@blamejs/pki 0.8.3 → 0.8.4

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.4 — 2026-09-25
+
+A decode cap bounds every structure a parse reads, and a refusal caused by a cap is no longer reported as malformed input.
+
+### Added
+
+- `pki.schema.engine.decodeNested(bytes, ctx, label, opts?)`, the decode to perform on a value already read out of a parse's input. It applies the caps carried on the walk context and records a resource refusal against the parse before re-throwing, which is what a format parser composed on the engine needs so its embedded payloads answer to the caller's caps.
+- `pki.schema.engine.withResources(ns, source)` carries a parse's caps and budget onto another namespace, for a format whose structure is carried inside another one. The structure is still walked in its own namespace, so a fault in it keeps that format's error class and code. `pki.schema.engine.isResourceRefusal(err)` reports whether a codec error was a limit rather than a claim about the bytes.
+
+### Changed
+
+- An input refused for exceeding a decode limit reports `<format>/too-large` in cases where it previously reported the format's own malformed-value code, such as `cms/bad-aead-params` or `cmp/bad-body`. A parser that decodes a value out of its input wraps a decode failure in a code of its own, and that code sent a reader to inspect bytes that were fine and a cap that was too small. A caller matching on one of those codes to detect malformed input will stop seeing over-budget inputs under it. The wrapped error is carried on the refusal as its `cause`.
+
+### Fixed
+
+- A decode cap bounds every structure a parse reads, not the input alone. An embedded `OCTET STRING` payload, an encapsulated protocol body, a `SafeContents` inside a PKCS#12 store and an attribute value are all decoded under the caps the caller named. The 0.8.3 notes recorded that a structure decoded from inside the input kept the built-in `pki.C.LIMITS` defaults; it no longer does.
+- `pki.schema.cmc.parse` applies the caller's caps to the `PKIData` or `PKIResponse` body. It read the caps, bounded the CMS carrier with them, and then decoded the body that carries the request or response with the built-in defaults.
+- A parse cannot return a result after a decode limit has refused something inside that parse, whatever the code between the two does with the failure. A parser that catches a resource refusal and re-throws its own typed error is the common shape, and that shape previously carried the parse past the latch the budget sets. The door now reads the latch on the failure path as well as on the success path.
+
 ## v0.8.3 — 2026-09-25
 
 A parser takes decode caps from its caller, and a resource refusal says so instead of reading as malformed input.

package/lib/guard-parsed.js

@@ -158,8 +158,8 @@ function recordingParser(kind, parse, ErrorClass, code, label) {
 
 // @enforced-by guard-shape-reinlined -- shares recordingParser's shape below: the PROVENANCE.set
 function recordingWalker(kind, walkNode, decodeBytes) {
-  return function (node) {
-    var out = walkNode(node);
+  return function (node, ctx) {
+    var out = walkNode(node, ctx);
     if (out && typeof out === "object" && node && _isBytes(node.bytes)) {
       _weakSet(PROVENANCE, out, {
         kind: kind,

package/lib/schema-attrcert.js

@@ -147,7 +147,7 @@ var V2_FORM = schema.seq([
     if (issuerName.names[0].tagNumber !== 4) {
       throw ctx.E("attrcert/bad-issuer-name", "the issuerName GeneralName must be a directoryName [4] (RFC 5755 sec. 4.2.3)");
     }
-    var dirName = asn1.decode(issuerName.names[0].bytes).children[0];
+    var dirName = pkix.decodeNested(issuerName.names[0].bytes, ctx, "the issuerName directoryName").children[0];
     if (!dirName.children || dirName.children.length < 1) {
       throw ctx.E("attrcert/bad-issuer-name", "the issuerName directoryName must be a non-empty distinguished name (RFC 5755 sec. 4.2.3)");
     }
@@ -217,14 +217,14 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
     var attributes = acinfo.fields.attributes.value.result;
     attributes.forEach(function (a) {
       var dec = _ATTR_VALUE_DECODERS[a.type];
-      a.decoded = a.values.map(function (v) { return dec ? dec(v) : { opaque: true, bytes: v }; });
+      a.decoded = a.values.map(function (v) { return dec ? dec(v, ctx) : { opaque: true, bytes: v }; });
     });
 
     var extField = acinfo.fields.extensions;
     var extensions = (extField && extField.present) ? extField.value.result : [];
     extensions.forEach(function (x) {
       var dec = _AC_EXT_DECODERS[x.oid];
-      x.decoded = dec ? dec(x.value) : { opaque: true, bytes: x.value };
+      x.decoded = dec ? dec(x.value, ctx) : { opaque: true, bytes: x.value };
     });
 
     return {
@@ -398,12 +398,13 @@ function _oneGN(node, code) {
 
 // @internal
 function readGeneralName(der, code) {
+  // allow:bare-decode reached from the builder, not from a parse, so no parse context carries caps here.
   return _oneGN(asn1.decode(der), code || "attrcert/bad-input");
 }
 
 function _svceAuthInfo(authInfoAllowed, code) {
-  return function (buf) {
-    var kids = _seqChildren(buf, code, "SvceAuthInfo");
+  return function (buf, ctx) {
+    var kids = _seqChildren(buf, code, "SvceAuthInfo", ctx);
     if (kids.length < 2 || kids.length > 3) throw NS.E(code, "SvceAuthInfo must be a SEQUENCE { service, ident, authInfo? }");
     var service = _oneGN(kids[0], code);
     var ident = _oneGN(kids[1], code);
@@ -417,12 +418,12 @@ function _svceAuthInfo(authInfoAllowed, code) {
   };
 }
 
