/src/openssl30/crypto/asn1/a_d2i_fp.c

Source (jump to first uncovered line)
/*
 * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include <limits.h>
#include "internal/cryptlib.h"
#include "internal/numbers.h"
#include <openssl/buffer.h>
#include <openssl/asn1.h>
#include "internal/asn1.h"
#include "crypto/asn1.h"

#ifndef NO_OLD_ASN1
# ifndef OPENSSL_NO_STDIO

void *ASN1_d2i_fp(void *(*xnew) (void), d2i_of_void *d2i, FILE *in, void **x)
{
    BIO *b;
    void *ret;

    if ((b = BIO_new(BIO_s_file())) == NULL) {
        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
        return NULL;
    }
    BIO_set_fp(b, in, BIO_NOCLOSE);
    ret = ASN1_d2i_bio(xnew, d2i, b, x);
    BIO_free(b);
    return ret;
}
# endif

void *ASN1_d2i_bio(void *(*xnew) (void), d2i_of_void *d2i, BIO *in, void **x)
{
    BUF_MEM *b = NULL;
    const unsigned char *p;
    void *ret = NULL;
    int len;

    len = asn1_d2i_read_bio(in, &b);
    if (len < 0)
        goto err;

    p = (unsigned char *)b->data;
    ret = d2i(x, &p, len);
 err:
    BUF_MEM_free(b);
    return ret;
}

#endif

void *ASN1_item_d2i_bio_ex(const ASN1_ITEM *it, BIO *in, void *x,
                           OSSL_LIB_CTX *libctx, const char *propq)
{
    BUF_MEM *b = NULL;
    const unsigned char *p;
    void *ret = NULL;
    int len;

    if (in == NULL)
        return NULL;
    len = asn1_d2i_read_bio(in, &b);
    if (len < 0)
        goto err;

    p = (const unsigned char *)b->data;
    ret = ASN1_item_d2i_ex(x, &p, len, it, libctx, propq);
 err:
    BUF_MEM_free(b);
    return ret;
}

void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x)
{
    return ASN1_item_d2i_bio_ex(it, in, x, NULL, NULL);
}

#ifndef OPENSSL_NO_STDIO
void *ASN1_item_d2i_fp_ex(const ASN1_ITEM *it, FILE *in, void *x,
                          OSSL_LIB_CTX *libctx, const char *propq)
{
    BIO *b;
    char *ret;

    if ((b = BIO_new(BIO_s_file())) == NULL) {
        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
        return NULL;
    }
    BIO_set_fp(b, in, BIO_NOCLOSE);
    ret = ASN1_item_d2i_bio_ex(it, b, x, libctx, propq);
    BIO_free(b);
    return ret;
}

void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x)
{
    return ASN1_item_d2i_fp_ex(it, in, x, NULL, NULL);
}
#endif

#define HEADER_SIZE   8
#define ASN1_CHUNK_INITIAL_SIZE (16 * 1024)
int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
{
    BUF_MEM *b;
    unsigned char *p;
    int i;
    size_t want = HEADER_SIZE;
    uint32_t eos = 0;
    size_t off = 0;
    size_t len = 0;
    size_t diff;

    const unsigned char *q;
    long slen;
    int inf, tag, xclass;

    b = BUF_MEM_new();
    if (b == NULL) {
        ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
        return -1;
    }

    ERR_set_mark();
    for (;;) {
        diff = len - off;
        if (want >= diff) {
            want -= diff;

            if (len + want < len || !BUF_MEM_grow_clean(b, len + want)) {
                ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
                goto err;
            }
            i = BIO_read(in, &(b->data[len]), want);
            if (i < 0 && diff == 0) {
                ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
                goto err;
            }
            if (i > 0) {
                if (len + i < len) {
                    ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
                    goto err;
                }
                len += i;
            }
        }
        /* else data already loaded */

        p = (unsigned char *)&(b->data[off]);
        q = p;
        diff = len - off;
        if (diff == 0)
            goto err;
        inf = ASN1_get_object(&q, &slen, &tag, &xclass, diff);
        if (inf & 0x80) {
            unsigned long e;

            e = ERR_GET_REASON(ERR_peek_last_error());
            if (e != ASN1_R_TOO_LONG)
                goto err;
            ERR_pop_to_mark();
        }
        i = q - p;            /* header length */
        off += i;               /* end of data */

        if (inf & 1) {
            /* no data body so go round again */
            if (eos == UINT32_MAX) {
                ERR_raise(ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG);
                goto err;
            }
            eos++;
            want = HEADER_SIZE;
        } else if (eos && (slen == 0) && (tag == V_ASN1_EOC)) {
            /* eos value, so go back and read another header */
            eos--;
            if (eos == 0)
                break;
            else
                want = HEADER_SIZE;
        } else {
            /* suck in slen bytes of data */
            want = slen;
            if (want > (len - off)) {
                size_t chunk_max = ASN1_CHUNK_INITIAL_SIZE;

