@blamejs/pki 0.8.2 → 0.8.4

package/lib/schema-c509.js

@@ -413,16 +413,16 @@ function _generalNameToDer(intVal, valueNode, ipMode, isNative) {
   if (intVal === 0 || intVal === -1 || intVal === -2 || intVal === -3) return _otherNameToDer(valueNode, intVal);
   throw _err("c509/bad-extensions", "GeneralName int " + intVal + " has no C509 sec. 8.13 registry row");
 }
-function _generalNameFromDer(gn, ipMode) {
+function _generalNameFromDer(gn, ipMode, ctx) {
   var t = gn.tagNumber;
   if (t === 1 || t === 2 || t === 6) return [cbor.build.int(BigInt(t)), cbor.build.textString(gn.value)];
-  if (t === 4) { var nm = _dirNameToCbor(gn.bytes); return nm == null ? null : [cbor.build.int(4n), nm]; }
+  if (t === 4) { var nm = _dirNameToCbor(gn.bytes, ctx); return nm == null ? null : [cbor.build.int(4n), nm]; }
   if (t === 7) {
     if (!ipMode) return [cbor.build.int(7n), cbor.build.byteString(gn.value)];
     var ip = _ncIpFromDer(gn.value); return ip == null ? null : [cbor.build.int(7n), cbor.build.byteString(ip)];
   }
   if (t === 8) return [cbor.build.int(8n), _oidCbor(gn.value)];
-  if (t === 0) return _otherNameFromDer(gn.value);
+  if (t === 0) return _otherNameFromDer(gn.value, ctx);
   return null;
 }
 
@@ -434,10 +434,10 @@ function _generalNamesToDer(node, isNative) {
   for (var i = 0; i + 1 < kids.length; i += 2) out.push(_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralName type")), kids[i + 1], false, isNative));
   return out;
 }
-function _generalNamesFromDer(gnNodes) {
+function _generalNamesFromDer(gnNodes, ctx) {
   var out = [];
   for (var i = 0; i < gnNodes.length; i++) {
-    var pair = _generalNameFromDer(schema.walk(GN_LEAF, gnNodes[i], NS), false);
+    var pair = _generalNameFromDer(schema.walk(GN_LEAF, gnNodes[i], schema.withResources(NS, ctx)), false, ctx);
     if (pair == null) return null;
     out.push(pair[0]); out.push(pair[1]);
   }
@@ -470,11 +470,11 @@ function _otherNameToDer(node, intVal) {
   }
   return b.contextConstructed(0, Buffer.concat([b.oid(typeId), b.explicit(0, inner)]));
 }
-function _otherNameFromDer(v) {
+function _otherNameFromDer(v, ctx) {
   var onInt = ON_INT_BY_OID[v.typeId];
   if (onInt === undefined) return [cbor.build.int(0n), cbor.build.array([_oidCbor(v.typeId), cbor.build.byteString(v.valueBytes)])];
   var inner;
-  try { inner = asn1.decode(v.valueBytes); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed otherName value yields null, so the extension does not compact and is carried in C509 general form (raw bytes)
+  try { inner = pkix.decodeNested(v.valueBytes, ctx, "an otherName value"); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed otherName value yields null, so the extension does not compact and is carried in C509 general form (raw bytes)
   if (onInt === -1) {
     if (inner.tagClass !== "universal" || inner.tagNumber !== asn1.TAGS.SEQUENCE || !inner.children || inner.children.length !== 2) return null;
     var hwType, hwSerial;
@@ -492,11 +492,11 @@ function _otherNameFromDer(v) {
   return [cbor.build.int(-3n), cbor.build.byteString(mac)];
 }
 
-function _dirNameToCbor(gnBytes) {
-  var node = asn1.decode(gnBytes);
+function _dirNameToCbor(gnBytes, ctx) {
+  var node = pkix.decodeNested(gnBytes, ctx, "a directoryName value");
   if (!node.children || node.children.length !== 1) return null;
   var name;
-  try { name = _c509NameFromDer(node.children[0].bytes); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed directoryName yields null, so the extension is carried in C509 general form instead
+  try { name = _c509NameFromDer(node.children[0].bytes, ctx); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed directoryName yields null, so the extension is carried in C509 general form instead
   try { return _encName(name, true); } catch (_e2) { return null; }   // allow:swallow-unverified -- a directoryName that does not re-encode yields null, so the extension is carried in C509 general form instead
 }
 