-function _ietfAttrSyntax(buf) {
+function _ietfAttrSyntax(buf, ctx) {
   var C = "attrcert/bad-ietf-attr";
-  var kids = _seqChildren(buf, C, "IetfAttrSyntax");
+  var kids = _seqChildren(buf, C, "IetfAttrSyntax", ctx);
   if (!kids.length || kids.length > 2) throw NS.E(C, "IetfAttrSyntax must be a SEQUENCE { policyAuthority [0]?, values }");
   var policyAuthority = null, i = 0;
-  if (_isCtx(kids[0], 0)) { policyAuthority = schema.walk(_GNS_0, kids[0], NS).result; i = 1; }
+  if (_isCtx(kids[0], 0)) { policyAuthority = schema.walk(_GNS_0, kids[0], schema.withResources(NS, ctx)).result; i = 1; }
   var valuesNode = kids[i];
   if (!valuesNode || !_isU(valuesNode, TAGS.SEQUENCE) || !valuesNode.children || !valuesNode.children.length) {
     throw NS.E(C, "IetfAttrSyntax values must be a non-empty SEQUENCE OF value");
@@ -438,12 +439,12 @@ function _ietfAttrSyntax(buf) {
   return { policyAuthority: policyAuthority, values: values, homogeneous: Object.keys(kinds).length === 1 };
 }
 
-function _role(buf) {
+function _role(buf, ctx) {
   var C = "attrcert/bad-role";
-  var kids = _seqChildren(buf, C, "RoleSyntax");
+  var kids = _seqChildren(buf, C, "RoleSyntax", ctx);
   if (!kids.length || kids.length > 2) throw NS.E(C, "RoleSyntax must be a SEQUENCE { roleAuthority [0]?, roleName [1] }");
   var roleAuthority = null, i = 0;
-  if (_isCtx(kids[0], 0)) { roleAuthority = schema.walk(_GNS_0, kids[0], NS).result; i = 1; }
+  if (_isCtx(kids[0], 0)) { roleAuthority = schema.walk(_GNS_0, kids[0], schema.withResources(NS, ctx)).result; i = 1; }
   var rn = kids[i];
   if (!_isCtx(rn, 1) || !rn.children || rn.children.length !== 1) throw NS.E(C, "RoleSyntax roleName must be an EXPLICIT [1] wrapping exactly one GeneralName");
   if (i + 1 !== kids.length) throw NS.E(C, "RoleSyntax has unexpected trailing fields");
@@ -473,9 +474,9 @@ function _securityCategory(node, C) {
   if (!_isCtx(valueNode, 1) || !valueNode.children || valueNode.children.length !== 1) throw NS.E(C, "SecurityCategory value must be an EXPLICIT [1] wrapping one element");
   return { type: type, valueBytes: Buffer.concat([valueNode.children[0].bytes]) };
 }
-function _clearance(buf) {
+function _clearance(buf, ctx) {
   var C = "attrcert/bad-clearance";
-  var kids = _seqChildren(buf, C, "Clearance");
+  var kids = _seqChildren(buf, C, "Clearance", ctx);
   if (!kids.length || kids.length > 3) throw NS.E(C, "Clearance must be a SEQUENCE { policyId, classList?, securityCategories? }");
   if (!_isU(kids[0], TAGS.OBJECT_IDENTIFIER)) throw NS.E(C, "Clearance policyId must be an OBJECT IDENTIFIER");
   var policyId; try { policyId = asn1.read.oid(kids[0]); } catch (e) { throw NS.E(C, "Clearance policyId must be an OBJECT IDENTIFIER", e); }
@@ -508,16 +509,16 @@ _ATTR_VALUE_DECODERS[_Oav("chargingIdentity")] = _ietfAttrSyntax;
 _ATTR_VALUE_DECODERS[_Oav("group")] = _ietfAttrSyntax;
 
 
-function _acAuditIdentity(buf) {
+function _acAuditIdentity(buf, ctx) {
   var C = "attrcert/bad-audit-identity";
-  var n = _decodeTop(buf, C, "AuditIdentity");
+  var n = _decodeTop(buf, C, "AuditIdentity", ctx);
   if (!_isU(n, TAGS.OCTET_STRING)) throw NS.E(C, "AuditIdentity must be an OCTET STRING");
   return Buffer.concat([asn1.read.octetString(n)]);
 }
 
