/src/boringssl/crypto/x509/asn1_gen.cc

Source
// Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include <openssl/x509.h>

#include <assert.h>
#include <ctype.h>
#include <limits.h>
#include <string.h>

#include <openssl/asn1.h>
#include <openssl/bytestring.h>
#include <openssl/err.h>
#include <openssl/obj.h>

#include "../conf/internal.h"
#include "../internal.h"
#include "internal.h"


using namespace bssl;

// Although this file is in crypto/x509 for layering purposes, it emits
// errors from the ASN.1 module for OpenSSL compatibility.

// ASN1_GEN_MAX_DEPTH is the maximum number of nested TLVs allowed.
#define ASN1_GEN_MAX_DEPTH 50

// ASN1_GEN_MAX_OUTPUT is the maximum output, in bytes, allowed. This limit is
// necessary because the SEQUENCE and SET section reference mechanism allows the
// output length to grow super-linearly with the input length.
#define ASN1_GEN_MAX_OUTPUT (64 * 1024)

// ASN1_GEN_FORMAT_* are the values for the format modifiers.
#define ASN1_GEN_FORMAT_ASCII 1
#define ASN1_GEN_FORMAT_UTF8 2
#define ASN1_GEN_FORMAT_HEX 3
#define ASN1_GEN_FORMAT_BITLIST 4

// generate_v3 converts `str` into an ASN.1 structure and writes the result to
// `cbb`. It returns one on success and zero on error. `depth` bounds recursion,
// and `format` specifies the current format modifier.
//
// If `tag` is non-zero, the structure is implicitly tagged with `tag`. `tag`
// must not have the constructed bit set.
static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
                       CBS_ASN1_TAG tag, int format, int depth);

static int bitstr_cb(const char *elem, size_t len, void *bitstr);

ASN1_TYPE *bssl::ASN1_generate_v3(const char *str, const X509V3_CTX *cnf) {
  ScopedCBB cbb;
  if (!CBB_init(cbb.get(), 0) ||  //
      !generate_v3(cbb.get(), str, cnf, /*tag=*/0, ASN1_GEN_FORMAT_ASCII,
                   /*depth=*/0)) {
    return nullptr;
  }

  // While not strictly necessary to avoid a DoS (we rely on any super-linear
  // checks being performed internally), cap the overall output to
  // `ASN1_GEN_MAX_OUTPUT` so the externally-visible behavior is consistent.
  if (CBB_len(cbb.get()) > ASN1_GEN_MAX_OUTPUT) {
    OPENSSL_PUT_ERROR(ASN1, ASN1_R_TOO_LONG);
    return nullptr;
  }

  const uint8_t *der = CBB_data(cbb.get());
  return d2i_ASN1_TYPE(nullptr, &der, CBB_len(cbb.get()));
}

static int cbs_str_equal(const CBS *cbs, const char *str) {
  return CBS_len(cbs) == strlen(str) &&
         OPENSSL_memcmp(CBS_data(cbs), str, strlen(str)) == 0;
}

// parse_tag decodes a tag specifier in `cbs`. It returns the tag on success or
// zero on error.
static CBS_ASN1_TAG parse_tag(const CBS *cbs) {
  CBS copy = *cbs;
  uint64_t num;
  if (!CBS_get_u64_decimal(&copy, &num) || num > CBS_ASN1_TAG_NUMBER_MASK) {
    OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_NUMBER);
    return 0;
  }

  CBS_ASN1_TAG tag_class = CBS_ASN1_CONTEXT_SPECIFIC;
  // The tag may be suffixed by a class.
  uint8_t c;
  if (CBS_get_u8(&copy, &c)) {
    switch (c) {
      case 'U':
        tag_class = CBS_ASN1_UNIVERSAL;
        break;
      case 'A':
        tag_class = CBS_ASN1_APPLICATION;
        break;
      case 'P':
        tag_class = CBS_ASN1_PRIVATE;
        break;
      case 'C':
        tag_class = CBS_ASN1_CONTEXT_SPECIFIC;
        break;
      default: {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_MODIFIER);
        return 0;
      }
    }
    if (CBS_len(&copy) != 0) {
      OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_MODIFIER);
      return 0;
    }
  }

  // Tag [UNIVERSAL 0] is reserved for indefinite-length end-of-contents. We
  // also use zero in this file to indicator no explicit tagging.
  if (tag_class == CBS_ASN1_UNIVERSAL && num == 0) {
    OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_NUMBER);
    return 0;
  }

  return tag_class | (CBS_ASN1_TAG)num;
}

static int generate_wrapped(CBB *cbb, const char *str, const X509V3_CTX *cnf,
                            CBS_ASN1_TAG tag, int padding, int format,
                            int depth) {
  CBB child;
  return CBB_add_asn1(cbb, &child, tag) &&
         (!padding || CBB_add_u8(&child, 0)) &&
         generate_v3(&child, str, cnf, /*tag=*/0, format, depth + 1) &&
         CBB_flush(cbb);
}

static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
                       CBS_ASN1_TAG tag, int format, int depth) {
  assert((tag & CBS_ASN1_CONSTRUCTED) == 0);
  if (depth > ASN1_GEN_MAX_DEPTH) {
    OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_NESTED_TAGGING);
    return 0;
  }

  // Process modifiers. This function uses a mix of NUL-terminated strings and
  // `CBS`. Several functions only work with NUL-terminated strings, so we need
  // to keep track of when a slice spans the whole buffer.
  for (;;) {
    // Skip whitespace.
    while (*str != '\0' && OPENSSL_isspace((unsigned char)*str)) {
      str++;
    }

    // Modifiers end at commas.
    const char *comma = strchr(str, ',');
    if (comma == nullptr) {
      break;
    }