@@ -745,13 +745,13 @@ function _subtreesToDer(node, isNative) {
   for (var i = 0; i + 1 < kids.length; i += 2) out.push(b.sequence([_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralSubtree base type")), kids[i + 1], true, isNative)]));
   return Buffer.concat(out);
 }
-function _subtreesFromDer(subtreeNodes) {
+function _subtreesFromDer(subtreeNodes, ctx) {
   if (!subtreeNodes.length) return null;
   var out = [];
   for (var i = 0; i < subtreeNodes.length; i++) {
     var st = subtreeNodes[i];
     if (st.tagClass !== "universal" || st.tagNumber !== asn1.TAGS.SEQUENCE || !st.children || st.children.length !== 1) return null;
-    var pair = _generalNameFromDer(schema.walk(GN_LEAF_SUBTREE, st.children[0], NS), true);
+    var pair = _generalNameFromDer(schema.walk(GN_LEAF_SUBTREE, st.children[0], schema.withResources(NS, ctx)), true, ctx);
     if (pair == null) return null;
     out.push(pair[0]); out.push(pair[1]);
   }
@@ -836,7 +836,7 @@ function _dpToDer(dpNode, isNative) {
   if (!_isCborNull(crlIssuer)) fields.push(b.contextConstructed(2, b.explicit(4, _reconName(_name509(crlIssuer, true, isNative)))));
   return b.sequence(fields);
 }
-function _dpFromDer(dp) {
+function _dpFromDer(dp, ctx) {
   if (dp.tagClass !== "universal" || dp.tagNumber !== asn1.TAGS.SEQUENCE || !dp.children) return null;
   var fullNameUris = null, reasonsVal = null, crlIssuerCbor = null, lastTag = -1;
   for (var i = 0; i < dp.children.length; i++) {
@@ -862,7 +862,7 @@ function _dpFromDer(dp) {
       if (!f.children || f.children.length !== 1) return null;
       var ci = f.children[0];
       if (ci.tagClass !== "context" || ci.tagNumber !== 4 || !ci.children || ci.children.length !== 1) return null;
-      try { crlIssuerCbor = _encName(_c509NameFromDer(ci.children[0].bytes), true); } catch (_e2) { return null; }   // allow:swallow-unverified -- a malformed CRL-issuer name yields null, so the distributionPoint is carried in C509 general form instead
+      try { crlIssuerCbor = _encName(_c509NameFromDer(ci.children[0].bytes, ctx), true); } catch (_e2) { return null; }   // allow:swallow-unverified -- a malformed CRL-issuer name yields null, so the distributionPoint is carried in C509 general form instead
     } else return null;
   }
   if (fullNameUris == null) return null;
@@ -1054,15 +1054,15 @@ function _extValueToDer(name, node, isNative) {
   }
 }
 