-function _noRevAvail(buf) {
+function _noRevAvail(buf, ctx) {
   var C = "attrcert/bad-no-rev-avail";
-  var n = _decodeTop(buf, C, "NoRevAvail");
+  var n = _decodeTop(buf, C, "NoRevAvail", ctx);
   try { asn1.read.nullValue(n); } catch (e) { throw NS.E(C, "NoRevAvail must be a DER NULL (RFC 5755 sec. 4.3.6)", e); }
   return { noRevAvail: true };
 }
@@ -546,13 +547,13 @@ function _acDecodeTargets(node, C, allowTargetCert) {
   if (!_isU(node, TAGS.SEQUENCE) || !node.children || !node.children.length) throw NS.E(C, "Targets must be a non-empty SEQUENCE OF Target");
   return node.children.map(function (t) { return _acTarget(t, C, allowTargetCert); });
 }
-function _seqOfTargets(buf, C, allowTargetCert) {
-  var kids = _seqChildren(buf, C, "SEQUENCE OF Targets");
+function _seqOfTargets(buf, C, allowTargetCert, ctx) {
+  var kids = _seqChildren(buf, C, "SEQUENCE OF Targets", ctx);
   if (!kids.length) throw NS.E(C, "a SEQUENCE OF Targets must be non-empty");
   return kids.map(function (targetsNode) { return _acDecodeTargets(targetsNode, C, allowTargetCert); });
 }
-function _targetInformation(buf) { return _seqOfTargets(buf, "attrcert/bad-targets", true); }
-function _acProxying(buf) { return _seqOfTargets(buf, "attrcert/bad-proxy-info", false); }
+function _targetInformation(buf, ctx) { return _seqOfTargets(buf, "attrcert/bad-targets", true, ctx); }
+function _acProxying(buf, ctx) { return _seqOfTargets(buf, "attrcert/bad-proxy-info", false, ctx); }
 
 function _acAttrSpec(node, C) {
   if (!node.children) throw NS.E(C, "an AttrSpec must be a SEQUENCE OF OBJECT IDENTIFIER");
@@ -561,9 +562,9 @@ function _acAttrSpec(node, C) {
     try { return asn1.read.oid(o); } catch (e) { throw NS.E(C, "an AttrSpec element must be an OBJECT IDENTIFIER", e); }
   });
 }
-function _aaControls(buf) {
+function _aaControls(buf, ctx) {
   var C = "attrcert/bad-aa-controls";
-  var kids = _seqChildren(buf, C, "AAControls");
+  var kids = _seqChildren(buf, C, "AAControls", ctx);
   if (kids.length > 4) throw NS.E(C, "AAControls has too many fields");
   var out = { pathLenConstraint: null, permittedAttrs: null, excludedAttrs: null, permitUnSpecified: true }, i = 0;
   if (kids[i] && _isU(kids[i], TAGS.INTEGER)) { out.pathLenConstraint = guard.range.uint31(_readInt(kids[i], C, "pathLenConstraint"), NS.E, C, "AAControls pathLenConstraint"); i++; }
@@ -588,9 +589,18 @@ _AC_EXT_DECODERS[_Oav("acProxying")] = _acProxying;
  *  through the certificate decoders, so a relying party running the sec. 6 "pointer in AC" scheme
  *  reads the distribution point and the OCSP location off the parse rather than off raw bytes. */
 var _CERT_EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
-_AC_EXT_DECODERS[_Oav("authorityKeyIdentifier")] = _CERT_EXT_DECODERS[_Oav("authorityKeyIdentifier")];
-_AC_EXT_DECODERS[_Oav("authorityInfoAccess")] = _CERT_EXT_DECODERS[_Oav("authorityInfoAccess")];
-_AC_EXT_DECODERS[_Oav("cRLDistributionPoints")] = _CERT_EXT_DECODERS[_Oav("cRLDistributionPoints")];
+/** @internal The certificate decoders close over the namespace they were built with, so a parse
+ *  that named caps gets its own table and every decode below these three reads the caller's
+ *  figure. A caller outside a parse passes no context and reuses the module's table. */
+function _certExtDecoder(name) {
+  var key = _Oav(name);
+  return function (buf, ctx) {
+    return (ctx ? pkix.certExtensionDecoders(schema.withResources(NS, ctx)).byOid : _CERT_EXT_DECODERS)[key](buf);
+  };
+}
+_AC_EXT_DECODERS[_Oav("authorityKeyIdentifier")] = _certExtDecoder("authorityKeyIdentifier");
+_AC_EXT_DECODERS[_Oav("authorityInfoAccess")] = _certExtDecoder("authorityInfoAccess");
+_AC_EXT_DECODERS[_Oav("cRLDistributionPoints")] = _certExtDecoder("cRLDistributionPoints");
 
 // @internal
 function validateAttributeValue(type, valueDer) {

package/lib/schema-c509.js

@@ -413,16 +413,16 @@ function _generalNameToDer(intVal, valueNode, ipMode, isNative) {
   if (intVal === 0 || intVal === -1 || intVal === -2 || intVal === -3) return _otherNameToDer(valueNode, intVal);
   throw _err("c509/bad-extensions", "GeneralName int " + intVal + " has no C509 sec. 8.13 registry row");
 }
-function _generalNameFromDer(gn, ipMode) {
+function _generalNameFromDer(gn, ipMode, ctx) {
   var t = gn.tagNumber;
   if (t === 1 || t === 2 || t === 6) return [cbor.build.int(BigInt(t)), cbor.build.textString(gn.value)];
-  if (t === 4) { var nm = _dirNameToCbor(gn.bytes); return nm == null ? null : [cbor.build.int(4n), nm]; }
+  if (t === 4) { var nm = _dirNameToCbor(gn.bytes, ctx); return nm == null ? null : [cbor.build.int(4n), nm]; }
   if (t === 7) {
     if (!ipMode) return [cbor.build.int(7n), cbor.build.byteString(gn.value)];
     var ip = _ncIpFromDer(gn.value); return ip == null ? null : [cbor.build.int(7n), cbor.build.byteString(ip)];
   }
   if (t === 8) return [cbor.build.int(8n), _oidCbor(gn.value)];
-  if (t === 0) return _otherNameFromDer(gn.value);
+  if (t === 0) return _otherNameFromDer(gn.value, ctx);
   return null;
 }
 