    // Remove trailing whitespace.
    CBS modifier;
    CBS_init(&modifier, (const uint8_t *)str, comma - str);
    for (;;) {
      uint8_t v;
      CBS copy = modifier;
      if (!CBS_get_last_u8(&copy, &v) || !OPENSSL_isspace(v)) {
        break;
      }
      modifier = copy;
    }

    // Advance the string past the modifier, but save the original value. We
    // will need to rewind if this is not a recognized modifier.
    const char *str_old = str;
    str = comma + 1;

    // Each modifier is either NAME:VALUE or NAME.
    CBS name;
    int has_value = CBS_get_until_first(&modifier, &name, ':');
    if (has_value) {
      CBS_skip(&modifier, 1);  // Skip the colon.
    } else {
      name = modifier;
      CBS_init(&modifier, nullptr, 0);
    }

    if (cbs_str_equal(&name, "FORMAT") || cbs_str_equal(&name, "FORM")) {
      if (cbs_str_equal(&modifier, "ASCII")) {
        format = ASN1_GEN_FORMAT_ASCII;
      } else if (cbs_str_equal(&modifier, "UTF8")) {
        format = ASN1_GEN_FORMAT_UTF8;
      } else if (cbs_str_equal(&modifier, "HEX")) {
        format = ASN1_GEN_FORMAT_HEX;
      } else if (cbs_str_equal(&modifier, "BITLIST")) {
        format = ASN1_GEN_FORMAT_BITLIST;
      } else {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNKNOWN_FORMAT);
        return 0;
      }
    } else if (cbs_str_equal(&name, "IMP") ||
               cbs_str_equal(&name, "IMPLICIT")) {
      if (tag != 0) {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_NESTED_TAGGING);
        return 0;
      }
      tag = parse_tag(&modifier);
      if (tag == 0) {
        return 0;
      }
    } else if (cbs_str_equal(&name, "EXP") ||
               cbs_str_equal(&name, "EXPLICIT")) {
      // It would actually be supportable, but OpenSSL does not allow wrapping
      // an explicit tag in an implicit tag.
      if (tag != 0) {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_NESTED_TAGGING);
        return 0;
      }
      tag = parse_tag(&modifier);
      return tag != 0 &&
             generate_wrapped(cbb, str, cnf, tag | CBS_ASN1_CONSTRUCTED,
                              /*padding=*/0, format, depth);
    } else if (cbs_str_equal(&name, "OCTWRAP")) {
      tag = tag == 0 ? CBS_ASN1_OCTETSTRING : tag;
      return generate_wrapped(cbb, str, cnf, tag, /*padding=*/0, format, depth);
    } else if (cbs_str_equal(&name, "BITWRAP")) {
      tag = tag == 0 ? CBS_ASN1_BITSTRING : tag;
      return generate_wrapped(cbb, str, cnf, tag, /*padding=*/1, format, depth);
    } else if (cbs_str_equal(&name, "SEQWRAP")) {
      tag = tag == 0 ? CBS_ASN1_SEQUENCE : (tag | CBS_ASN1_CONSTRUCTED);
      tag |= CBS_ASN1_CONSTRUCTED;
      return generate_wrapped(cbb, str, cnf, tag, /*padding=*/0, format, depth);
    } else if (cbs_str_equal(&name, "SETWRAP")) {
      tag = tag == 0 ? CBS_ASN1_SET : (tag | CBS_ASN1_CONSTRUCTED);
      return generate_wrapped(cbb, str, cnf, tag, /*padding=*/0, format, depth);
    } else {
      // If this was not a recognized modifier, rewind `str` to before splitting
      // on the comma. The type itself consumes all remaining input.
      str = str_old;
      break;
    }
  }

  // The final element is, like modifiers, NAME:VALUE or NAME, but VALUE spans
  // the length of the string, including any commas.
  const char *colon = strchr(str, ':');
  CBS name;
  const char *value;
  int has_value = colon != nullptr;
  if (has_value) {
    CBS_init(&name, (const uint8_t *)str, colon - str);
    value = colon + 1;
  } else {
    CBS_init(&name, (const uint8_t *)str, strlen(str));
    value = "";  // Most types treat missing and empty value equivalently.
  }

  static const struct {
    const char *name;
    CBS_ASN1_TAG type;
  } kTypes[] = {
      {"BOOL", CBS_ASN1_BOOLEAN},
      {"BOOLEAN", CBS_ASN1_BOOLEAN},
      {"NULL", CBS_ASN1_NULL},
      {"INT", CBS_ASN1_INTEGER},
      {"INTEGER", CBS_ASN1_INTEGER},
      {"ENUM", CBS_ASN1_ENUMERATED},
      {"ENUMERATED", CBS_ASN1_ENUMERATED},
      {"OID", CBS_ASN1_OBJECT},
      {"OBJECT", CBS_ASN1_OBJECT},
      {"UTCTIME", CBS_ASN1_UTCTIME},
      {"UTC", CBS_ASN1_UTCTIME},
      {"GENERALIZEDTIME", CBS_ASN1_GENERALIZEDTIME},
      {"GENTIME", CBS_ASN1_GENERALIZEDTIME},
      {"OCT", CBS_ASN1_OCTETSTRING},
      {"OCTETSTRING", CBS_ASN1_OCTETSTRING},
      {"BITSTR", CBS_ASN1_BITSTRING},
      {"BITSTRING", CBS_ASN1_BITSTRING},
      {"UNIVERSALSTRING", CBS_ASN1_UNIVERSALSTRING},
      {"UNIV", CBS_ASN1_UNIVERSALSTRING},
      {"IA5", CBS_ASN1_IA5STRING},
      {"IA5STRING", CBS_ASN1_IA5STRING},
      {"UTF8", CBS_ASN1_UTF8STRING},
      {"UTF8String", CBS_ASN1_UTF8STRING},
      {"BMP", CBS_ASN1_BMPSTRING},
      {"BMPSTRING", CBS_ASN1_BMPSTRING},
      {"PRINTABLESTRING", CBS_ASN1_PRINTABLESTRING},
      {"PRINTABLE", CBS_ASN1_PRINTABLESTRING},
      {"T61", CBS_ASN1_T61STRING},
      {"T61STRING", CBS_ASN1_T61STRING},
      {"TELETEXSTRING", CBS_ASN1_T61STRING},
      {"SEQUENCE", CBS_ASN1_SEQUENCE},
      {"SEQ", CBS_ASN1_SEQUENCE},
      {"SET", CBS_ASN1_SET},
  };
  CBS_ASN1_TAG type = 0;
  for (const auto &t : kTypes) {
    if (cbs_str_equal(&name, t.name)) {
      type = t.type;
      break;
    }
  }
  if (type == 0) {
    OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNKNOWN_TAG);
    return 0;
  }