-function _extValueFromDer(name, der) {
+function _extValueFromDer(name, der, ctx) {
   var node;
   try {
-  node = asn1.decode(der);
+  node = pkix.decodeNested(der, ctx, "an extension value");
   switch (name) {
     case "subjectKeyIdentifier":
       return cbor.build.byteString(asn1.read.octetString(node));
     case "keyUsage": {
-      var bits = _keyUsageBitsFromDer(der);
+      var bits = _keyUsageBitsFromDer(der, ctx);
       return bits == null ? null : cbor.build.uint(BigInt(bits));
     }
     case "basicConstraints": {
@@ -1081,7 +1081,7 @@ function _extValueFromDer(name, der) {
       if (akids.length === 3 && akids[0].tagClass === "context" && akids[0].tagNumber === 0 &&
           akids[1].tagClass === "context" && akids[1].tagNumber === 1 && akids[1].children &&
           akids[2].tagClass === "context" && akids[2].tagNumber === 2) {
-        var akiIssuer = _generalNamesFromDer(akids[1].children);
+        var akiIssuer = _generalNamesFromDer(akids[1].children, ctx);
         if (akiIssuer == null) return null;
         var akiSerial = asn1.read.integerImplicit(akids[2], 2);
         if (akiSerial < 0n) return null;
@@ -1112,7 +1112,7 @@ function _extValueFromDer(name, der) {
       if (sanMembers.length === 1 && sanMembers[0].tagClass === "context" && sanMembers[0].tagNumber === 2) {
         return cbor.build.textString(schema.walk(GN_LEAF, sanMembers[0], NS).value);
       }
-      var sanItems = _generalNamesFromDer(sanMembers);
+      var sanItems = _generalNamesFromDer(sanMembers, ctx);
       return sanItems == null ? null : cbor.build.array(sanItems);
     }
     case "nameConstraints": {
@@ -1122,7 +1122,7 @@ function _extValueFromDer(name, der) {
         var ncf = node.children[nci];
         if (ncf.tagClass !== "context" || ncf.tagNumber <= ncLast) return null;
         ncLast = ncf.tagNumber;
-        var subItems = _subtreesFromDer(ncf.children || []);
+        var subItems = _subtreesFromDer(ncf.children || [], ctx);
         if (subItems == null) return null;
         if (ncf.tagNumber === 0) { permCbor = cbor.build.array(subItems); sawNc = true; }
         else if (ncf.tagNumber === 1) { exclCbor = cbor.build.array(subItems); sawNc = true; }
@@ -1151,7 +1151,7 @@ function _extValueFromDer(name, der) {
       var dps = node.children || [];
       if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || dps.length < 1) return null;
       var dpResults = [];
-      for (var dpi = 0; dpi < dps.length; dpi++) { var dpr = _dpFromDer(dps[dpi]); if (dpr == null) return null; dpResults.push(dpr); }
+      for (var dpi = 0; dpi < dps.length; dpi++) { var dpr = _dpFromDer(dps[dpi], ctx); if (dpr == null) return null; dpResults.push(dpr); }
       if (dpResults.length === 1 && dpResults[0].oneUri != null && dpResults[0].noReasons && dpResults[0].noIssuer) return cbor.build.textString(dpResults[0].oneUri);
       return cbor.build.array(dpResults.map(function (r) { return r.triple; }));
     }
@@ -1377,14 +1377,14 @@ function _sdaFromDer(node) {
  * the codec represents it, and one without a codec always, since its int form carries the same
  * bytes. An extension the codec cannot represent keeps the generic form on every certificate type.
  */
-function _assertSpecificExtension(dotted, valContent, isNative) {
+function _assertSpecificExtension(dotted, valContent, isNative, ctx) {
   var canon = EXT_NAME_BY_OID[dotted];
   if (!isNative || canon === undefined) return;
-  if (EXT_COMPACT[canon] && (!Buffer.isBuffer(valContent) || _tryCompactExtValue(canon, valContent, isNative) == null)) return;
+  if (EXT_COMPACT[canon] && (!Buffer.isBuffer(valContent) || _tryCompactExtValue(canon, valContent, isNative, ctx) == null)) return;
   throw _err("c509/non-specific-encoding", "extension " + canon + " has a C509 registry id that carries this value, and a natively signed certificate uses only the specific CBOR encoding (draft sec. 3.7)");
 }
-function _tryCompactExtValue(name, der, isNative) {
-  var compact = _extValueFromDer(name, der);
+function _tryCompactExtValue(name, der, isNative, ctx) {
+  var compact = _extValueFromDer(name, der, ctx);
   if (compact == null) return null;
   var recon;
   try {
@@ -1395,7 +1395,7 @@ function _tryCompactExtValue(name, der, isNative) {
   return recon.equals(der) ? compact : null;
 }
 
-function _extensions(node, isNative) {
+function _extensions(node, isNative, ctx) {
   if (node.majorType === 0 || node.majorType === 1) {
     var iv = Number(cbor.read.int(node));
     return [{ name: "keyUsage", oid: oid.byName("keyUsage"), critical: iv < 0, keyUsageBits: Math.abs(iv) }];
@@ -1437,7 +1437,7 @@ function _extensions(node, isNative) {
         if (valNode.majorType !== 2) throw _err("c509/bad-extensions", "a non-critical ~oid extension value must be a byte string");
         valContent = valNode.content;
       }
-      _assertSpecificExtension(extOid, valContent, isNative);
+      _assertSpecificExtension(extOid, valContent, isNative, ctx);
     }
     out.push({ name: name, oid: extOid, critical: critical, value: valContent || null });
   }
@@ -1563,7 +1563,7 @@ function _reconstructDer(r, sigNode) {
 
