Coverage Report

Created: 2023-06-08 06:41

/src/openssl111/crypto/asn1/asn1_lib.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the OpenSSL license (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
#include <stdio.h>
11
#include <limits.h>
12
#include "internal/cryptlib.h"
13
#include <openssl/asn1.h>
14
#include "asn1_local.h"
15
16
static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
17
                           long max);
18
static void asn1_put_length(unsigned char **pp, int length);
19
20
static int _asn1_check_infinite_end(const unsigned char **p, long len)
21
0
{
22
    /*
23
     * If there is 0 or 1 byte left, the length check should pick things up
24
     */
25
0
    if (len <= 0)
26
0
        return 1;
27
0
    else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0)) {
28
0
        (*p) += 2;
29
0
        return 1;
30
0
    }
31
0
    return 0;
32
0
}
33
34
int ASN1_check_infinite_end(unsigned char **p, long len)
35
0
{
36
0
    return _asn1_check_infinite_end((const unsigned char **)p, len);
37
0
}
38
39
int ASN1_const_check_infinite_end(const unsigned char **p, long len)
40
0
{
41
0
    return _asn1_check_infinite_end(p, len);
42
0
}
43
44
int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
45
                    int *pclass, long omax)
46
30.0M
{
47
30.0M
    int i, ret;
48
30.0M
    long l;
49
30.0M
    const unsigned char *p = *pp;
50
30.0M
    int tag, xclass, inf;
51
30.0M
    long max = omax;
52
53
30.0M
    if (!max)
54
2.03k
        goto err;
55
30.0M
    ret = (*p & V_ASN1_CONSTRUCTED);
56
30.0M
    xclass = (*p & V_ASN1_PRIVATE);
57
30.0M
    i = *p & V_ASN1_PRIMITIVE_TAG;
58
30.0M
    if (i == V_ASN1_PRIMITIVE_TAG) { /* high-tag */
59
42.1k
        p++;
60
42.1k
        if (--max == 0)
61
297
            goto err;
62
41.8k
        l = 0;
63
69.5k
        while (*p & 0x80) {
64
28.2k
            l <<= 7L;
65
28.2k
            l |= *(p++) & 0x7f;
66
28.2k
            if (--max == 0)
67
226
                goto err;
68
27.9k
            if (l > (INT_MAX >> 7L))
69
235
                goto err;
70
27.9k
        }
71
41.3k
        l <<= 7L;
72
41.3k
        l |= *(p++) & 0x7f;
73
41.3k
        tag = (int)l;
74
41.3k
        if (--max == 0)
75
498
            goto err;
76
30.0M
    } else {
77
30.0M
        tag = i;
78
30.0M
        p++;
79
30.0M
        if (--max == 0)
80
1.41k
            goto err;
81
30.0M
    }
82
30.0M
    *ptag = tag;
83
30.0M
    *pclass = xclass;
84
30.0M
    if (!asn1_get_length(&p, &inf, plength, max))
85
3.69k
        goto err;
86
87
30.0M
    if (inf && !(ret & V_ASN1_CONSTRUCTED))
88
301
        goto err;
89
90
30.0M
    if (*plength > (omax - (p - *pp))) {
91
646k
        ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_TOO_LONG);
92
        /*
93
         * Set this so that even if things are not long enough the values are
94
         * set correctly
95
         */
96
646k
        ret |= 0x80;
97
646k
    }
98
30.0M
    *pp = p;
99
30.0M
    return ret | inf;
100
8.70k
 err:
101
8.70k
    ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_HEADER_TOO_LONG);
102
8.70k
    return 0x80;
103
30.0M
}
104
105
/*
106
 * Decode a length field.
107
 * The short form is a single byte defining a length 0 - 127.
108
 * The long form is a byte 0 - 127 with the top bit set and this indicates
109
 * the number of following octets that contain the length.  These octets
110
 * are stored most significant digit first.