@@ -434,10 +434,10 @@ function _generalNamesToDer(node, isNative) {
   for (var i = 0; i + 1 < kids.length; i += 2) out.push(_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralName type")), kids[i + 1], false, isNative));
   return out;
 }
-function _generalNamesFromDer(gnNodes) {
+function _generalNamesFromDer(gnNodes, ctx) {
   var out = [];
   for (var i = 0; i < gnNodes.length; i++) {
-    var pair = _generalNameFromDer(schema.walk(GN_LEAF, gnNodes[i], NS), false);
+    var pair = _generalNameFromDer(schema.walk(GN_LEAF, gnNodes[i], schema.withResources(NS, ctx)), false, ctx);
     if (pair == null) return null;
     out.push(pair[0]); out.push(pair[1]);
   }
@@ -470,11 +470,11 @@ function _otherNameToDer(node, intVal) {
   }
   return b.contextConstructed(0, Buffer.concat([b.oid(typeId), b.explicit(0, inner)]));
 }
-function _otherNameFromDer(v) {
+function _otherNameFromDer(v, ctx) {
   var onInt = ON_INT_BY_OID[v.typeId];
   if (onInt === undefined) return [cbor.build.int(0n), cbor.build.array([_oidCbor(v.typeId), cbor.build.byteString(v.valueBytes)])];
   var inner;
-  try { inner = asn1.decode(v.valueBytes); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed otherName value yields null, so the extension does not compact and is carried in C509 general form (raw bytes)
+  try { inner = pkix.decodeNested(v.valueBytes, ctx, "an otherName value"); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed otherName value yields null, so the extension does not compact and is carried in C509 general form (raw bytes)
   if (onInt === -1) {
     if (inner.tagClass !== "universal" || inner.tagNumber !== asn1.TAGS.SEQUENCE || !inner.children || inner.children.length !== 2) return null;
     var hwType, hwSerial;
@@ -492,11 +492,11 @@ function _otherNameFromDer(v) {
   return [cbor.build.int(-3n), cbor.build.byteString(mac)];
 }
 
-function _dirNameToCbor(gnBytes) {
-  var node = asn1.decode(gnBytes);
+function _dirNameToCbor(gnBytes, ctx) {
+  var node = pkix.decodeNested(gnBytes, ctx, "a directoryName value");
   if (!node.children || node.children.length !== 1) return null;
   var name;
-  try { name = _c509NameFromDer(node.children[0].bytes); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed directoryName yields null, so the extension is carried in C509 general form instead
+  try { name = _c509NameFromDer(node.children[0].bytes, ctx); } catch (_e) { return null; }   // allow:swallow-unverified -- a malformed directoryName yields null, so the extension is carried in C509 general form instead
   try { return _encName(name, true); } catch (_e2) { return null; }   // allow:swallow-unverified -- a directoryName that does not re-encode yields null, so the extension is carried in C509 general form instead
 }
 
@@ -745,13 +745,13 @@ function _subtreesToDer(node, isNative) {
   for (var i = 0; i + 1 < kids.length; i += 2) out.push(b.sequence([_generalNameToDer(Number(_cborIntVal(kids[i], "a GeneralSubtree base type")), kids[i + 1], true, isNative)]));
   return Buffer.concat(out);
 }
-function _subtreesFromDer(subtreeNodes) {
+function _subtreesFromDer(subtreeNodes, ctx) {
   if (!subtreeNodes.length) return null;
   var out = [];
   for (var i = 0; i < subtreeNodes.length; i++) {
     var st = subtreeNodes[i];
     if (st.tagClass !== "universal" || st.tagNumber !== asn1.TAGS.SEQUENCE || !st.children || st.children.length !== 1) return null;
-    var pair = _generalNameFromDer(schema.walk(GN_LEAF_SUBTREE, st.children[0], NS), true);
+    var pair = _generalNameFromDer(schema.walk(GN_LEAF_SUBTREE, st.children[0], schema.withResources(NS, ctx)), true, ctx);
     if (pair == null) return null;
     out.push(pair[0]); out.push(pair[1]);
   }
@@ -836,7 +836,7 @@ function _dpToDer(dpNode, isNative) {
   if (!_isCborNull(crlIssuer)) fields.push(b.contextConstructed(2, b.explicit(4, _reconName(_name509(crlIssuer, true, isNative)))));
   return b.sequence(fields);
 }
-function _dpFromDer(dp) {
+function _dpFromDer(dp, ctx) {
   if (dp.tagClass !== "universal" || dp.tagNumber !== asn1.TAGS.SEQUENCE || !dp.children) return null;
   var fullNameUris = null, reasonsVal = null, crlIssuerCbor = null, lastTag = -1;
   for (var i = 0; i < dp.children.length; i++) {
@@ -862,7 +862,7 @@ function _dpFromDer(dp) {
       if (!f.children || f.children.length !== 1) return null;
       var ci = f.children[0];
       if (ci.tagClass !== "context" || ci.tagNumber !== 4 || !ci.children || ci.children.length !== 1) return null;
-      try { crlIssuerCbor = _encName(_c509NameFromDer(ci.children[0].bytes), true); } catch (_e2) { return null; }   // allow:swallow-unverified -- a malformed CRL-issuer name yields null, so the distributionPoint is carried in C509 general form instead
+      try { crlIssuerCbor = _encName(_c509NameFromDer(ci.children[0].bytes, ctx), true); } catch (_e2) { return null; }   // allow:swallow-unverified -- a malformed CRL-issuer name yields null, so the distributionPoint is carried in C509 general form instead
     } else return null;
   }
   if (fullNameUris == null) return null;
@@ -1054,15 +1054,15 @@ function _extValueToDer(name, node, isNative) {
   }
 }
 