 /**
  * @primitive  pki.schema.c509.parse
- * @signature  pki.schema.c509.parse(bytes) -> { certificateType, serialNumber, serialNumberHex, ... }
+ * @signature  pki.schema.c509.parse(bytes, caps?) -> { certificateType, serialNumber, serialNumberHex, ... }
  * @since      0.2.30
  * @status     stable
  * @spec       draft-ietf-cose-cbor-encoded-cert, RFC 8949, RFC 9090, RFC 5280
@@ -1583,11 +1583,27 @@ function _reconstructDer(r, sigNode) {
  *     "hex");
  *   var c = pki.schema.c509.parse(bytes);
  *   c.certificateType; // 3
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-function parse(input) {
+var _PARSE_OPTS = pkix.cborParseOpts(C509Error, "c509", "the C509 certificate");
+
+function parse(input, callerOpts) {
+  var caps = pkix.parseCaps(callerOpts, _PARSE_OPTS);
   var root;
-  try { root = cbor.decode(input); }
-  catch (e) { throw _err("c509/not-a-certificate", "the input is not well-formed deterministic CBOR", e); }
+  try {
+    root = cbor.decode(input, { maxBytes: caps.maxBytes, maxDepth: caps.maxDepth, maxItems: caps.maxItems });
+  } catch (e) {
+    /** @internal A resource refusal from the CBOR reader says the cap was too small. Reading it
+     *  as "these bytes are not a certificate" would send a caller to look at the wrong thing. */
+    if (pkix.isCborResourceRefusal(e)) {
+      throw _err("c509/too-large", "the C509 certificate exceeds the decode budget for this parse: " + ((e && e.message) || ""), e);
+    }
+    throw _err("c509/not-a-certificate", "the input is not well-formed deterministic CBOR", e);
+  }
   if (root.majorType !== 4 || !root.children) throw _err("c509/not-a-certificate", "a C509 certificate must be a CBOR array");
   var f = root.children;
   if (f.length !== 11) throw _err("c509/bad-tbs", "a C509 certificate must be an array of exactly 11 elements, got " + f.length);
@@ -1621,21 +1637,49 @@ function parse(input) {
     if (f[8].majorType !== 2) throw _err("c509/bad-spki", "subjectPublicKey must be a CBOR byte string");
     subjectPublicKey = f[8].content;
   }
-  var extensions = _extensions(f[9], type === 2);
+  /** @internal A native certificate's extension values are opaque DER inside the CBOR, so reading
+   *  one is a second decode that restarts depth and item counting and takes the caps this door
+   *  was given. The latch is re-read before the result is returned. */
+  var nested = pkix.nestedContext(NS, caps);
+  var result;
+  try {
+    result = _finishParse(f, root, nested, {
+      type: type, serial: serial, sHex: sHex, sigAlg: sigAlg, issuer: issuer,
+      notBefore: notBefore, notAfter: notAfter, subject: subject, spkAlg: spkAlg,
+      subjectPublicKey: subjectPublicKey, rsaKey: rsaKey,
+    });
+  } catch (e) {
+    if (nested.budget.exhausted() && !(e && e.code === "c509/too-large")) throw _budgetRefusal(e);
+    throw e;
+  }
+  if (nested.budget.exhausted()) throw _budgetRefusal(null);
+  return result;
+}
+
+/** @internal The refusal a cap produces, as distinct from a statement about the bytes. It is read
+ *  off the latch rather than off a throw, because the probe that reads an extension value absorbs
+ *  a failure by returning null. */
+function _budgetRefusal(cause) {
+  return _err("c509/too-large", "the C509 certificate exceeds the decode budget for this parse", cause || undefined);
+}
+
+function _finishParse(f, root, nested, fields) {
+  var type = fields.type;
+  var extensions = _extensions(f[9], type === 2, nested.ns);
   if (f[10].majorType !== 2) throw _err("c509/bad-signature", "issuerSignatureValue must be a CBOR byte string");
   var signatureValue = f[10].content;
 