111
 */
112
static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
113
                           long max)
114
30.0M
{
115
30.0M
    const unsigned char *p = *pp;
116
30.0M
    unsigned long ret = 0;
117
30.0M
    int i;
118
119
30.0M
    if (max-- < 1)
120
0
        return 0;
121
30.0M
    if (*p == 0x80) {
122
1.98M
        *inf = 1;
123
1.98M
        p++;
124
28.0M
    } else {
125
28.0M
        *inf = 0;
126
28.0M
        i = *p & 0x7f;
127
28.0M
        if (*p++ & 0x80) {
128
45.7k
            if (max < i + 1)
129
3.20k
                return 0;
130
            /* Skip leading zeroes */
131
70.8k
            while (i > 0 && *p == 0) {
132
28.2k
                p++;
133
28.2k
                i--;
134
28.2k
            }
135
42.5k
            if (i > (int)sizeof(long))
136
215
                return 0;
137
62.0k
            while (i > 0) {
138
19.7k
                ret <<= 8;
139
19.7k
                ret |= *p++;
140
19.7k
                i--;
141
19.7k
            }
142
42.3k
            if (ret > LONG_MAX)
143
274
                return 0;
144
42.3k
        } else
145
28.0M
            ret = i;
146
28.0M
    }
147
30.0M
    *pp = p;
148
30.0M
    *rl = (long)ret;
149
30.0M
    return 1;
150
30.0M
}
151
152
/*
153
 * class 0 is constructed constructed == 2 for indefinite length constructed
154
 */
155
void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
156
                     int xclass)
157
9.82M
{
158
9.82M
    unsigned char *p = *pp;
159
9.82M
    int i, ttag;
160
161
9.82M
    i = (constructed) ? V_ASN1_CONSTRUCTED : 0;
162
9.82M
    i |= (xclass & V_ASN1_PRIVATE);
163
9.82M
    if (tag < 31)
164
9.82M
        *(p++) = i | (tag & V_ASN1_PRIMITIVE_TAG);
165
3.69k
    else {
166
3.69k
        *(p++) = i | V_ASN1_PRIMITIVE_TAG;
167
9.43k
        for (i = 0, ttag = tag; ttag > 0; i++)
168
5.74k
            ttag >>= 7;
169
3.69k
        ttag = i;
170
9.43k
        while (i-- > 0) {
171
5.74k
            p[i] = tag & 0x7f;
172
5.74k
            if (i != (ttag - 1))
173
2.04k
                p[i] |= 0x80;
174
5.74k
            tag >>= 7;
175
5.74k
        }
176
3.69k
        p += ttag;
177
3.69k
    }
178
9.82M
    if (constructed == 2)
179
0
        *(p++) = 0x80;
180
9.82M
    else
181
9.82M
        asn1_put_length(&p, length);
182
9.82M
    *pp = p;
183
9.82M
}
184
185
int ASN1_put_eoc(unsigned char **pp)
186
0
{
187
0
    unsigned char *p = *pp;
188
0
    *p++ = 0;
189
0
    *p++ = 0;
190
0
    *pp = p;
191
0
    return 2;
192
0
}
193
194
static void asn1_put_length(unsigned char **pp, int length)
195
9.82M
{
196
9.82M
    unsigned char *p = *pp;
197
9.82M
    int i, l;
198
9.82M
    if (length <= 127)
199
9.81M
        *(p++) = (unsigned char)length;
200
7.63k
    else {
201
7.63k
        l = length;
202
18.2k
        for (i = 0; l > 0; i++)
203
10.6k
            l >>= 8;
204
7.63k
        *(p++) = i | 0x80;
205
7.63k
        l = i;
206
18.2k
        while (i-- > 0) {
207
10.6k
            p[i] = length & 0xff;
208
10.6k
            length >>= 8;
209
10.6k
        }
210
7.63k
        p += l;
211
7.63k
    }
212
9.82M
    *pp = p;
213
9.82M
}
214
215
int ASN1_object_size(int constructed, int length, int tag)
216
41.8M
{
217
41.8M
    int ret = 1;
218
41.8M
    if (length < 0)
219
0
        return -1;
220
41.8M
    if (tag >= 31) {
221
62.8k
        while (tag > 0) {
222
37.2k
            tag >>= 7;
223
37.2k
            ret++;
224
37.2k
        }
225
25.5k
    }
226
41.8M
    if (constructed == 2) {
227
0
        ret += 3;
228
41.8M
    } else {
229
41.8M
        ret++;
230
41.8M
        if (length > 127) {
231
21.4k
            int tmplen = length;
232
53.0k
            while (tmplen > 0) {
233
31.6k
                tmplen >>= 8;
234
31.6k
                ret++;
235
31.6k
            }
236
21.4k
        }
237
41.8M
    }
238
41.8M
    if (ret >= INT_MAX - length)
239
0
        return -1;
240
41.8M
    return ret + length;
241
41.8M
}
242
243
int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str)
244
957k
{
245
957k
    if (str == NULL)
246
0
        return 0;
247
957k
    dst->type = str->type;
248
957k
    if (!ASN1_STRING_set(dst, str->data, str->length))
249
0
        return 0;
250
    /* Copy flags but preserve embed value */
251
957k
    dst->flags &= ASN1_STRING_FLAG_EMBED;
252
957k
    dst->flags |= str->flags & ~ASN1_STRING_FLAG_EMBED;
253
957k
    return 1;
254
957k
}
255
256
ASN1_STRING *ASN1_STRING_dup(const ASN1_STRING *str)
257
0
{
258
0
    ASN1_STRING *ret;
259
0
    if (!str)
260
0
        return NULL;
261
0
    ret = ASN1_STRING_new();
262
0
    if (ret == NULL)
263
0
        return NULL;
264
0
    if (!ASN1_STRING_copy(ret, str)) {
265
0
        ASN1_STRING_free(ret);
266
0
        return NULL;
267
0
    }
268
0
    return ret;
269
0
}
270
271
int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len_in)
272
2.00M
{
273
2.00M
    unsigned char *c;
274
2.00M
    const char *data = _data;
275
2.00M
    size_t len;
276
277
2.00M
    if (len_in < 0) {
278
0
        if (data == NULL)
279
0
            return 0;
280
0
        len = strlen(data);
281
2.00M
    } else {
282
2.00M
        len = (size_t)len_in;
283
2.00M
    }
284
    /*
285
     * Verify that the length fits within an integer for assignment to
286
     * str->length below.  The additional 1 is subtracted to allow for the
287
     * '\0' terminator even though this isn't strictly necessary.