-function _extValueFromDer(name, der) {
+function _extValueFromDer(name, der, ctx) {
   var node;
   try {
-  node = asn1.decode(der);
+  node = pkix.decodeNested(der, ctx, "an extension value");
   switch (name) {
     case "subjectKeyIdentifier":
       return cbor.build.byteString(asn1.read.octetString(node));
     case "keyUsage": {
-      var bits = _keyUsageBitsFromDer(der);
+      var bits = _keyUsageBitsFromDer(der, ctx);
       return bits == null ? null : cbor.build.uint(BigInt(bits));
     }
     case "basicConstraints": {
@@ -1081,7 +1081,7 @@ function _extValueFromDer(name, der) {
       if (akids.length === 3 && akids[0].tagClass === "context" && akids[0].tagNumber === 0 &&
           akids[1].tagClass === "context" && akids[1].tagNumber === 1 && akids[1].children &&
           akids[2].tagClass === "context" && akids[2].tagNumber === 2) {
-        var akiIssuer = _generalNamesFromDer(akids[1].children);
+        var akiIssuer = _generalNamesFromDer(akids[1].children, ctx);
         if (akiIssuer == null) return null;
         var akiSerial = asn1.read.integerImplicit(akids[2], 2);
         if (akiSerial < 0n) return null;
@@ -1112,7 +1112,7 @@ function _extValueFromDer(name, der) {
       if (sanMembers.length === 1 && sanMembers[0].tagClass === "context" && sanMembers[0].tagNumber === 2) {
         return cbor.build.textString(schema.walk(GN_LEAF, sanMembers[0], NS).value);
       }
-      var sanItems = _generalNamesFromDer(sanMembers);
+      var sanItems = _generalNamesFromDer(sanMembers, ctx);
       return sanItems == null ? null : cbor.build.array(sanItems);
     }
     case "nameConstraints": {
@@ -1122,7 +1122,7 @@ function _extValueFromDer(name, der) {
         var ncf = node.children[nci];
         if (ncf.tagClass !== "context" || ncf.tagNumber <= ncLast) return null;
         ncLast = ncf.tagNumber;
-        var subItems = _subtreesFromDer(ncf.children || []);
+        var subItems = _subtreesFromDer(ncf.children || [], ctx);
         if (subItems == null) return null;
         if (ncf.tagNumber === 0) { permCbor = cbor.build.array(subItems); sawNc = true; }
         else if (ncf.tagNumber === 1) { exclCbor = cbor.build.array(subItems); sawNc = true; }
@@ -1151,7 +1151,7 @@ function _extValueFromDer(name, der) {
       var dps = node.children || [];
       if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || dps.length < 1) return null;
       var dpResults = [];
-      for (var dpi = 0; dpi < dps.length; dpi++) { var dpr = _dpFromDer(dps[dpi]); if (dpr == null) return null; dpResults.push(dpr); }
+      for (var dpi = 0; dpi < dps.length; dpi++) { var dpr = _dpFromDer(dps[dpi], ctx); if (dpr == null) return null; dpResults.push(dpr); }
       if (dpResults.length === 1 && dpResults[0].oneUri != null && dpResults[0].noReasons && dpResults[0].noIssuer) return cbor.build.textString(dpResults[0].oneUri);
       return cbor.build.array(dpResults.map(function (r) { return r.triple; }));
     }
@@ -1377,14 +1377,14 @@ function _sdaFromDer(node) {
  * the codec represents it, and one without a codec always, since its int form carries the same
  * bytes. An extension the codec cannot represent keeps the generic form on every certificate type.
  */
-function _assertSpecificExtension(dotted, valContent, isNative) {
+function _assertSpecificExtension(dotted, valContent, isNative, ctx) {
   var canon = EXT_NAME_BY_OID[dotted];
   if (!isNative || canon === undefined) return;
-  if (EXT_COMPACT[canon] && (!Buffer.isBuffer(valContent) || _tryCompactExtValue(canon, valContent, isNative) == null)) return;
+  if (EXT_COMPACT[canon] && (!Buffer.isBuffer(valContent) || _tryCompactExtValue(canon, valContent, isNative, ctx) == null)) return;
   throw _err("c509/non-specific-encoding", "extension " + canon + " has a C509 registry id that carries this value, and a natively signed certificate uses only the specific CBOR encoding (draft sec. 3.7)");
 }
-function _tryCompactExtValue(name, der, isNative) {
-  var compact = _extValueFromDer(name, der);
+function _tryCompactExtValue(name, der, isNative, ctx) {
+  var compact = _extValueFromDer(name, der, ctx);
   if (compact == null) return null;
   var recon;
   try {
@@ -1395,7 +1395,7 @@ function _tryCompactExtValue(name, der, isNative) {
   return recon.equals(der) ? compact : null;
 }
 