   var result = {
     certificateType: type,
-    serialNumber: serial,
-    serialNumberHex: sHex,
-    signatureAlgorithm: sigAlg,
-    issuer: issuer,
-    validity: { notBefore: notBefore, notAfter: notAfter },
-    subject: subject,
-    subjectPublicKeyAlgorithm: spkAlg,
-    subjectPublicKey: subjectPublicKey,
-    rsaPublicKey: rsaKey,
+    serialNumber: fields.serial,
+    serialNumberHex: fields.sHex,
+    signatureAlgorithm: fields.sigAlg,
+    issuer: fields.issuer,
+    validity: { notBefore: fields.notBefore, notAfter: fields.notAfter },
+    subject: fields.subject,
+    subjectPublicKeyAlgorithm: fields.spkAlg,
+    subjectPublicKey: fields.subjectPublicKey,
+    rsaPublicKey: fields.rsaKey,
     extensions: extensions,
     signatureValue: signatureValue,
   };
@@ -1644,7 +1688,6 @@ function parse(input) {
   if (type === 2) result.signedData = result._fieldBytes;
 
   if (type === 3) result.reconstructedDer = _reconstructDer(result, f[10]);
-
   return result;
 }
 
@@ -1867,8 +1910,8 @@ function _euiFromCn(value) {
   if (bytes[3] === 0xff && bytes[4] === 0xfe) return Buffer.concat([bytes.subarray(0, 3), bytes.subarray(5)]);
   return bytes;
 }
-function _c509NameFromDer(nameBytes) {
-  var node = asn1.decode(nameBytes);
+function _c509NameFromDer(nameBytes, ctx) {
+  var node = pkix.decodeNested(nameBytes, ctx, "a Name value");
   var rdns = [];
   (node.children || []).forEach(function (rdnSet) {
     if (!rdnSet.children || rdnSet.children.length !== 1) throw _err("c509/non-invertible", "a C509 Name requires single-attribute RDNs");
@@ -1889,10 +1932,10 @@ function _c509NameFromDer(nameBytes) {
   });
   return { rdns: rdns };
 }
-function _keyUsageBitsFromDer(extnValue) {
+function _keyUsageBitsFromDer(extnValue, ctx) {
   var bs;
   try {
-    bs = asn1.read.bitString(asn1.decode(extnValue));
+    bs = asn1.read.bitString(pkix.decodeNested(extnValue, ctx, "a keyUsage extension value"));
   } catch (_e) {
     return null;
   }
@@ -1909,6 +1952,7 @@ function _magBytes(intNode) {
 }
 function _sigMagWidth(derSig) {
   var n;
+  // allow:bare-decode on the DER -> C509 conversion, below the X.509 parse door that caps the input.
   try { n = asn1.decode(derSig); } catch (e) { throw _err("c509/bad-signature", "the ECDSA issuer signature is not valid DER", e); }
   if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length !== 2) throw _err("c509/bad-signature", "the ECDSA issuer signature must be a SEQUENCE of two INTEGERs");
   for (var i = 0; i < 2; i++) {
@@ -1953,12 +1997,14 @@ _derToType3 = function (input, opts) {
   var sigAlgName = sigCanon === undefined ? c.signatureAlgorithm.name : sigCanon;
   if (String(sigAlgName || "").toLowerCase().indexOf("ecdsa") !== 0) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (sigAlgName || "an unregistered algorithm"));
   if (c.subjectPublicKeyInfo.algorithm.oid !== oid.byName("ecPublicKey")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
+  // allow:bare-decode on the DER -> C509 conversion, below the X.509 parse door that caps the input.
   var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));
   var curveCanon = EC_CURVE_BY_OID[curveOid];
   var curve = curveCanon === undefined ? oid.name(curveOid) : curveCanon;
   var coordLen = EC_FIELD_BYTES[curve];
   if (!coordLen) throw _err("c509/non-invertible", "unsupported EC subject curve " + (curve || curveOid));
   var sigCurve = _resolveIssuerSigCurve(c, opts, sigAlgName);
+  // allow:bare-decode on the DER -> C509 conversion, below the X.509 parse door that caps the input.
   var spkiNode = asn1.decode(c.subjectPublicKeyInfo.bytes);
   return {
     certificateType: 3,

package/lib/schema-cmc.js

@@ -195,8 +195,8 @@ function readExtendedFailInfo(children, what) {
   return { failInfoOID: asn1.read.oid(children[0]), failInfoValueBytes: children[1].bytes };
 }
 