                want -= (len - off);
                if (want > INT_MAX /* BIO_read takes an int length */  ||
                    len + want < len) {
                    ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
                    goto err;
                }
                while (want > 0) {
                    /*
                     * Read content in chunks of increasing size
                     * so we can return an error for EOF without
                     * having to allocate the entire content length
                     * in one go.
                     */
                    size_t chunk = want > chunk_max ? chunk_max : want;

                    if (!BUF_MEM_grow_clean(b, len + chunk)) {
                        ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
                        goto err;
                    }
                    want -= chunk;
                    while (chunk > 0) {
                        i = BIO_read(in, &(b->data[len]), chunk);
                        if (i <= 0) {
                            ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
                            goto err;
                        }
                    /*
                     * This can't overflow because |len+want| didn't
                     * overflow.
                     */
                        len += i;
                        chunk -= i;
                    }
                    if (chunk_max < INT_MAX/2)
                        chunk_max *= 2;
                }
            }
            if (off + slen < off) {
                ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
                goto err;
            }
            off += slen;
            if (eos == 0) {
                break;
            } else
                want = HEADER_SIZE;
        }
    }

    if (off > INT_MAX) {
        ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
        goto err;
    }

    *pb = b;
    return off;
 err:
    ERR_clear_last_mark();
    BUF_MEM_free(b);
    return -1;
}

