Coverage Report

Created: 2025-06-13 06:56

/src/openssl/crypto/asn1/a_d2i_fp.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
#include <stdio.h>
11
#include <limits.h>
12
#include "internal/cryptlib.h"
13
#include "internal/numbers.h"
14
#include <openssl/buffer.h>
15
#include <openssl/asn1.h>
16
#include "internal/asn1.h"
17
#include "crypto/asn1.h"
18
19
#ifndef NO_OLD_ASN1
20
# ifndef OPENSSL_NO_STDIO
21
22
void *ASN1_d2i_fp(void *(*xnew) (void), d2i_of_void *d2i, FILE *in, void **x)
23
0
{
24
0
    BIO *b;
25
0
    void *ret;
26
27
0
    if ((b = BIO_new(BIO_s_file())) == NULL) {
28
0
        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
29
0
        return NULL;
30
0
    }
31
0
    BIO_set_fp(b, in, BIO_NOCLOSE);
32
0
    ret = ASN1_d2i_bio(xnew, d2i, b, x);
33
0
    BIO_free(b);
34
0
    return ret;
35
0
}
36
# endif
37
38
void *ASN1_d2i_bio(void *(*xnew) (void), d2i_of_void *d2i, BIO *in, void **x)
39
0
{
40
0
    BUF_MEM *b = NULL;
41
0
    const unsigned char *p;
42
0
    void *ret = NULL;
43
0
    int len;
44
45
0
    len = asn1_d2i_read_bio(in, &b);
46
0
    if (len < 0)
47
0
        goto err;
48
49
0
    p = (unsigned char *)b->data;
50
0
    ret = d2i(x, &p, len);
51
0
 err:
52
0
    BUF_MEM_free(b);
53
0
    return ret;
54
0
}
55
56
#endif
57
58
void *ASN1_item_d2i_bio_ex(const ASN1_ITEM *it, BIO *in, void *x,
59
                           OSSL_LIB_CTX *libctx, const char *propq)
60
0
{
61
0
    BUF_MEM *b = NULL;
62
0
    const unsigned char *p;
63
0
    void *ret = NULL;
64
0
    int len;
65
66
0
    if (in == NULL)
67
0
        return NULL;
68
0
    len = asn1_d2i_read_bio(in, &b);
69
0
    if (len < 0)
70
0
        goto err;
71
72
0
    p = (const unsigned char *)b->data;
73
0
    ret = ASN1_item_d2i_ex(x, &p, len, it, libctx, propq);
74
0
 err:
75
0
    BUF_MEM_free(b);
76
0
    return ret;
77
0
}
78
79
void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x)
80
0
{
81
0
    return ASN1_item_d2i_bio_ex(it, in, x, NULL, NULL);
82
0
}
83
84
#ifndef OPENSSL_NO_STDIO
85
void *ASN1_item_d2i_fp_ex(const ASN1_ITEM *it, FILE *in, void *x,
86
                          OSSL_LIB_CTX *libctx, const char *propq)
87
0
{
88
0
    BIO *b;
89
0
    char *ret;
90
91
0
    if ((b = BIO_new(BIO_s_file())) == NULL) {
92
0
        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
93
0
        return NULL;
94
0
    }
95
0
    BIO_set_fp(b, in, BIO_NOCLOSE);
96
0
    ret = ASN1_item_d2i_bio_ex(it, b, x, libctx, propq);
97
0
    BIO_free(b);
98
0
    return ret;
99
0
}
100
101
void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x)
102
0
{
103
0
    return ASN1_item_d2i_fp_ex(it, in, x, NULL, NULL);
104
0
}
105
#endif
106
107
1.42M
#define HEADER_SIZE   8
108
323k
#define ASN1_CHUNK_INITIAL_SIZE (16 * 1024)
109
int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
110
12.6k
{
111
12.6k
    BUF_MEM *b;
112
12.6k
    unsigned char *p;
113
12.6k
    int i;
114
12.6k
    size_t want = HEADER_SIZE;
115
12.6k
    uint32_t eos = 0;
116
12.6k
    size_t off = 0;
117
12.6k
    size_t len = 0;
118
12.6k
    size_t diff;
119
120
12.6k
    const unsigned char *q;
121
12.6k
    long slen;
122
12.6k
    int inf, tag, xclass;
123
124
12.6k
    b = BUF_MEM_new();
125
12.6k
    if (b == NULL) {
126
0
        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
127
0
        return -1;
128
0
    }
129
130
12.6k
    ERR_set_mark();
131
1.42M
    for (;;) {
132
1.42M
        diff = len - off;
133
1.42M
        if (want >= diff) {
134
1.42M
            want -= diff;
135
136
1.42M
            if (len + want < len || !BUF_MEM_grow_clean(b, len + want)) {
137
0
                ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
138
0
                goto err;
139
0
            }
140
1.42M
            i = BIO_read(in, &(b->data[len]), want);
141
1.42M
            if (i < 0 && diff == 0) {
142
0
                ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
143
0
                goto err;
144
0
            }
145
1.42M
            if (i > 0) {
146
1.41M
                if (len + i < len) {
147
0
                    ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
148
0
                    goto err;
149
0
                }
150
1.41M