-function _extensions(node, isNative) {
+function _extensions(node, isNative, ctx) {
   if (node.majorType === 0 || node.majorType === 1) {
     var iv = Number(cbor.read.int(node));
     return [{ name: "keyUsage", oid: oid.byName("keyUsage"), critical: iv < 0, keyUsageBits: Math.abs(iv) }];
@@ -1437,7 +1437,7 @@ function _extensions(node, isNative) {
         if (valNode.majorType !== 2) throw _err("c509/bad-extensions", "a non-critical ~oid extension value must be a byte string");
         valContent = valNode.content;
       }
-      _assertSpecificExtension(extOid, valContent, isNative);
+      _assertSpecificExtension(extOid, valContent, isNative, ctx);
     }
     out.push({ name: name, oid: extOid, critical: critical, value: valContent || null });
   }
@@ -1637,21 +1637,49 @@ function parse(input, callerOpts) {
     if (f[8].majorType !== 2) throw _err("c509/bad-spki", "subjectPublicKey must be a CBOR byte string");
     subjectPublicKey = f[8].content;
   }
-  var extensions = _extensions(f[9], type === 2);
+  /** @internal A native certificate's extension values are opaque DER inside the CBOR, so reading
+   *  one is a second decode that restarts depth and item counting and takes the caps this door
+   *  was given. The latch is re-read before the result is returned. */
+  var nested = pkix.nestedContext(NS, caps);
+  var result;
+  try {
+    result = _finishParse(f, root, nested, {
+      type: type, serial: serial, sHex: sHex, sigAlg: sigAlg, issuer: issuer,
+      notBefore: notBefore, notAfter: notAfter, subject: subject, spkAlg: spkAlg,
+      subjectPublicKey: subjectPublicKey, rsaKey: rsaKey,
+    });
+  } catch (e) {
+    if (nested.budget.exhausted() && !(e && e.code === "c509/too-large")) throw _budgetRefusal(e);
+    throw e;
+  }
+  if (nested.budget.exhausted()) throw _budgetRefusal(null);
+  return result;
+}
+
+/** @internal The refusal a cap produces, as distinct from a statement about the bytes. It is read
+ *  off the latch rather than off a throw, because the probe that reads an extension value absorbs
+ *  a failure by returning null. */
+function _budgetRefusal(cause) {
+  return _err("c509/too-large", "the C509 certificate exceeds the decode budget for this parse", cause || undefined);
+}
+
+function _finishParse(f, root, nested, fields) {
+  var type = fields.type;
+  var extensions = _extensions(f[9], type === 2, nested.ns);
   if (f[10].majorType !== 2) throw _err("c509/bad-signature", "issuerSignatureValue must be a CBOR byte string");
   var signatureValue = f[10].content;
 
   var result = {
     certificateType: type,
-    serialNumber: serial,
-    serialNumberHex: sHex,
-    signatureAlgorithm: sigAlg,
-    issuer: issuer,
-    validity: { notBefore: notBefore, notAfter: notAfter },
-    subject: subject,
-    subjectPublicKeyAlgorithm: spkAlg,
-    subjectPublicKey: subjectPublicKey,
-    rsaPublicKey: rsaKey,
+    serialNumber: fields.serial,
+    serialNumberHex: fields.sHex,
+    signatureAlgorithm: fields.sigAlg,
+    issuer: fields.issuer,
+    validity: { notBefore: fields.notBefore, notAfter: fields.notAfter },
+    subject: fields.subject,
+    subjectPublicKeyAlgorithm: fields.spkAlg,
+    subjectPublicKey: fields.subjectPublicKey,
+    rsaPublicKey: fields.rsaKey,
     extensions: extensions,
     signatureValue: signatureValue,
   };
@@ -1660,7 +1688,6 @@ function parse(input, callerOpts) {
   if (type === 2) result.signedData = result._fieldBytes;
 
   if (type === 3) result.reconstructedDer = _reconstructDer(result, f[10]);
-
   return result;
 }
 