-function parseStatusInfo(valueDer, version, bodyPartID) {
-  var root = asn1.decode(valueDer);
+function parseStatusInfo(valueDer, version, bodyPartID, ctx) {
+  var root = pkix.decodeNested(valueDer, ctx, "a CMCStatusInfo value");
   if (root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE || !root.constructed) {
     throw E("cmc/bad-status-info", "a CMCStatusInfo value must be a SEQUENCE");
   }
@@ -447,14 +447,15 @@ var PKI_RESPONSE = schema.seq([
  * that is not one could never be checked against anything. This is asked of a CHALLENGED request only.
  * A request body carries what its sender sent, and judging it is the enrollment's business, not the
  * decoder's. */
-function _assertAnswerableRequest(request) {
+function _assertAnswerableRequest(request, ctx) {
   if (request.arm !== "tcr" && request.arm !== "crm") return;
   /** @internal A CertReqMessages of one, which is the shape the CRMF parser takes; built outside the
    * catch below so only the parse it wraps can be what fails. */
   var payload = request.arm === "tcr" ? request.certificationRequestBytes
     : asn1.build.sequence([asn1.build.raw(request.certReqMsgBytes)]);
   try {
-    if (request.arm === "tcr") { csr.parse(payload); } else { crmf.parse(payload); }
+    var caps = ctx ? ctx.caps : undefined;
+    if (request.arm === "tcr") { csr.parse(payload, caps); } else { crmf.parse(payload, caps); }
   } catch (e) {
     throw E("cmc/bad-pop-challenge",
       "the request an EncryptedPOP quotes is not a " +
@@ -464,13 +465,13 @@ function _assertAnswerableRequest(request) {
   }
 }
 
-function parseEncryptedPop(node) {
+function parseEncryptedPop(node, ctx) {
   if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
       node.children.length !== 5) {
     throw E("cmc/bad-pop-challenge",
       "an EncryptedPOP is SEQUENCE { request, cms, thePOPAlgID, witnessAlgID, witness } (RFC 5272 sec. 6.7)");
   }
-  var envelope = _assertEnvelopedChallenge(node.children[1]);
+  var envelope = _assertEnvelopedChallenge(node.children[1], ctx);
   var request;
   try { request = parseTaggedRequest(node.children[0]); }
   catch (e) {
@@ -478,7 +479,7 @@ function parseEncryptedPop(node) {
       "an EncryptedPOP quotes the request it challenges as a TaggedRequest: " +
       ((e && e.message) || "malformed") + " (RFC 5272 sec. 6.7)", e);
   }
-  _assertAnswerableRequest(request);
+  _assertAnswerableRequest(request, ctx);
   return {
     request: request,
     /** @internal The TaggedRequest exactly as it arrived. A proof of possession is a MAC over these
@@ -526,7 +527,7 @@ function parseDecryptedPop(node) {
  * on unopened because opening them needs key material this parser does not hold. Unopened is not
  * unchecked: a field that is not a ContentInfo carrying an EnvelopedData cannot be a challenge, and
  * saying so here is what keeps a control that could never be answered from reading as one. */
-function _assertEnvelopedChallenge(node) {
+function _assertEnvelopedChallenge(node, ctx) {
   var kids = pkix.rootSequenceChildren(node, 2, 2);
   if (!kids) {
     throw E("cmc/bad-pop-challenge",
@@ -557,7 +558,7 @@ function _assertEnvelopedChallenge(node) {
    * a challenge addressed only that way is refused here, and `pki.cms.decrypt` could not open it
    * either, so it is refused where the reason can be named rather than after a failed answer. */
   var enveloped;
-  try { enveloped = cms.walkEnvelopedData(content.children[0]); }
+  try { enveloped = cms.walkEnvelopedData(content.children[0], ctx); }
   catch (e) {
     throw E("cmc/bad-pop-challenge",
       "an EncryptedPOP's ContentInfo does not carry an EnvelopedData a recipient could open: " +
@@ -594,26 +595,26 @@ function _popAlgorithm(node, what) {
 }
 
 /** @internal One AttributeValue, which is what a control carrying a single structure holds. */
-function _onlyValue(c, what) {
+function _onlyValue(c, what, ctx) {
   if (c.values.length !== 1) {
     throw E("cmc/bad-pop-challenge",
       "a " + what + " control carries exactly one AttributeValue, got " + c.values.length);
   }
-  return asn1.decode(c.values[0]);
+  return pkix.decodeNested(c.values[0], ctx, what + " control value");
 }
 
