNumber < 0 || Math.floor(tagNumber) !== tagNumber) {
+    throw new Asn1Error("asn1/bad-tag", "tag number must be a non-negative integer");
+  }
   var lead = classBits | (constructed ? CONSTRUCTED_BIT : 0);
   if (tagNumber < 0x1f) return Buffer.from([lead | tagNumber]);
   var body = [];
   var v = tagNumber;
   do { body.unshift(v & 0x7f); v = Math.floor(v / 128); } while (v > 0);
+  // Symmetric with the decoder's 4-octet high-tag-number cap, so the encoder
+  // can't emit an identifier decode() refuses as hostile.
+  if (body.length > 4) throw new Asn1Error("asn1/tag-too-large", "high-tag-number too large");
   for (var i = 0; i < body.length - 1; i++) body[i] |= 0x80;
   return Buffer.concat([Buffer.from([lead | 0x1f]), Buffer.from(body)]);
 }
@@ -744,7 +795,7 @@ function encodeIdentifier(classBits, constructed, tagNumber) {
  * @spec       X.690, ISO/IEC 8825-1
  * @related    pki.asn1.decode
  *
- * Low-level TLV encoder — prepend the identifier + DER length to a content
+ * Low-level TLV encoder -- prepend the identifier + DER length to a content
  * buffer. Most callers use the higher-level `build.*` helpers; this is the
  * escape hatch for context-tagged and implicitly-tagged constructions.
  *
@@ -817,7 +868,7 @@ var PRINTABLE_RE = /^[A-Za-z0-9 '()+,\-./:=?]*$/;
 function _fmtTwo(n) { return (n < 10 ? "0" : "") + n; }
 
 function _generalizedTimeString(date) {
-  // GeneralizedTime is YYYYMMDDHHMMSSZ — a year below 1000 must still emit
+  // GeneralizedTime is YYYYMMDDHHMMSSZ -- a year below 1000 must still emit
   // four digits, or read.time rejects the short (12-14 char) content.
   var y = date.getUTCFullYear();
   if (y < 0 || y > 9999) throw new Asn1Error("asn1/bad-generalizedtime", "GeneralizedTime year " + y + " outside 0000..9999");
@@ -828,7 +879,7 @@ function _generalizedTimeString(date) {
 }
 
 function _utcTimeString(date) {
-  // RFC 5280 §4.1.2.5.1 restricts UTCTime to 1950..2049; a year outside that
+  // RFC 5280 sec. 4.1.2.5.1 restricts UTCTime to 1950..2049; a year outside that
   // wraps to the wrong century (2050 -> "50" -> decodes as 1950).
   var y = date.getUTCFullYear();
   if (y < 1950 || y > 2049) throw new Asn1Error("asn1/bad-utctime", "UTCTime year " + y + " outside 1950..2049; use GeneralizedTime");
@@ -864,11 +915,17 @@ var build = {
   oid:      function (dotted) { return _universal(TAGS.OBJECT_IDENTIFIER, false, encodeOidContent(dotted)); },
   octetString: function (buf) { return _universal(TAGS.OCTET_STRING, false, _asBuffer(buf, "build.octetString")); },
   bitString: function (buf, unusedBits) {
-    var u = unusedBits || 0;
-    if (u < 0 || u > 7) throw new Asn1Error("asn1/bad-bit-string", "unusedBits must be 0..7");
+    var u = unusedBits == null ? 0 : unusedBits;
+    // An integer in 0..7 (X.690 sec. 8.6.2.2). A fractional / non-finite count
+    // would be silently bit-truncated into a DIFFERENT value when written
+    // into the leading octet -- reject it like the other numeric builder
+    // inputs (encodeLength, the tag number).
+    if (typeof u !== "number" || !Number.isInteger(u) || u < 0 || u > 7) {
+      throw new Asn1Error("asn1/bad-bit-string", "unusedBits must be an integer 0..7");
+    }
     var body = _asBuffer(buf, "build.bitString");
     // X.690 8.6.2.3: an empty BIT STRING has no content octets, so its
-    // unused-bit count must be zero — there are no bits to leave unused.
+    // unused-bit count must be zero -- there are no bits to leave unused.
     if (u > 0 && body.length === 0) throw new Asn1Error("asn1/bad-bit-string", "empty BIT STRING must declare zero unused bits");
     // Stay canonical: refuse a tail whose declared unused low bits are set.
     if (u > 0 && body.length > 0) {
@@ -963,6 +1020,7 @@ module.exports = {
     octetStringImplicit: readOctetStringImplicit,
     nullValue:    readNull,
     nullImplicit: readNullImplicit,
+    booleanImplicit: readBooleanImplicit,
     oid:          readOid,
     string:       readString,
     time:         readTime,

