check for >2 bytes long chars

Author: baloo

der/Cargo.toml

@@ -39,6 +39,7 @@ derive = ["dep:der_derive"]
 oid = ["dep:const-oid"]
 pem = ["dep:pem-rfc7468", "alloc", "zeroize"]
 real = []
+hazmat = []
 
 [package.metadata.docs.rs]
 all-features = true

der/src/asn1/bmp_string.rs

@@ -44,6 +44,10 @@ impl BmpString {
         #[allow(clippy::integer_arithmetic)]
         let mut bytes = Vec::with_capacity(utf8.len() * 2);
 
+        if utf8.chars().any(|c| c.len_utf16() != 1) {
+            return Err(Tag::BmpString.value_error());
+        }
+
         for code_point in utf8.encode_utf16() {
             bytes.extend(code_point.to_be_bytes());
         }
@@ -77,6 +81,24 @@ impl BmpString {
             .chunks_exact(2)
             .map(|chunk| u16::from_be_bytes(chunk.try_into().expect("two bytes")))
     }
+
+    #[cfg(feature = "hazmat")]
+    /// Create a new [`BmpString`] from bytes.
+    ///
+    /// It bypasses the check for utf16 encoding of its values.
+    pub fn new_unchecked(bytes: impl Into<Box<[u8]>>) -> Result<Self> {
+        let bytes = bytes.into();
+
+        if bytes.len() % 2 != 0 {
+            return Err(Tag::BmpString.length_error());
+        }
+
+        let ret = Self {
+            bytes: bytes.try_into()?,
+        };
+
+        Ok(ret)
+    }
 }
 
 impl AsRef<[u8]> for BmpString {
@@ -131,7 +153,7 @@ impl fmt::Display for BmpString {
 #[cfg(test)]
 mod tests {
     use super::BmpString;
-    use crate::{Decode, Encode};
+    use crate::{Decode, Encode, Tag};
     use alloc::string::ToString;
     use hex_literal::hex;
 
@@ -157,4 +179,15 @@ mod tests {
         let encoded = bmp_string.to_der().unwrap();
         assert_eq!(encoded, EXAMPLE_BYTES);
     }
+
+    #[test]
+    fn encode_errors() {
+        let err = BmpString::from_utf8("🔥");
+        assert_eq!(err, Err(Tag::BmpString.value_error()));
+
+        #[cfg(feature = "hazmat")]
+        {
+            assert!(BmpString::new_unchecked("🔥".as_bytes()).is_ok());
+        }
+    }
 }