@@ -1883,8 +1910,8 @@ function _euiFromCn(value) {
   if (bytes[3] === 0xff && bytes[4] === 0xfe) return Buffer.concat([bytes.subarray(0, 3), bytes.subarray(5)]);
   return bytes;
 }
-function _c509NameFromDer(nameBytes) {
-  var node = asn1.decode(nameBytes);
+function _c509NameFromDer(nameBytes, ctx) {
+  var node = pkix.decodeNested(nameBytes, ctx, "a Name value");
   var rdns = [];
   (node.children || []).forEach(function (rdnSet) {
     if (!rdnSet.children || rdnSet.children.length !== 1) throw _err("c509/non-invertible", "a C509 Name requires single-attribute RDNs");
@@ -1905,10 +1932,10 @@ function _c509NameFromDer(nameBytes) {
   });
   return { rdns: rdns };
 }
-function _keyUsageBitsFromDer(extnValue) {
+function _keyUsageBitsFromDer(extnValue, ctx) {
   var bs;
   try {
-    bs = asn1.read.bitString(asn1.decode(extnValue));
+    bs = asn1.read.bitString(pkix.decodeNested(extnValue, ctx, "a keyUsage extension value"));
   } catch (_e) {
     return null;
   }
@@ -1925,6 +1952,7 @@ function _magBytes(intNode) {
 }
 function _sigMagWidth(derSig) {
   var n;
+  // allow:bare-decode on the DER -> C509 conversion, below the X.509 parse door that caps the input.
   try { n = asn1.decode(derSig); } catch (e) { throw _err("c509/bad-signature", "the ECDSA issuer signature is not valid DER", e); }
   if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length !== 2) throw _err("c509/bad-signature", "the ECDSA issuer signature must be a SEQUENCE of two INTEGERs");
   for (var i = 0; i < 2; i++) {
@@ -1969,12 +1997,14 @@ _derToType3 = function (input, opts) {
   var sigAlgName = sigCanon === undefined ? c.signatureAlgorithm.name : sigCanon;
   if (String(sigAlgName || "").toLowerCase().indexOf("ecdsa") !== 0) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (sigAlgName || "an unregistered algorithm"));
   if (c.subjectPublicKeyInfo.algorithm.oid !== oid.byName("ecPublicKey")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
+  // allow:bare-decode on the DER -> C509 conversion, below the X.509 parse door that caps the input.
   var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));
   var curveCanon = EC_CURVE_BY_OID[curveOid];
   var curve = curveCanon === undefined ? oid.name(curveOid) : curveCanon;
   var coordLen = EC_FIELD_BYTES[curve];
   if (!coordLen) throw _err("c509/non-invertible", "unsupported EC subject curve " + (curve || curveOid));
   var sigCurve = _resolveIssuerSigCurve(c, opts, sigAlgName);
+  // allow:bare-decode on the DER -> C509 conversion, below the X.509 parse door that caps the input.
   var spkiNode = asn1.decode(c.subjectPublicKeyInfo.bytes);
   return {
     certificateType: 3,

package/lib/schema-cmc.js

@@ -195,8 +195,8 @@ function readExtendedFailInfo(children, what) {
   return { failInfoOID: asn1.read.oid(children[0]), failInfoValueBytes: children[1].bytes };
 }
 
-function parseStatusInfo(valueDer, version, bodyPartID) {
-  var root = asn1.decode(valueDer);
+function parseStatusInfo(valueDer, version, bodyPartID, ctx) {
+  var root = pkix.decodeNested(valueDer, ctx, "a CMCStatusInfo value");
   if (root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE || !root.constructed) {
     throw E("cmc/bad-status-info", "a CMCStatusInfo value must be a SEQUENCE");
   }
@@ -447,14 +447,15 @@ var PKI_RESPONSE = schema.seq([
  * that is not one could never be checked against anything. This is asked of a CHALLENGED request only.
  * A request body carries what its sender sent, and judging it is the enrollment's business, not the
  * decoder's. */
-function _assertAnswerableRequest(request) {
+function _assertAnswerableRequest(request, ctx) {
   if (request.arm !== "tcr" && request.arm !== "crm") return;
   /** @internal A CertReqMessages of one, which is the shape the CRMF parser takes; built outside the
    * catch below so only the parse it wraps can be what fails. */
   var payload = request.arm === "tcr" ? request.certificationRequestBytes
     : asn1.build.sequence([asn1.build.raw(request.certReqMsgBytes)]);
   try {
-    if (request.arm === "tcr") { csr.parse(payload); } else { crmf.parse(payload); }
+    var caps = ctx ? ctx.caps : undefined;
+    if (request.arm === "tcr") { csr.parse(payload, caps); } else { crmf.parse(payload, caps); }
   } catch (e) {
     throw E("cmc/bad-pop-challenge",
       "the request an EncryptedPOP quotes is not a " +
@@ -464,13 +465,13 @@ function _assertAnswerableRequest(request) {
   }
 }
 