  // If there is an implicit tag, use the constructed bit from the base type.
  tag = tag == 0 ? type : (tag | (type & CBS_ASN1_CONSTRUCTED));
  CBB child;
  if (!CBB_add_asn1(cbb, &child, tag)) {
    return 0;
  }

  switch (type) {
    case CBS_ASN1_NULL:
      if (*value != '\0') {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_NULL_VALUE);
        return 0;
      }
      return CBB_flush(cbb);

    case CBS_ASN1_BOOLEAN: {
      if (format != ASN1_GEN_FORMAT_ASCII) {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_NOT_ASCII_FORMAT);
        return 0;
      }
      ASN1_BOOLEAN boolean;
      if (!X509V3_bool_from_string(value, &boolean)) {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_BOOLEAN);
        return 0;
      }
      return CBB_add_u8(&child, boolean ? 0xff : 0x00) && CBB_flush(cbb);
    }

    case CBS_ASN1_INTEGER:
    case CBS_ASN1_ENUMERATED: {
      if (format != ASN1_GEN_FORMAT_ASCII) {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_INTEGER_NOT_ASCII_FORMAT);
        return 0;
      }
      ASN1_INTEGER *obj = s2i_ASN1_INTEGER(nullptr, value);
      if (obj == nullptr) {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_INTEGER);
        return 0;
      }
      int len = i2c_ASN1_INTEGER(obj, nullptr);
      uint8_t *out;
      int ok = len > 0 &&  //
               CBB_add_space(&child, &out, len) &&
               i2c_ASN1_INTEGER(obj, &out) == len && CBB_flush(cbb);
      ASN1_INTEGER_free(obj);
      return ok;
    }

    case CBS_ASN1_OBJECT: {
      if (format != ASN1_GEN_FORMAT_ASCII) {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_OBJECT_NOT_ASCII_FORMAT);
        return 0;
      }
      ASN1_OBJECT *obj = OBJ_txt2obj(value, /*dont_search_names=*/0);
      if (obj == nullptr || obj->length == 0) {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_OBJECT);
        return 0;
      }
      int ok = CBB_add_bytes(&child, obj->data, obj->length) && CBB_flush(cbb);
      ASN1_OBJECT_free(obj);
      return ok;
    }

    case CBS_ASN1_UTCTIME:
    case CBS_ASN1_GENERALIZEDTIME: {
      if (format != ASN1_GEN_FORMAT_ASCII) {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_TIME_NOT_ASCII_FORMAT);
        return 0;
      }
      CBS value_cbs;
      CBS_init(&value_cbs, (const uint8_t *)value, strlen(value));
      int ok = type == CBS_ASN1_UTCTIME
                   ? CBS_parse_utc_time(&value_cbs, nullptr,
                                        /*allow_timezone_offset=*/0)
                   : CBS_parse_generalized_time(&value_cbs, nullptr,
                                                /*allow_timezone_offset=*/0);
      if (!ok) {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_TIME_VALUE);
        return 0;
      }
      return CBB_add_bytes(&child, (const uint8_t *)value, strlen(value)) &&
             CBB_flush(cbb);
    }

    case CBS_ASN1_UNIVERSALSTRING:
    case CBS_ASN1_IA5STRING:
    case CBS_ASN1_UTF8STRING:
    case CBS_ASN1_BMPSTRING:
    case CBS_ASN1_PRINTABLESTRING:
    case CBS_ASN1_T61STRING: {
      int encoding;
      if (format == ASN1_GEN_FORMAT_ASCII) {
        encoding = MBSTRING_ASC;
      } else if (format == ASN1_GEN_FORMAT_UTF8) {
        encoding = MBSTRING_UTF8;
      } else {
        OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_FORMAT);
        return 0;
      }

      // `maxsize` is measured in code points, rather than bytes, but pass it in
      // as a loose cap so fuzzers can exit from excessively long inputs
      // earlier. This limit is not load-bearing because `ASN1_mbstring_ncopy`'s
      // output is already linear in the input.
      ASN1_STRING *obj = nullptr;
      if (ASN1_mbstring_ncopy(&obj, (const uint8_t *)value, -1, encoding,
                              ASN1_tag2bit(type), /*minsize=*/0,
                              /*maxsize=*/ASN1_GEN_MAX_OUTPUT) <= 0) {
        return 0;
      }
      int ok = CBB_add_bytes(&child, obj->data, obj->length) && CBB_flush(cbb);
      ASN1_STRING_free(obj);
      return ok;
    }

    case CBS_ASN1_BITSTRING:
      if (format == ASN1_GEN_FORMAT_BITLIST) {
        ASN1_BIT_STRING *obj = ASN1_BIT_STRING_new();
        if (obj == nullptr) {
          return 0;
        }
        if (!CONF_parse_list(value, ',', 1, bitstr_cb, obj)) {
          OPENSSL_PUT_ERROR(ASN1, ASN1_R_LIST_ERROR);
          ASN1_BIT_STRING_free(obj);
          return 0;
        }
        int len = i2c_ASN1_BIT_STRING(obj, nullptr);
        uint8_t *out;
        int ok = len > 0 &&  //
                 CBB_add_space(&child, &out, len) &&
                 i2c_ASN1_BIT_STRING(obj, &out) == len &&  //
                 CBB_flush(cbb);
        ASN1_BIT_STRING_free(obj);
        return ok;
      }