288
     */
289
2.00M
    if (len > INT_MAX - 1) {
290
0
        ASN1err(0, ASN1_R_TOO_LARGE);
291
0
        return 0;
292
0
    }
293
2.00M
    if ((size_t)str->length <= len || str->data == NULL) {
294
2.00M
        c = str->data;
295
2.00M
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
296
        /* No NUL terminator in fuzzing builds */
297
2.00M
        str->data = OPENSSL_realloc(c, len != 0 ? len : 1);
298
#else
299
        str->data = OPENSSL_realloc(c, len + 1);
300
#endif
301
2.00M
        if (str->data == NULL) {
302
0
            ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
303
0
            str->data = c;
304
0
            return 0;
305
0
        }
306
2.00M
    }
307
2.00M
    str->length = len;
308
2.00M
    if (data != NULL) {
309
1.94M
        memcpy(str->data, data, len);
310
1.94M
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
311
        /* Set the unused byte to something non NUL and printable. */
312
1.94M
        if (len == 0)
313
1.75M
            str->data[len] = '~';
314
#else
315
        /*
316
         * Add a NUL terminator. This should not be necessary - but we add it as
317
         * a safety precaution
318
         */
319
        str->data[len] = '\0';
320
#endif
321
1.94M
    }
322
2.00M
    return 1;
323
2.00M
}
324
325
void ASN1_STRING_set0(ASN1_STRING *str, void *data, int len)
326
0
{
327
0
    OPENSSL_free(str->data);
328
0
    str->data = data;
329
0
    str->length = len;
330
0
}
331
332
ASN1_STRING *ASN1_STRING_new(void)
333
0
{
334
0
    return ASN1_STRING_type_new(V_ASN1_OCTET_STRING);
335
0
}
336
337
ASN1_STRING *ASN1_STRING_type_new(int type)
338
4.73M
{
339
4.73M
    ASN1_STRING *ret;
340
341
4.73M
    ret = OPENSSL_zalloc(sizeof(*ret));
342
4.73M
    if (ret == NULL) {
343
0
        ASN1err(ASN1_F_ASN1_STRING_TYPE_NEW, ERR_R_MALLOC_FAILURE);
344
0
        return NULL;
345
0
    }
346
4.73M
    ret->type = type;
347
4.73M
    return ret;
348
4.73M
}
349
350
void asn1_string_embed_free(ASN1_STRING *a, int embed)
351
4.87M
{
352
4.87M
    if (a == NULL)
353
0
        return;
354
4.87M
    if (!(a->flags & ASN1_STRING_FLAG_NDEF))
355
4.87M
        OPENSSL_free(a->data);
356
4.87M
    if (embed == 0)
357
4.73M
        OPENSSL_free(a);
358
4.87M
}
359
360
void ASN1_STRING_free(ASN1_STRING *a)
361
192k
{
362
192k
    if (a == NULL)
363
189k
        return;
364
2.94k
    asn1_string_embed_free(a, a->flags & ASN1_STRING_FLAG_EMBED);
365
2.94k
}
366
367
void ASN1_STRING_clear_free(ASN1_STRING *a)
368
0
{
369
0
    if (a == NULL)
370
0
        return;
371
0
    if (a->data && !(a->flags & ASN1_STRING_FLAG_NDEF))
372
0
        OPENSSL_cleanse(a->data, a->length);
373
0
    ASN1_STRING_free(a);
374
0
}
375
376
int ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
377
0
{
378
0
    int i;
379
380
0
    i = (a->length - b->length);
381
0
    if (i == 0) {
382
0
        if (a->length != 0)
383
0
            i = memcmp(a->data, b->data, a->length);
384
0
        if (i == 0)
385
0
            return a->type - b->type;
386
0
        else
387
0
            return i;
388
0
    } else
389
0
        return i;
390
0
}
391
392
int ASN1_STRING_length(const ASN1_STRING *x)
393
28.6k
{
394
28.6k
    return x->length;
395
28.6k
}
396
397
void ASN1_STRING_length_set(ASN1_STRING *x, int len)
398
0
{
399
0
    x->length = len;
400
0
}
401
402
int ASN1_STRING_type(const ASN1_STRING *x)
403
0
{
404
0
    return x->type;
405
0
}
406
407
const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x)
408
28.6k
{
409
28.6k
    return x->data;
410
28.6k
}
411
412
# if OPENSSL_API_COMPAT < 0x10100000L
413
unsigned char *ASN1_STRING_data(ASN1_STRING *x)
414
0
{
415
0
    return x->data;
416
0
}
417
#endif