diff --git a/der/src/reader/position.rs b/der/src/reader/position.rs index 0d160a291..673d7b1c6 100644 --- a/der/src/reader/position.rs +++ b/der/src/reader/position.rs @@ -74,7 +74,7 @@ impl Position { /// A [`Resumption`] value which can be used to continue parsing the outer message. pub(super) fn split_nested(&mut self, len: Length) -> Result { match self.depth.checked_add(1) { - Some(depth) if depth < Self::MAX_DEPTH => self.depth = depth, + Some(depth) if depth <= Self::MAX_DEPTH => self.depth = depth, _ => return Err(self.error(ErrorKind::NestingDepth)), } diff --git a/der/tests/nesting.rs b/der/tests/nesting.rs index d8e81e703..250672d0e 100644 --- a/der/tests/nesting.rs +++ b/der/tests/nesting.rs @@ -15,11 +15,9 @@ fn walk<'a>(reader: &mut SliceReader<'a>) -> Result, Error> { } } -#[test] +/// Wrap an innermost `NULL` in `depth` nested `SEQUENCE`s. #[allow(clippy::cast_possible_truncation, reason = "test")] -fn returns_nesting_depth_error_when_max_depth_encountered() { - let depth = MAX_DEPTH + 1; - +fn nested_sequences(depth: usize) -> Vec { let mut buf = vec![0x05, 0x00]; // innermost NULL for _ in 0..depth { let len = buf.len(); @@ -43,7 +41,19 @@ fn returns_nesting_depth_error_when_max_depth_encountered() { next.extend_from_slice(&buf); buf = next; } + buf +} + +#[test] +fn accepts_documented_max_depth() { + let buf = nested_sequences(MAX_DEPTH); + let mut reader = SliceReader::new(&buf).unwrap(); + walk(&mut reader).expect("MAX_DEPTH levels of nesting should decode"); +} +#[test] +fn returns_nesting_depth_error_when_max_depth_encountered() { + let buf = nested_sequences(MAX_DEPTH + 1); let mut reader = SliceReader::new(&buf).unwrap(); let err = walk(&mut reader).expect_err("should return ErrorKind::NestingDepth"); assert_eq!(err.kind(), ErrorKind::NestingDepth);