-function _decodePopChallenges(controls) {
+function _decodePopChallenges(controls, ctx) {
   for (var i = 0; i < controls.length; i++) {
     var c = controls[i];
     if (c.attrType === OID_ENCRYPTED_POP) {
-      c.encryptedPOP = parseEncryptedPop(_onlyValue(c, "an Encrypted POP"));
+      c.encryptedPOP = parseEncryptedPop(_onlyValue(c, "an Encrypted POP", ctx), ctx);
     } else if (c.attrType === OID_DECRYPTED_POP) {
-      c.decryptedPOP = parseDecryptedPop(_onlyValue(c, "a Decrypted POP"));
+      c.decryptedPOP = parseDecryptedPop(_onlyValue(c, "a Decrypted POP", ctx));
     }
   }
 }
 
-function _collectStatuses(controls) {
+function _collectStatuses(controls, ctx) {
   var out = [];
   for (var i = 0; i < controls.length; i++) {
     var c = controls[i];
@@ -622,15 +623,15 @@ function _collectStatuses(controls) {
     if (c.values.length !== 1) {
       throw E("cmc/bad-status-info", "a CMC status control carries exactly one AttributeValue, got " + c.values.length);
     }
-    out.push(parseStatusInfo(c.values[0], version, c.bodyPartID));
+    out.push(parseStatusInfo(c.values[0], version, c.bodyPartID, ctx));
   }
   return out;
 }
 
-function _finishBody(body, where) {
+function _finishBody(body, where, ctx) {
   for (var i = 0; i < body.controls.length; i++) assertControlPlacement(body.controls[i], where);
-  _decodePopChallenges(body.controls);
-  body.statuses = _collectStatuses(body.controls);
+  _decodePopChallenges(body.controls, ctx);
+  body.statuses = _collectStatuses(body.controls, ctx);
   body.unhandled = body.controls.filter(function (c) {
     return c.attrType !== OID_STATUS_INFO && c.attrType !== OID_STATUS_INFO_V2 && c.attrName === null;
   });
@@ -646,7 +647,7 @@ function _finishBody(body, where) {
 
 /**
  * @primitive  pki.schema.cmc.parsePkiData
- * @signature  pki.schema.cmc.parsePkiData(der) -> parsed
+ * @signature  pki.schema.cmc.parsePkiData(der, caps?) -> parsed
  * @since      0.4.16
  * @status     stable
  * @spec       RFC 5272 sec. 3.2.1
@@ -664,17 +665,23 @@ function _finishBody(body, where) {
  *   var der = b.sequence([b.sequence([]), b.sequence([]), b.sequence([]), b.sequence([])]);
  *   var d = pki.schema.cmc.parsePkiData(der);
  *   d.controls.length;   // 0 -- present and empty, which is legal
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-function parsePkiData(input) {
-  var root = asn1.decode(guard.bytes.isByteSource(input) ? guard.bytes.source(input, E, "cmc/bad-input", "the CMC DER") : Buffer.from(input));
-  var body = schema.walk(PKI_DATA, root, NS).result;
-  body.bytes = root.bytes;
-  return _finishBody(body, "pkiData");
+function parsePkiData(input, callerOpts) {
+  return pkix.runParseWith(input, _BODY_PARSE_OPTS, callerOpts, function (root, ns) {
+    var body = schema.walk(PKI_DATA, root, ns).result;
+    body.bytes = root.bytes;
+    return _finishBody(body, "pkiData", ns);
+  });
 }
 