      // The other formats are the same as OCTET STRING, but with the leading
      // zero bytes.
      if (!CBB_add_u8(&child, 0)) {
        return 0;
      }
      [[fallthrough]];

    case CBS_ASN1_OCTETSTRING:
      if (format == ASN1_GEN_FORMAT_ASCII) {
        return CBB_add_bytes(&child, (const uint8_t *)value, strlen(value)) &&
               CBB_flush(cbb);
      }
      if (format == ASN1_GEN_FORMAT_HEX) {
        size_t len;
        uint8_t *data = x509v3_hex_to_bytes(value, &len);
        if (data == nullptr) {
          OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_HEX);
          return 0;
        }
        int ok = CBB_add_bytes(&child, data, len) && CBB_flush(cbb);
        OPENSSL_free(data);
        return ok;
      }

      OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_BITSTRING_FORMAT);
      return 0;

    case CBS_ASN1_SEQUENCE:
    case CBS_ASN1_SET:
      if (has_value) {
        if (cnf == nullptr) {
          OPENSSL_PUT_ERROR(ASN1, ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG);
          return 0;
        }
        const STACK_OF(CONF_VALUE) *section = X509V3_get_section(cnf, value);
        if (section == nullptr) {
          OPENSSL_PUT_ERROR(ASN1, ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG);
          return 0;
        }
        for (size_t i = 0; i < sk_CONF_VALUE_num(section); i++) {
          const CONF_VALUE *conf = sk_CONF_VALUE_value(section, i);
          if (!generate_v3(&child, conf->value, cnf, /*tag=*/0,
                           ASN1_GEN_FORMAT_ASCII, depth + 1)) {
            return 0;
          }
          // This recursive call, by referencing `section`, is the one place
          // where `generate_v3`'s output can be super-linear in the input.
          // Check bounds here.
          if (CBB_len(&child) > ASN1_GEN_MAX_OUTPUT) {
            OPENSSL_PUT_ERROR(ASN1, ASN1_R_TOO_LONG);
            return 0;
          }
        }
      }
      if (type == CBS_ASN1_SET) {
        // The SET type here is a SET OF and must be sorted.
        return CBB_flush_asn1_set_of(&child) && CBB_flush(cbb);
      }
      return CBB_flush(cbb);

    default:
      OPENSSL_PUT_ERROR(ASN1, ERR_R_INTERNAL_ERROR);
      return 0;
  }
}

static int bitstr_cb(const char *elem, size_t len, void *bitstr) {
  CBS cbs;
  CBS_init(&cbs, (const uint8_t *)elem, len);
  uint64_t bitnum;
  if (!CBS_get_u64_decimal(&cbs, &bitnum) || CBS_len(&cbs) != 0 ||
      // Cap the highest allowed bit so this mechanism cannot be used to create
      // extremely large allocations with short inputs. The highest named bit in
      // RFC 5280 is 8, so 256 should give comfortable margin but still only
      // allow a 32-byte allocation.
      //
      // We do not consider this function to be safe with untrusted inputs (even
      // without bugs, it is prone to string injection vulnerabilities), so DoS
      // is not truly a concern, but the limit is necessary to keep fuzzing
      // effective.
      bitnum > 256) {
    OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_NUMBER);
    return 0;
  }
  if (!ASN1_BIT_STRING_set_bit(reinterpret_cast<ASN1_BIT_STRING *>(bitstr),
                               (int)bitnum, 1)) {
    return 0;
  }
  return 1;
}