package/lib/constants.js

@@ -17,8 +17,10 @@
  *   and a reviewer never has to decode it.
  *
  *   Every scale helper is config-time / entry-point validation: it THROWS
- *   `ConstantsError` on a non-finite or negative argument, so an operator
- *   catches the typo at boot rather than shipping a silently-wrong window.
+ *   `ConstantsError` on a non-finite or negative argument, and on a product
+ *   outside the safe-integer range, so an operator catches the typo at boot
+ *   rather than shipping a silently-wrong window or an Infinity that would
+ *   disable a size cap.
  *
  * @card
  *   Functional scale helpers (`C.TIME.*`, `C.BYTES.*`) plus the toolkit
@@ -29,7 +31,7 @@ var frameworkError = require("./framework-error");
 
 var ConstantsError = frameworkError.ConstantsError;
 
-// _positive(n, who) — the shared guard every scale helper runs. Config-
+// _positive(n, who) -- the shared guard every scale helper runs. Config-
 // time tier: a bad scale argument is an authoring bug, so it throws.
 function _positive(n, who) {
   if (typeof n !== "number" || !isFinite(n) || n < 0) {
@@ -41,6 +43,22 @@ function _positive(n, who) {
   return n;
 }
 
+// _scale(n, who, factor) -- validate the argument AND the product. A finite
+// operand can still overflow the multiplication (days(1e304) -> Infinity),
+// and an Infinity handed onward silently disables any bound compared
+// against it (`len > Infinity` is always false) -- so a product outside the
+// safe-integer range throws instead of returning.
+function _scale(n, who, factor) {
+  var out = Math.round(_positive(n, who) * factor);
+  if (!Number.isSafeInteger(out)) {
+    throw new ConstantsError(
+      "constants/bad-scale",
+      who + ": the result " + String(out) + " is not a safe integer"
+    );
+  }
+  return out;
+}
+
 var MS_PER_SECOND = 1000;
 var SECONDS_PER_MINUTE = 60;
 var MINUTES_PER_HOUR = 60;
@@ -64,12 +82,12 @@ var DAYS_PER_WEEK = 7;
  *   // -> 31536000000
  */
 var TIME = {
-  milliseconds: function (n) { return Math.round(_positive(n, "C.TIME.milliseconds")); },
-  seconds: function (n) { return Math.round(_positive(n, "C.TIME.seconds") * MS_PER_SECOND); },
-  minutes: function (n) { return Math.round(_positive(n, "C.TIME.minutes") * SECONDS_PER_MINUTE * MS_PER_SECOND); },
-  hours:   function (n) { return Math.round(_positive(n, "C.TIME.hours") * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND); },
-  days:    function (n) { return Math.round(_positive(n, "C.TIME.days") * HOURS_PER_DAY * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND); },
-  weeks:   function (n) { return Math.round(_positive(n, "C.TIME.weeks") * DAYS_PER_WEEK * HOURS_PER_DAY * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND); },
+  milliseconds: function (n) { return _scale(n, "C.TIME.milliseconds", 1); },
+  seconds: function (n) { return _scale(n, "C.TIME.seconds", MS_PER_SECOND); },
+  minutes: function (n) { return _scale(n, "C.TIME.minutes", SECONDS_PER_MINUTE * MS_PER_SECOND); },
+  hours:   function (n) { return _scale(n, "C.TIME.hours", MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND); },
+  days:    function (n) { return _scale(n, "C.TIME.days", HOURS_PER_DAY * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND); },
+  weeks:   function (n) { return _scale(n, "C.TIME.weeks", DAYS_PER_WEEK * HOURS_PER_DAY * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND); },
 };
 
 var BYTES_PER_KIB = 1024;
@@ -90,13 +108,13 @@ var BYTES_PER_KIB = 1024;
  *   // -> 16777216
  */
 var BYTES = {
-  b:   function (n) { return Math.round(_positive(n, "C.BYTES.b")); },
-  kib: function (n) { return Math.round(_positive(n, "C.BYTES.kib") * BYTES_PER_KIB); },
-  mib: function (n) { return Math.round(_positive(n, "C.BYTES.mib") * BYTES_PER_KIB * BYTES_PER_KIB); },
-  gib: function (n) { return Math.round(_positive(n, "C.BYTES.gib") * BYTES_PER_KIB * BYTES_PER_KIB * BYTES_PER_KIB); },
+  b:   function (n) { return _scale(n, "C.BYTES.b", 1); },
+  kib: function (n) { return _scale(n, "C.BYTES.kib", BYTES_PER_KIB); },
+  mib: function (n) { return _scale(n, "C.BYTES.mib", BYTES_PER_KIB * BYTES_PER_KIB); },
+  gib: function (n) { return _scale(n, "C.BYTES.gib", BYTES_PER_KIB * BYTES_PER_KIB * BYTES_PER_KIB); },
 };
 