-function parseEncryptedPop(node) {
+function parseEncryptedPop(node, ctx) {
   if (node.tagClass !== "universal" || node.tagNumber !== TAGS.SEQUENCE || !node.constructed ||
       node.children.length !== 5) {
     throw E("cmc/bad-pop-challenge",
       "an EncryptedPOP is SEQUENCE { request, cms, thePOPAlgID, witnessAlgID, witness } (RFC 5272 sec. 6.7)");
   }
-  var envelope = _assertEnvelopedChallenge(node.children[1]);
+  var envelope = _assertEnvelopedChallenge(node.children[1], ctx);
   var request;
   try { request = parseTaggedRequest(node.children[0]); }
   catch (e) {
@@ -478,7 +479,7 @@ function parseEncryptedPop(node) {
       "an EncryptedPOP quotes the request it challenges as a TaggedRequest: " +
       ((e && e.message) || "malformed") + " (RFC 5272 sec. 6.7)", e);
   }
-  _assertAnswerableRequest(request);
+  _assertAnswerableRequest(request, ctx);
   return {
     request: request,
     /** @internal The TaggedRequest exactly as it arrived. A proof of possession is a MAC over these
@@ -526,7 +527,7 @@ function parseDecryptedPop(node) {
  * on unopened because opening them needs key material this parser does not hold. Unopened is not
  * unchecked: a field that is not a ContentInfo carrying an EnvelopedData cannot be a challenge, and
  * saying so here is what keeps a control that could never be answered from reading as one. */
-function _assertEnvelopedChallenge(node) {
+function _assertEnvelopedChallenge(node, ctx) {
   var kids = pkix.rootSequenceChildren(node, 2, 2);
   if (!kids) {
     throw E("cmc/bad-pop-challenge",
@@ -557,7 +558,7 @@ function _assertEnvelopedChallenge(node) {
    * a challenge addressed only that way is refused here, and `pki.cms.decrypt` could not open it
    * either, so it is refused where the reason can be named rather than after a failed answer. */
   var enveloped;
-  try { enveloped = cms.walkEnvelopedData(content.children[0]); }
+  try { enveloped = cms.walkEnvelopedData(content.children[0], ctx); }
   catch (e) {
     throw E("cmc/bad-pop-challenge",
       "an EncryptedPOP's ContentInfo does not carry an EnvelopedData a recipient could open: " +
@@ -594,26 +595,26 @@ function _popAlgorithm(node, what) {
 }
 
 /** @internal One AttributeValue, which is what a control carrying a single structure holds. */
-function _onlyValue(c, what) {
+function _onlyValue(c, what, ctx) {
   if (c.values.length !== 1) {
     throw E("cmc/bad-pop-challenge",
       "a " + what + " control carries exactly one AttributeValue, got " + c.values.length);
   }
-  return asn1.decode(c.values[0]);
+  return pkix.decodeNested(c.values[0], ctx, what + " control value");
 }
 
-function _decodePopChallenges(controls) {
+function _decodePopChallenges(controls, ctx) {
   for (var i = 0; i < controls.length; i++) {
     var c = controls[i];
     if (c.attrType === OID_ENCRYPTED_POP) {
-      c.encryptedPOP = parseEncryptedPop(_onlyValue(c, "an Encrypted POP"));
+      c.encryptedPOP = parseEncryptedPop(_onlyValue(c, "an Encrypted POP", ctx), ctx);
     } else if (c.attrType === OID_DECRYPTED_POP) {
-      c.decryptedPOP = parseDecryptedPop(_onlyValue(c, "a Decrypted POP"));
+      c.decryptedPOP = parseDecryptedPop(_onlyValue(c, "a Decrypted POP", ctx));
     }
   }
 }
 
-function _collectStatuses(controls) {
+function _collectStatuses(controls, ctx) {
   var out = [];
   for (var i = 0; i < controls.length; i++) {
     var c = controls[i];
@@ -622,15 +623,15 @@ function _collectStatuses(controls) {
     if (c.values.length !== 1) {
       throw E("cmc/bad-status-info", "a CMC status control carries exactly one AttributeValue, got " + c.values.length);
     }
-    out.push(parseStatusInfo(c.values[0], version, c.bodyPartID));
+    out.push(parseStatusInfo(c.values[0], version, c.bodyPartID, ctx));
   }
   return out;
 }
 
-function _finishBody(body, where) {
+function _finishBody(body, where, ctx) {
   for (var i = 0; i < body.controls.length; i++) assertControlPlacement(body.controls[i], where);
-  _decodePopChallenges(body.controls);
-  body.statuses = _collectStatuses(body.controls);
+  _decodePopChallenges(body.controls, ctx);
+  body.statuses = _collectStatuses(body.controls, ctx);
   body.unhandled = body.controls.filter(function (c) {
     return c.attrType !== OID_STATUS_INFO && c.attrType !== OID_STATUS_INFO_V2 && c.attrName === null;
   });
@@ -674,7 +675,7 @@ function parsePkiData(input, callerOpts) {
   return pkix.runParseWith(input, _BODY_PARSE_OPTS, callerOpts, function (root, ns) {
     var body = schema.walk(PKI_DATA, root, ns).result;
     body.bytes = root.bytes;
-    return _finishBody(body, "pkiData");
+    return _finishBody(body, "pkiData", ns);
   });
 }
 
@@ -706,7 +707,7 @@ function parsePkiResponse(input, callerOpts) {
   return pkix.runParseWith(input, _BODY_PARSE_OPTS, callerOpts, function (root, ns) {
     var body = schema.walk(PKI_RESPONSE, root, ns).result;
     body.bytes = root.bytes;
-    return _finishBody(body, "pkiResponse");
+    return _finishBody(body, "pkiResponse", ns);
   });
 }
 
@@ -793,7 +794,9 @@ function parse(input, callerOpts) {
     throw E("cmc/no-content",
       "a Full PKI Request / Response carries its body as the encapsulated content; this SignedData is detached (RFC 5272 sec. 3.2)");
   }
-  var body = eContentType === OID_PKI_DATA ? parsePkiData(encap.eContent) : parsePkiResponse(encap.eContent);
+  var body = eContentType === OID_PKI_DATA
+    ? parsePkiData(encap.eContent, caps)
+    : parsePkiResponse(encap.eContent, caps);
   body.cms = parsedCms;
   body.eContentType = eContentType;
   return body;