Coverage Report

Created: 2026-08-08 07:14

Line	Count	Source
1		// Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
2		//
3		// Licensed under the Apache License, Version 2.0 (the "License");
4		// you may not use this file except in compliance with the License.
5		// You may obtain a copy of the License at
6		//
7		// https://www.apache.org/licenses/LICENSE-2.0
8		//
9		// Unless required by applicable law or agreed to in writing, software
10		// distributed under the License is distributed on an "AS IS" BASIS,
11		// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12		// See the License for the specific language governing permissions and
13		// limitations under the License.
14
15		#include <openssl/x509.h>
16
17		#include <assert.h>
18		#include <ctype.h>
19		#include <limits.h>
20		#include <string.h>
21
22		#include <openssl/asn1.h>
23		#include <openssl/bytestring.h>
24		#include <openssl/err.h>
25		#include <openssl/obj.h>
26
27		#include "../conf/internal.h"
28		#include "../internal.h"
29		#include "internal.h"
30
31
32		using namespace bssl;
33
34		// Although this file is in crypto/x509 for layering purposes, it emits
35		// errors from the ASN.1 module for OpenSSL compatibility.
36
37		// ASN1_GEN_MAX_DEPTH is the maximum number of nested TLVs allowed.
38	0	#define ASN1_GEN_MAX_DEPTH 50
39
40		// ASN1_GEN_MAX_OUTPUT is the maximum output, in bytes, allowed. This limit is
41		// necessary because the SEQUENCE and SET section reference mechanism allows the
42		// output length to grow super-linearly with the input length.
43	0	#define ASN1_GEN_MAX_OUTPUT (64 * 1024)
44
45		// ASN1_GEN_FORMAT_* are the values for the format modifiers.
46	0	#define ASN1_GEN_FORMAT_ASCII 1
47	0	#define ASN1_GEN_FORMAT_UTF8 2
48	0	#define ASN1_GEN_FORMAT_HEX 3
49	0	#define ASN1_GEN_FORMAT_BITLIST 4
50
51		// generate_v3 converts `str` into an ASN.1 structure and writes the result to
52		// `cbb`. It returns one on success and zero on error. `depth` bounds recursion,
53		// and `format` specifies the current format modifier.
54		//
55		// If `tag` is non-zero, the structure is implicitly tagged with `tag`. `tag`
56		// must not have the constructed bit set.
57		static int generate_v3(CBB cbb, const char str, const X509V3_CTX *cnf,
58		CBS_ASN1_TAG tag, int format, int depth);
59
60		static int bitstr_cb(const char elem, size_t len, void bitstr);
61
62	0	ASN1_TYPE bssl::ASN1_generate_v3(const char str, const X509V3_CTX *cnf) {
63	0	ScopedCBB cbb;
64	0	if (!CBB_init(cbb.get(), 0) \|\| //
65	0	!generate_v3(cbb.get(), str, cnf, /tag=/0, ASN1_GEN_FORMAT_ASCII,
66	0	/depth=/0)) {
67	0	return nullptr;
68	0	}
69
70		// While not strictly necessary to avoid a DoS (we rely on any super-linear
71		// checks being performed internally), cap the overall output to
72		// `ASN1_GEN_MAX_OUTPUT` so the externally-visible behavior is consistent.
73	0	if (CBB_len(cbb.get()) > ASN1_GEN_MAX_OUTPUT) {
74	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_TOO_LONG);
75	0	return nullptr;
76	0	}
77
78	0	const uint8_t *der = CBB_data(cbb.get());
79	0	return d2i_ASN1_TYPE(nullptr, &der, CBB_len(cbb.get()));
80	0	}
81
82	0	static int cbs_str_equal(const CBS cbs, const char str) {
83	0	return CBS_len(cbs) == strlen(str) &&
84	0	OPENSSL_memcmp(CBS_data(cbs), str, strlen(str)) == 0;
85	0	}
86
87		// parse_tag decodes a tag specifier in `cbs`. It returns the tag on success or
88		// zero on error.
89	0	static CBS_ASN1_TAG parse_tag(const CBS *cbs) {
90	0	CBS copy = *cbs;
91	0	uint64_t num;
92	0	if (!CBS_get_u64_decimal(&copy, &num) \|\| num > CBS_ASN1_TAG_NUMBER_MASK) {
93	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_NUMBER);
94	0	return 0;
95	0	}
96
97	0	CBS_ASN1_TAG tag_class = CBS_ASN1_CONTEXT_SPECIFIC;
98		// The tag may be suffixed by a class.
99	0	uint8_t c;
100	0	if (CBS_get_u8(&copy, &c)) {
101	0	switch (c) {
102	0	case 'U':
103	0	tag_class = CBS_ASN1_UNIVERSAL;
104	0	break;
105	0	case 'A':
106	0	tag_class = CBS_ASN1_APPLICATION;
107	0	break;
108	0	case 'P':
109	0	tag_class = CBS_ASN1_PRIVATE;
110	0	break;
111	0	case 'C':
112	0	tag_class = CBS_ASN1_CONTEXT_SPECIFIC;
113	0	break;
114	0	default: {
115	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_MODIFIER);
116	0	return 0;
117	0	}
118	0	}
119	0	if (CBS_len(&copy) != 0) {
120	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_MODIFIER);
121	0	return 0;
122	0	}
123	0	}
124
125		// Tag [UNIVERSAL 0] is reserved for indefinite-length end-of-contents. We
126		// also use zero in this file to indicator no explicit tagging.
127	0	if (tag_class == CBS_ASN1_UNIVERSAL && num == 0) {
128	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_NUMBER);
129	0	return 0;
130	0	}
131
132	0	return tag_class \| (CBS_ASN1_TAG)num;
133	0	}