-// LIMITS — shared codec ceilings. A DER document larger than this, or
+// LIMITS -- shared codec ceilings. A DER document larger than this, or
 // nested deeper than this, is refused before the parser walks it: an
 // unbounded length prefix or a pathologically-nested SEQUENCE is a
 // classic decoder-DoS, so the bound is a fail-closed default rather
@@ -109,7 +127,7 @@ var BYTES = {
 // decoder-DoS the document cap does not stop. 16 KiB covers any real key
 // material (an RSA-131072 modulus), and 32 bytes covers any real OID arc:
 // the largest standard sub-identifier is a 128-bit UUID-based arc (X.667,
-// e.g. 2.25.<uuid>), which is 19 base-128 bytes — so the cap must exceed
+// e.g. 2.25.<uuid>), which is 19 base-128 bytes -- so the cap must exceed
 // that, not sit at 16. Anything larger than 32 bytes is refused as hostile.
 var LIMITS = {
   DER_MAX_BYTES: BYTES.mib(16),
@@ -117,21 +135,28 @@ var LIMITS = {
   PEM_MAX_BYTES: BYTES.mib(16),
   DER_MAX_INTEGER_BYTES: BYTES.kib(16),
   OID_MAX_SUBIDENTIFIER_BYTES: 32,
-  // Certificate Transparency SCT-list bounds (RFC 6962 §3.3). The outer sct_list
+  // Certificate Transparency SCT-list bounds (RFC 6962 sec. 3.3). The outer sct_list
   // vector carries a 2-byte length prefix, so a well-formed list body is at most
   // 2^16-1 = 65535 bytes and the full TLS blob (prefix + body) is at most 65537.
   // The byte cap sits at that structural maximum, so the largest conforming list
   // is accepted while an oversized inner OCTET STRING (up to the DER document cap)
-  // is refused BEFORE the list is walked; the per-list count cap is likewise
-  // asserted before iteration so a hostile length prefix cannot drive unbounded
-  // work (the CVE-2022-0778 class: crafted bytes inside a certificate extension
-  // pinning a validator). A real chain carries 2-5 SCTs; 256 is far above policy.
+  // is refused BEFORE the list is walked. The per-list count cap is asserted per
+  // element DURING the walk (an element count is unknowable before walking
+  // variable-length elements), bounding total work at SCT_MAX_COUNT+1 elements
+  // regardless of a hostile length prefix (the CVE-2022-0778 class: crafted bytes
+  // inside a certificate extension pinning a validator). A real chain carries
+  // 2-5 SCTs; 256 is far above policy.
   SCT_MAX_BYTES: BYTES.kib(64) + 1,
   SCT_MAX_COUNT: 256,
   // Certification-path length ceiling: bounds the per-cert asymmetric verify
   // work on an untrusted certificate bundle (a real chain is well under this;
   // the operator may override via opts.maxPathCerts).
   PATH_MAX_CERTS: 100,
+  // Valid-policy-tree node ceiling: bounds the RFC 5280 6.1.3(d) tree a
+  // policy-rich hostile chain can grow (the CVE-2023-0464 class). A real
+  // chain's tree holds a handful of nodes; the operator may override via
+  // opts.maxPolicyNodes.
+  PATH_MAX_POLICY_NODES: 4096,
   // PKCS#12 container ceilings. A PFX carries lists at three altitudes
   // (ContentInfos per AuthenticatedSafe, SafeBags per SafeContents,
   // attributes per bag) and can chain fresh DER blobs inside OCTET STRINGs,
@@ -145,7 +170,7 @@ var LIMITS = {
   // nesting multiplies transient memory. Real producers segment one level
   // deep; nesting past this cap is amplification, not a store.
   BER_MAX_STRING_NESTING: 8,
-  // A single attribute's value SET — no deployed attribute carries more than
+  // A single attribute's value SET -- no deployed attribute carries more than
   // a handful of values; a list at this scale is amplification.
   ATTRIBUTE_MAX_VALUES: 256,
 };