                len += i;
151
1.41M
                if ((size_t)i < want)
152
2.17k
                    continue;
153
154
1.41M
            }
155
1.42M
        }
156
        /* else data already loaded */
157
158
1.42M
        p = (unsigned char *)&(b->data[off]);
159
1.42M
        q = p;
160
1.42M
        diff = len - off;
161
1.42M
        if (diff == 0)
162
0
            goto err;
163
1.42M
        inf = ASN1_get_object(&q, &slen, &tag, &xclass, diff);
164
1.42M
        if (inf & 0x80) {
165
323k
            unsigned long e;
166
167
323k
            e = ERR_GET_REASON(ERR_peek_last_error());
168
323k
            if (e != ASN1_R_TOO_LONG)
169
55
                goto err;
170
323k
            ERR_pop_to_mark();
171
323k
        }
172
1.42M
        i = q - p;            /* header length */
173
1.42M
        off += i;               /* end of data */
174
175
1.42M
        if (inf & 1) {
176
            /* no data body so go round again */
177
13.4k
            if (eos == UINT32_MAX) {
178
0
                ERR_raise(ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG);
179
0
                goto err;
180
0
            }
181
13.4k
            eos++;
182
13.4k
            want = HEADER_SIZE;
183
1.40M
        } else if (eos && (slen == 0) && (tag == V_ASN1_EOC)) {
184
            /* eos value, so go back and read another header */
185
13.3k
            eos--;
186
13.3k
            if (eos == 0)
187
5.35k
                break;
188
7.99k
            else
189
7.99k
                want = HEADER_SIZE;
190
1.39M
        } else {
191
            /* suck in slen bytes of data */
192
1.39M
            want = slen;
193
1.39M
            if (want > (len - off)) {
194
323k
                size_t chunk_max = ASN1_CHUNK_INITIAL_SIZE;
195
196
323k
                want -= (len - off);
197
323k
                if (want > INT_MAX /* BIO_read takes an int length */  ||
198
323k
                    len + want < len) {
199
0
                    ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
200
0
                    goto err;
201
0
                }
202
646k
                while (want > 0) {
203
                    /*
204
                     * Read content in chunks of increasing size
205
                     * so we can return an error for EOF without
206
                     * having to allocate the entire content length
207
                     * in one go.
208
                     */
209
323k
                    size_t chunk = want > chunk_max ? chunk_max : want;
210
211
323k
                    if (!BUF_MEM_grow_clean(b, len + chunk)) {
212
0
                        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
213
0
                        goto err;
214
0
                    }
215
323k
                    want -= chunk;
216
647k
                    while (chunk > 0) {
217
323k
                        i = BIO_read(in, &(b->data[len]), chunk);
218
323k
                        if (i <= 0) {
219
0
                            ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
220
0
                            goto err;
221
0
                        }
222
                    /*
223
                     * This can't overflow because |len+want| didn't
224
                     * overflow.
225
                     */
226
323k
                        len += i;
227
323k
                        chunk -= i;
228
323k
                    }
229
323k
                    if (chunk_max < INT_MAX/2)
230
323k
                        chunk_max *= 2;
231
323k
                }
232
323k
            }
233
1.39M
            if (off + slen < off) {
234
0
                ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
235
0
                goto err;
236
0
            }
237
1.39M
            off += slen;
238
1.39M
            if (eos == 0) {
239
7.22k
                break;
240
7.22k
            } else
241
1.38M
                want = HEADER_SIZE;
242
1.39M
        }
243
1.42M
    }
244
245
12.5k
    if (off > INT_MAX) {
246
0
        ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
247
0
        goto err;
248
0
    }
249
250
12.5k
    *pb = b;
251
12.5k
    return off;
252
55
 err:
253
55
    ERR_clear_last_mark();
254
55
    BUF_MEM_free(b);
255
55
    return -1;
256
12.5k
}