134
135		static int generate_wrapped(CBB cbb, const char str, const X509V3_CTX *cnf,
136		CBS_ASN1_TAG tag, int padding, int format,
137	0	int depth) {
138	0	CBB child;
139	0	return CBB_add_asn1(cbb, &child, tag) &&
140	0	(!padding \|\| CBB_add_u8(&child, 0)) &&
141	0	generate_v3(&child, str, cnf, /tag=/0, format, depth + 1) &&
142	0	CBB_flush(cbb);
143	0	}
144
145		static int generate_v3(CBB cbb, const char str, const X509V3_CTX *cnf,
146	0	CBS_ASN1_TAG tag, int format, int depth) {
147	0	assert((tag & CBS_ASN1_CONSTRUCTED) == 0);
148	0	if (depth > ASN1_GEN_MAX_DEPTH) {
149	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_NESTED_TAGGING);
150	0	return 0;
151	0	}
152
153		// Process modifiers. This function uses a mix of NUL-terminated strings and
154		// `CBS`. Several functions only work with NUL-terminated strings, so we need
155		// to keep track of when a slice spans the whole buffer.
156	0	for (;;) {
157		// Skip whitespace.
158	0	while (str != '\0' && OPENSSL_isspace((unsigned char)str)) {
159	0	str++;
160	0	}
161
162		// Modifiers end at commas.
163	0	const char *comma = strchr(str, ',');
164	0	if (comma == nullptr) {
165	0	break;
166	0	}
167
168		// Remove trailing whitespace.
169	0	CBS modifier;
170	0	CBS_init(&modifier, (const uint8_t *)str, comma - str);
171	0	for (;;) {
172	0	uint8_t v;
173	0	CBS copy = modifier;
174	0	if (!CBS_get_last_u8(&copy, &v) \|\| !OPENSSL_isspace(v)) {
175	0	break;
176	0	}
177	0	modifier = copy;
178	0	}
179
180		// Advance the string past the modifier, but save the original value. We
181		// will need to rewind if this is not a recognized modifier.
182	0	const char *str_old = str;
183	0	str = comma + 1;
184
185		// Each modifier is either NAME:VALUE or NAME.
186	0	CBS name;
187	0	int has_value = CBS_get_until_first(&modifier, &name, ':');
188	0	if (has_value) {
189	0	CBS_skip(&modifier, 1); // Skip the colon.
190	0	} else {
191	0	name = modifier;
192	0	CBS_init(&modifier, nullptr, 0);
193	0	}
194
195	0	if (cbs_str_equal(&name, "FORMAT") \|\| cbs_str_equal(&name, "FORM")) {
196	0	if (cbs_str_equal(&modifier, "ASCII")) {
197	0	format = ASN1_GEN_FORMAT_ASCII;
198	0	} else if (cbs_str_equal(&modifier, "UTF8")) {
199	0	format = ASN1_GEN_FORMAT_UTF8;
200	0	} else if (cbs_str_equal(&modifier, "HEX")) {
201	0	format = ASN1_GEN_FORMAT_HEX;
202	0	} else if (cbs_str_equal(&modifier, "BITLIST")) {
203	0	format = ASN1_GEN_FORMAT_BITLIST;
204	0	} else {
205	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNKNOWN_FORMAT);
206	0	return 0;
207	0	}
208	0	} else if (cbs_str_equal(&name, "IMP") \|\|
209	0	cbs_str_equal(&name, "IMPLICIT")) {
210	0	if (tag != 0) {
211	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_NESTED_TAGGING);
212	0	return 0;
213	0	}
214	0	tag = parse_tag(&modifier);
215	0	if (tag == 0) {
216	0	return 0;
217	0	}
218	0	} else if (cbs_str_equal(&name, "EXP") \|\|
219	0	cbs_str_equal(&name, "EXPLICIT")) {
220		// It would actually be supportable, but OpenSSL does not allow wrapping
221		// an explicit tag in an implicit tag.
222	0	if (tag != 0) {
223	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_NESTED_TAGGING);
224	0	return 0;
225	0	}
226	0	tag = parse_tag(&modifier);
227	0	return tag != 0 &&
228	0	generate_wrapped(cbb, str, cnf, tag \| CBS_ASN1_CONSTRUCTED,
229	0	/padding=/0, format, depth);
230	0	} else if (cbs_str_equal(&name, "OCTWRAP")) {
231	0	tag = tag == 0 ? CBS_ASN1_OCTETSTRING : tag;
232	0	return generate_wrapped(cbb, str, cnf, tag, /padding=/0, format, depth);
233	0	} else if (cbs_str_equal(&name, "BITWRAP")) {
234	0	tag = tag == 0 ? CBS_ASN1_BITSTRING : tag;
235	0	return generate_wrapped(cbb, str, cnf, tag, /padding=/1, format, depth);
236	0	} else if (cbs_str_equal(&name, "SEQWRAP")) {
237	0	tag = tag == 0 ? CBS_ASN1_SEQUENCE : (tag \| CBS_ASN1_CONSTRUCTED);
238	0	tag \|= CBS_ASN1_CONSTRUCTED;
239	0	return generate_wrapped(cbb, str, cnf, tag, /padding=/0, format, depth);
240	0	} else if (cbs_str_equal(&name, "SETWRAP")) {
241	0	tag = tag == 0 ? CBS_ASN1_SET : (tag \| CBS_ASN1_CONSTRUCTED);
242	0	return generate_wrapped(cbb, str, cnf, tag, /padding=/0, format, depth);
243	0	} else {
244		// If this was not a recognized modifier, rewind `str` to before splitting
245		// on the comma. The type itself consumes all remaining input.
246	0	str = str_old;
247	0	break;
248	0	}
249	0	}
250
251		// The final element is, like modifiers, NAME:VALUE or NAME, but VALUE spans
252		// the length of the string, including any commas.
253	0	const char *colon = strchr(str, ':');
254	0	CBS name;
255	0	const char *value;
256	0	int has_value = colon != nullptr;
257	0	if (has_value) {
258	0	CBS_init(&name, (const uint8_t *)str, colon - str);
259	0	value = colon + 1;
260	0	} else {
261	0	CBS_init(&name, (const uint8_t *)str, strlen(str));