 /**
  * @primitive  pki.schema.cmc.parsePkiResponse
- * @signature  pki.schema.cmc.parsePkiResponse(der) -> parsed
+ * @signature  pki.schema.cmc.parsePkiResponse(der, caps?) -> parsed
  * @since      0.4.16
  * @status     stable
  * @spec       RFC 5272 sec. 4.2.1
@@ -690,17 +697,33 @@ function parsePkiData(input) {
  *   var der = b.sequence([b.sequence([]), b.sequence([]), b.sequence([])]);
  *   var r = pki.schema.cmc.parsePkiResponse(der);
  *   r.statuses.length;   // 0 -- no status control means success is assumed
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-function parsePkiResponse(input) {
-  var root = asn1.decode(guard.bytes.isByteSource(input) ? guard.bytes.source(input, E, "cmc/bad-input", "the CMC DER") : Buffer.from(input));
-  var body = schema.walk(PKI_RESPONSE, root, NS).result;
-  body.bytes = root.bytes;
-  return _finishBody(body, "pkiResponse");
+function parsePkiResponse(input, callerOpts) {
+  return pkix.runParseWith(input, _BODY_PARSE_OPTS, callerOpts, function (root, ns) {
+    var body = schema.walk(PKI_RESPONSE, root, ns).result;
+    body.bytes = root.bytes;
+    return _finishBody(body, "pkiResponse", ns);
+  });
 }
 
+/** @internal The door options for the two body parsers, which read a bare DER body rather than
+ *  a CMS carrier, so they take no PEM label. `rawDecodeErrors` keeps the codec's own code for a
+ *  malformed body, which callers already pin. */
+var _CARRIER_PARSE_OPTS = pkix.parseOpts({ ErrorClass: CmcError, prefix: "cmc", what: "the CMC message" });
+
+var _BODY_PARSE_OPTS = pkix.parseOpts({
+  ns: NS, ErrorClass: CmcError, PemError: CmcError, prefix: "cmc",
+  what: "the CMC body", pemLabel: null, rawDecodeErrors: true,
+});
+
 /**
  * @primitive  pki.schema.cmc.parse
- * @signature  pki.schema.cmc.parse(input) -> parsed
+ * @signature  pki.schema.cmc.parse(input, caps?) -> parsed
  * @since      0.4.16
  * @status     stable
  * @spec       RFC 5272, RFC 6402
@@ -724,17 +747,31 @@ function parsePkiResponse(input) {
  *   var sd = b.sequence([b.integer(3n), b.set([]), encap, b.set([])]);
  *   var der = b.sequence([b.oid("1.2.840.113549.1.7.2"), b.explicit(0, sd)]);
  *   pki.schema.cmc.parse(der).kind;   // "pkiData"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-function parse(input) {
+function parse(input, callerOpts) {
+  /** @internal Before the branch, because the already-parsed arm reaches no decode and would
+   *  otherwise hold a caller to the option contract only when they passed bytes. The snapshot
+   *  is what travels onward: handing the caller's own object to the CMS parser would read each
+   *  cap a second time, and a value read twice need not answer the same way twice. */
+  var caps = pkix.parseCaps(callerOpts, _CARRIER_PARSE_OPTS);
   var alreadyParsed = input && typeof input === "object" && !ArrayBuffer.isView(input) &&
     !guard.bytes.isByteSource(input) && input.encapContentInfo != null;
   var parsedCms;
   if (alreadyParsed) { parsedCms = input; }
   else {
     /** @internal Bytes that are not a CMS message at all are a CMC message this cannot read, and every
-     * other format parser answers for its own input in its own domain. */
-    try { parsedCms = cms.parse(input); }
+     * other format parser answers for its own input in its own domain. A resource refusal is the one
+     * exception: it is not a statement about the bytes, so it keeps its own code. */
+    try { parsedCms = cms.parse(input, caps); }
     catch (e) {
+      if (e && typeof e.code === "string" && e.code.indexOf("/too-large") !== -1) {
+        throw E("cmc/too-large", "the CMC message exceeds the decode budget for this parse: " + (e.message || ""), e);
+      }
       throw E("cmc/bad-der",
         "a CMC message is carried in a CMS SignedData or AuthenticatedData, and these bytes are not " +
         "one: " + ((e && e.message) || "malformed") + " (RFC 5272 sec. 3.2 / 4.2)", e);
@@ -757,7 +794,9 @@ function parse(input) {
     throw E("cmc/no-content",
       "a Full PKI Request / Response carries its body as the encapsulated content; this SignedData is detached (RFC 5272 sec. 3.2)");
   }
-  var body = eContentType === OID_PKI_DATA ? parsePkiData(encap.eContent) : parsePkiResponse(encap.eContent);
+  var body = eContentType === OID_PKI_DATA
+    ? parsePkiData(encap.eContent, caps)
+    : parsePkiResponse(encap.eContent, caps);
   body.cms = parsedCms;
   body.eContentType = eContentType;
   return body;