Coverage Report

Created: 2023-09-25 06:45

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <stdio.h>
11		#include <limits.h>
12		#include "internal/cryptlib.h"
13		#include "internal/numbers.h"
14		#include <openssl/buffer.h>
15		#include <openssl/asn1.h>
16		#include "internal/asn1.h"
17		#include "crypto/asn1.h"
18
19		#ifndef NO_OLD_ASN1
20		# ifndef OPENSSL_NO_STDIO
21
22		void ASN1_d2i_fp(void (xnew) (void), d2i_of_void d2i, FILE in, void *x)
23	0	{
24	0	BIO *b;
25	0	void *ret;
26
27	0	if ((b = BIO_new(BIO_s_file())) == NULL) {
28	0	ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
29	0	return NULL;
30	0	}
31	0	BIO_set_fp(b, in, BIO_NOCLOSE);
32	0	ret = ASN1_d2i_bio(xnew, d2i, b, x);
33	0	BIO_free(b);
34	0	return ret;
35	0	}
36		# endif
37
38		void ASN1_d2i_bio(void (xnew) (void), d2i_of_void d2i, BIO in, void *x)
39	0	{
40	0	BUF_MEM *b = NULL;
41	0	const unsigned char *p;
42	0	void *ret = NULL;
43	0	int len;
44
45	0	len = asn1_d2i_read_bio(in, &b);
46	0	if (len < 0)
47	0	goto err;
48
49	0	p = (unsigned char *)b->data;
50	0	ret = d2i(x, &p, len);
51	0	err:
52	0	BUF_MEM_free(b);
53	0	return ret;
54	0	}
55
56		#endif
57
58		void ASN1_item_d2i_bio_ex(const ASN1_ITEM it, BIO in, void x,
59		OSSL_LIB_CTX libctx, const char propq)
60	38.5k	{
61	38.5k	BUF_MEM *b = NULL;
62	38.5k	const unsigned char *p;
63	38.5k	void *ret = NULL;
64	38.5k	int len;
65
66	38.5k	if (in == NULL)
67	0	return NULL;
68	38.5k	len = asn1_d2i_read_bio(in, &b);
69	38.5k	if (len < 0)
70	2.44k	goto err;
71
72	36.0k	p = (const unsigned char *)b->data;
73	36.0k	ret = ASN1_item_d2i_ex(x, &p, len, it, libctx, propq);
74	38.5k	err:
75	38.5k	BUF_MEM_free(b);
76	38.5k	return ret;
77	36.0k	}
78
79		void ASN1_item_d2i_bio(const ASN1_ITEM it, BIO in, void x)
80		{
81		return ASN1_item_d2i_bio_ex(it, in, x, NULL, NULL);
82		}
83
84		#ifndef OPENSSL_NO_STDIO
85		void ASN1_item_d2i_fp_ex(const ASN1_ITEM it, FILE in, void x,
86		OSSL_LIB_CTX libctx, const char propq)
87	0	{
88	0	BIO *b;
89	0	char *ret;
90
91	0	if ((b = BIO_new(BIO_s_file())) == NULL) {
92	0	ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
93	0	return NULL;
94	0	}
95	0	BIO_set_fp(b, in, BIO_NOCLOSE);
96	0	ret = ASN1_item_d2i_bio_ex(it, b, x, libctx, propq);
97	0	BIO_free(b);
98	0	return ret;
99	0	}
100
101		void ASN1_item_d2i_fp(const ASN1_ITEM it, FILE in, void x)
102	0	{
103	0	return ASN1_item_d2i_fp_ex(it, in, x, NULL, NULL);
104	0	}
105		#endif
106
107	609M	#define HEADER_SIZE 8
108	49.1M	#define ASN1_CHUNK_INITIAL_SIZE (16 * 1024)
109		int asn1_d2i_read_bio(BIO in, BUF_MEM *pb)
110	1.77M	{
111	1.77M	BUF_MEM *b;
112	1.77M	unsigned char *p;
113	1.77M	int i;
114	1.77M	size_t want = HEADER_SIZE;
115	1.77M	uint32_t eos = 0;
116	1.77M	size_t off = 0;
117	1.77M	size_t len = 0;
118	1.77M	size_t diff;
119
120	1.77M	const unsigned char *q;
121	1.77M	long slen;
122	1.77M	int inf, tag, xclass;
123
124	1.77M	b = BUF_MEM_new();
125	1.77M	if (b == NULL) {
126	0	ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
127	0	return -1;
128	0	}
129
130	1.77M	ERR_set_mark();
131	609M	for (;;) {
132	609M	diff = len - off;
133	609M	if (want >= diff) {
134	609M	want -= diff;
135
136	609M	if (len + want < len \|\| !BUF_MEM_grow_clean(b, len + want)) {
137	0	ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
138	0	goto err;
139	0	}
140	609M	i = BIO_read(in, &(b->data[len]), want);
141	609M	if (i < 0 && diff == 0) {
142	340	ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
143	340	goto err;
144	340	}
145	609M	if (i > 0) {
146	608M	if (len + i < len) {
147	0	ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
148	0	goto err;
149	0	}
150	608M	len += i;
151	608M	}
152	609M	}
153		/* else data already loaded */
154
155	609M	p = (unsigned char *)&(b->data[off]);
156	609M	q = p;
157	609M	diff = len - off;
158	609M	if (diff == 0)
159	81.0k	goto err;
160	608M	inf = ASN1_get_object(&q, &slen, &tag, &xclass, diff);
161	608M	if (inf & 0x80) {
162	49.2M	unsigned long e;
163
164	49.2M	e = ERR_GET_REASON(ERR_peek_last_error());
165	49.2M	if (e != ASN1_R_TOO_LONG)
166	98.2k	goto err;
167	49.1M	ERR_pop_to_mark();
168	49.1M	}
169	608M	i = q - p; /* header length */
170	608M	off += i; /* end of data */
171
172	608M	if (inf & 1) {
173		/* no data body so go round again */
174	121M	if (eos == UINT32_MAX) {
175	0	ERR_raise(ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG);
176	0	goto err;
177	0	}
178	121M	eos++;
179	121M	want = HEADER_SIZE;
180	487M	} else if (eos && (slen == 0) && (tag == V_ASN1_EOC)) {
181		/* eos value, so go back and read another header */
182	50.5M	eos--;
183	50.5M	if (eos == 0)
184	929k	break;
185	49.6M	else
186	49.6M	want = HEADER_SIZE;
187	437M	} else {
188		/* suck in slen bytes of data */
189	437M	want = slen;
190	437M	if (want > (len - off)) {
191	49.1M	size_t chunk_max = ASN1_CHUNK_INITIAL_SIZE;
192
193	49.1M	want -= (len - off);
194	49.1M	if (want > INT_MAX /* BIO_read takes an int length */ \|\|
195	49.1M	len + want < len) {
196	5.29k	ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
197	5.29k	goto err;
198	5.29k	}
199	98.2M	while (want > 0) {
200		/*
201		* Read content in chunks of increasing size
202		* so we can return an error for EOF without
203		* having to allocate the entire content length
204		* in one go.
205		*/
206	49.2M	size_t chunk = want > chunk_max ? chunk_max : want;
207
208	49.2M	if (!BUF_MEM_grow_clean(b, len + chunk)) {
209	0	ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
210	0	goto err;
211	0	}
212	49.2M	want -= chunk;
213	98.4M	while (chunk > 0) {
214	49.2M	i = BIO_read(in, &(b->data[len]), chunk);
215	49.2M	if (i <= 0) {
216	91.5k	ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
217	91.5k	goto err;
218	91.5k	}
219		/*
220		* This can't overflow because \|len+want\| didn't
221		* overflow.
222		*/
223	49.1M	len += i;
224	49.1M	chunk -= i;
225	49.1M	}
226	49.1M	if (chunk_max < INT_MAX/2)
227	49.1M	chunk_max *= 2;
228	49.1M	}
229	49.1M	}
230	437M	if (off + slen < off) {
231	0	ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
232	0	goto err;
233	0	}
234	437M	off += slen;
235	437M	if (eos == 0) {
236	566k	break;
237	566k	} else
238	436M	want = HEADER_SIZE;
239	437M	}
240	608M	}
241
242	1.49M	if (off > INT_MAX) {
243	0	ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
244	0	goto err;
245	0	}
246
247	1.49M	*pb = b;
248	1.49M	return off;
249	276k	err:
250	276k	ERR_clear_last_mark();
251	276k	BUF_MEM_free(b);
252	276k	return -1;
253	1.49M	}