262	0	value = ""; // Most types treat missing and empty value equivalently.
263	0	}
264
265	0	static const struct {
266	0	const char *name;
267	0	CBS_ASN1_TAG type;
268	0	} kTypes[] = {
269	0	{"BOOL", CBS_ASN1_BOOLEAN},
270	0	{"BOOLEAN", CBS_ASN1_BOOLEAN},
271	0	{"NULL", CBS_ASN1_NULL},
272	0	{"INT", CBS_ASN1_INTEGER},
273	0	{"INTEGER", CBS_ASN1_INTEGER},
274	0	{"ENUM", CBS_ASN1_ENUMERATED},
275	0	{"ENUMERATED", CBS_ASN1_ENUMERATED},
276	0	{"OID", CBS_ASN1_OBJECT},
277	0	{"OBJECT", CBS_ASN1_OBJECT},
278	0	{"UTCTIME", CBS_ASN1_UTCTIME},
279	0	{"UTC", CBS_ASN1_UTCTIME},
280	0	{"GENERALIZEDTIME", CBS_ASN1_GENERALIZEDTIME},
281	0	{"GENTIME", CBS_ASN1_GENERALIZEDTIME},
282	0	{"OCT", CBS_ASN1_OCTETSTRING},
283	0	{"OCTETSTRING", CBS_ASN1_OCTETSTRING},
284	0	{"BITSTR", CBS_ASN1_BITSTRING},
285	0	{"BITSTRING", CBS_ASN1_BITSTRING},
286	0	{"UNIVERSALSTRING", CBS_ASN1_UNIVERSALSTRING},
287	0	{"UNIV", CBS_ASN1_UNIVERSALSTRING},
288	0	{"IA5", CBS_ASN1_IA5STRING},
289	0	{"IA5STRING", CBS_ASN1_IA5STRING},
290	0	{"UTF8", CBS_ASN1_UTF8STRING},
291	0	{"UTF8String", CBS_ASN1_UTF8STRING},
292	0	{"BMP", CBS_ASN1_BMPSTRING},
293	0	{"BMPSTRING", CBS_ASN1_BMPSTRING},
294	0	{"PRINTABLESTRING", CBS_ASN1_PRINTABLESTRING},
295	0	{"PRINTABLE", CBS_ASN1_PRINTABLESTRING},
296	0	{"T61", CBS_ASN1_T61STRING},
297	0	{"T61STRING", CBS_ASN1_T61STRING},
298	0	{"TELETEXSTRING", CBS_ASN1_T61STRING},
299	0	{"SEQUENCE", CBS_ASN1_SEQUENCE},
300	0	{"SEQ", CBS_ASN1_SEQUENCE},
301	0	{"SET", CBS_ASN1_SET},
302	0	};
303	0	CBS_ASN1_TAG type = 0;
304	0	for (const auto &t : kTypes) {
305	0	if (cbs_str_equal(&name, t.name)) {
306	0	type = t.type;
307	0	break;
308	0	}
309	0	}
310	0	if (type == 0) {
311	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNKNOWN_TAG);
312	0	return 0;
313	0	}
314
315		// If there is an implicit tag, use the constructed bit from the base type.
316	0	tag = tag == 0 ? type : (tag \| (type & CBS_ASN1_CONSTRUCTED));
317	0	CBB child;
318	0	if (!CBB_add_asn1(cbb, &child, tag)) {
319	0	return 0;
320	0	}
321
322	0	switch (type) {
323	0	case CBS_ASN1_NULL:
324	0	if (*value != '\0') {
325	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_NULL_VALUE);
326	0	return 0;
327	0	}
328	0	return CBB_flush(cbb);
329
330	0	case CBS_ASN1_BOOLEAN: {
331	0	if (format != ASN1_GEN_FORMAT_ASCII) {
332	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_NOT_ASCII_FORMAT);
333	0	return 0;
334	0	}
335	0	ASN1_BOOLEAN boolean;
336	0	if (!X509V3_bool_from_string(value, &boolean)) {
337	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_BOOLEAN);
338	0	return 0;
339	0	}
340	0	return CBB_add_u8(&child, boolean ? 0xff : 0x00) && CBB_flush(cbb);
341	0	}
342
343	0	case CBS_ASN1_INTEGER:
344	0	case CBS_ASN1_ENUMERATED: {
345	0	if (format != ASN1_GEN_FORMAT_ASCII) {
346	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_INTEGER_NOT_ASCII_FORMAT);
347	0	return 0;
348	0	}
349	0	ASN1_INTEGER *obj = s2i_ASN1_INTEGER(nullptr, value);
350	0	if (obj == nullptr) {
351	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_INTEGER);
352	0	return 0;
353	0	}
354	0	int len = i2c_ASN1_INTEGER(obj, nullptr);
355	0	uint8_t *out;
356	0	int ok = len > 0 && //
357	0	CBB_add_space(&child, &out, len) &&
358	0	i2c_ASN1_INTEGER(obj, &out) == len && CBB_flush(cbb);
359	0	ASN1_INTEGER_free(obj);
360	0	return ok;
361	0	}
362
363	0	case CBS_ASN1_OBJECT: {
364	0	if (format != ASN1_GEN_FORMAT_ASCII) {
365	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_OBJECT_NOT_ASCII_FORMAT);
366	0	return 0;
367	0	}
368	0	ASN1_OBJECT obj = OBJ_txt2obj(value, /dont_search_names=*/0);
369	0	if (obj == nullptr \|\| obj->length == 0) {
370	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_OBJECT);
371	0	return 0;
372	0	}
373	0	int ok = CBB_add_bytes(&child, obj->data, obj->length) && CBB_flush(cbb);
374	0	ASN1_OBJECT_free(obj);
375	0	return ok;
376	0	}
377
378	0	case CBS_ASN1_UTCTIME:
379	0	case CBS_ASN1_GENERALIZEDTIME: {
380	0	if (format != ASN1_GEN_FORMAT_ASCII) {
381	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_TIME_NOT_ASCII_FORMAT);
382	0	return 0;
383	0	}
384	0	CBS value_cbs;
385	0	CBS_init(&value_cbs, (const uint8_t *)value, strlen(value));
386	0	int ok = type == CBS_ASN1_UTCTIME
387	0	? CBS_parse_utc_time(&value_cbs, nullptr,
388	0	/allow_timezone_offset=/0)
389	0	: CBS_parse_generalized_time(&value_cbs, nullptr,
390	0	/allow_timezone_offset=/0);
391	0	if (!ok) {
392	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_TIME_VALUE);
393	0	return 0;
394	0	}
395	0	return CBB_add_bytes(&child, (const uint8_t *)value, strlen(value)) &&
396	0	CBB_flush(cbb);
397	0	}
398
399	0	case CBS_ASN1_UNIVERSALSTRING:
400	0	case CBS_ASN1_IA5STRING:
401	0	case CBS_ASN1_UTF8STRING:
402	0	case CBS_ASN1_BMPSTRING:
403	0	case CBS_ASN1_PRINTABLESTRING:
404	0	case CBS_ASN1_T61STRING: {
405	0	int encoding;
406	0	if (format == ASN1_GEN_FORMAT_ASCII) {
407	0	encoding = MBSTRING_ASC;
408	0	} else if (format == ASN1_GEN_FORMAT_UTF8) {
409	0	encoding = MBSTRING_UTF8;
410	0	} else {
411	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_FORMAT);
412	0	return 0;
413	0	}
414
415		// `maxsize` is measured in code points, rather than bytes, but pass it in
416		// as a loose cap so fuzzers can exit from excessively long inputs
417		// earlier. This limit is not load-bearing because `ASN1_mbstring_ncopy`'s
418		// output is already linear in the input.
419	0	ASN1_STRING *obj = nullptr;
420	0	if (ASN1_mbstring_ncopy(&obj, (const uint8_t *)value, -1, encoding,
421	0	ASN1_tag2bit(type), /minsize=/0,
422	0	/maxsize=/ASN1_GEN_MAX_OUTPUT) <= 0) {
423	0	return 0;
424	0	}
425	0	int ok = CBB_add_bytes(&child, obj->data, obj->length) && CBB_flush(cbb);
426	0	ASN1_STRING_free(obj);
427	0	return ok;
428	0	}
429
430	0	case CBS_ASN1_BITSTRING:
431	0	if (format == ASN1_GEN_FORMAT_BITLIST) {
432	0	ASN1_BIT_STRING *obj = ASN1_BIT_STRING_new();
433	0	if (obj == nullptr) {
434	0	return 0;
435	0	}
436	0	if (!CONF_parse_list(value, ',', 1, bitstr_cb, obj)) {
437	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_LIST_ERROR);
438	0	ASN1_BIT_STRING_free(obj);
439	0	return 0;
440	0	}
441	0	int len = i2c_ASN1_BIT_STRING(obj, nullptr);
442	0	uint8_t *out;
443	0	int ok = len > 0 && //
444	0	CBB_add_space(&child, &out, len) &&
445	0	i2c_ASN1_BIT_STRING(obj, &out) == len && //
446	0	CBB_flush(cbb);
447	0	ASN1_BIT_STRING_free(obj);
448	0	return ok;
449	0	}
450
451		// The other formats are the same as OCTET STRING, but with the leading
452		// zero bytes.
453	0	if (!CBB_add_u8(&child, 0)) {
454	0	return 0;
455	0	}
456	0	[[fallthrough]];
457
458	0	case CBS_ASN1_OCTETSTRING:
459	0	if (format == ASN1_GEN_FORMAT_ASCII) {
460	0	return CBB_add_bytes(&child, (const uint8_t *)value, strlen(value)) &&
461	0	CBB_flush(cbb);
462	0	}
463	0	if (format == ASN1_GEN_FORMAT_HEX) {
464	0	size_t len;
465	0	uint8_t *data = x509v3_hex_to_bytes(value, &len);
466	0	if (data == nullptr) {
467	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_HEX);
468	0	return 0;
469	0	}
470	0	int ok = CBB_add_bytes(&child, data, len) && CBB_flush(cbb);
471	0	OPENSSL_free(data);
472	0	return ok;
473	0	}
474
475	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_BITSTRING_FORMAT);
476	0	return 0;
477
478	0	case CBS_ASN1_SEQUENCE:
479	0	case CBS_ASN1_SET:
480	0	if (has_value) {
481	0	if (cnf == nullptr) {
482	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG);
483	0	return 0;
484	0	}
485	0	const STACK_OF(CONF_VALUE) *section = X509V3_get_section(cnf, value);
486	0	if (section == nullptr) {
487	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG);
488	0	return 0;
489	0	}
490	0	for (size_t i = 0; i < sk_CONF_VALUE_num(section); i++) {
491	0	const CONF_VALUE *conf = sk_CONF_VALUE_value(section, i);
492	0	if (!generate_v3(&child, conf->value, cnf, /tag=/0,
493	0	ASN1_GEN_FORMAT_ASCII, depth + 1)) {
494	0	return 0;
495	0	}
496		// This recursive call, by referencing `section`, is the one place
497		// where `generate_v3`'s output can be super-linear in the input.
498		// Check bounds here.
499	0	if (CBB_len(&child) > ASN1_GEN_MAX_OUTPUT) {
500	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_TOO_LONG);
501	0	return 0;
502	0	}
503	0	}
504	0	}
505	0	if (type == CBS_ASN1_SET) {
506		// The SET type here is a SET OF and must be sorted.
507	0	return CBB_flush_asn1_set_of(&child) && CBB_flush(cbb);
508	0	}
509	0	return CBB_flush(cbb);
510
511	0	default:
512	0	OPENSSL_PUT_ERROR(ASN1, ERR_R_INTERNAL_ERROR);
513	0	return 0;
514	0	}
515	0	}
516
517	0	static int bitstr_cb(const char elem, size_t len, void bitstr) {
518	0	CBS cbs;
519	0	CBS_init(&cbs, (const uint8_t *)elem, len);
520	0	uint64_t bitnum;
521	0	if (!CBS_get_u64_decimal(&cbs, &bitnum) \|\| CBS_len(&cbs) != 0 \|\|
522		// Cap the highest allowed bit so this mechanism cannot be used to create
523		// extremely large allocations with short inputs. The highest named bit in
524		// RFC 5280 is 8, so 256 should give comfortable margin but still only
525		// allow a 32-byte allocation.
526		//
527		// We do not consider this function to be safe with untrusted inputs (even
528		// without bugs, it is prone to string injection vulnerabilities), so DoS
529		// is not truly a concern, but the limit is necessary to keep fuzzing
530		// effective.
531	0	bitnum > 256) {
532	0	OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_NUMBER);
533	0	return 0;
534	0	}
535	0	if (!ASN1_BIT_STRING_set_bit(reinterpret_cast<ASN1_BIT_STRING *>(bitstr),
536	0	(int)bitnum, 1)) {
537	0	return 0;
538	0	}
539	0	return 1;
540	0	}