/src/openssl32/crypto/asn1/asn1_lib.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | #include <stdio.h> |
11 | | #include <limits.h> |
12 | | #include "internal/cryptlib.h" |
13 | | #include <openssl/asn1.h> |
14 | | #include "asn1_local.h" |
15 | | |
16 | | static int asn1_get_length(const unsigned char **pp, int *inf, long *rl, |
17 | | long max); |
18 | | static void asn1_put_length(unsigned char **pp, int length); |
19 | | |
20 | | static int _asn1_check_infinite_end(const unsigned char **p, long len) |
21 | 0 | { |
22 | | /* |
23 | | * If there is 0 or 1 byte left, the length check should pick things up |
24 | | */ |
25 | 0 | if (len <= 0) { |
26 | 0 | return 1; |
27 | 0 | } else { |
28 | 0 | if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0)) { |
29 | 0 | (*p) += 2; |
30 | 0 | return 1; |
31 | 0 | } |
32 | 0 | } |
33 | 0 | return 0; |
34 | 0 | } |
35 | | |
36 | | int ASN1_check_infinite_end(unsigned char **p, long len) |
37 | 0 | { |
38 | 0 | return _asn1_check_infinite_end((const unsigned char **)p, len); |
39 | 0 | } |
40 | | |
41 | | int ASN1_const_check_infinite_end(const unsigned char **p, long len) |
42 | 0 | { |
43 | 0 | return _asn1_check_infinite_end(p, len); |
44 | 0 | } |
45 | | |
46 | | int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag, |
47 | | int *pclass, long omax) |
48 | 1.85G | { |
49 | 1.85G | int i, ret; |
50 | 1.85G | long len; |
51 | 1.85G | const unsigned char *p = *pp; |
52 | 1.85G | int tag, xclass, inf; |
53 | 1.85G | long max = omax; |
54 | | |
55 | 1.85G | if (omax <= 0) { |
56 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_SMALL); |
57 | 0 | return 0x80; |
58 | 0 | } |
59 | 1.85G | ret = (*p & V_ASN1_CONSTRUCTED); |
60 | 1.85G | xclass = (*p & V_ASN1_PRIVATE); |
61 | 1.85G | i = *p & V_ASN1_PRIMITIVE_TAG; |
62 | 1.85G | if (i == V_ASN1_PRIMITIVE_TAG) { /* high-tag */ |
63 | 7.04M | p++; |
64 | 7.04M | if (--max == 0) |
65 | 11.9k | goto err; |
66 | 7.03M | len = 0; |
67 | 10.8M | while (*p & 0x80) { |
68 | 3.83M | len <<= 7L; |
69 | 3.83M | len |= *(p++) & 0x7f; |
70 | 3.83M | if (--max == 0) |
71 | 12.8k | goto err; |
72 | 3.82M | if (len > (INT_MAX >> 7L)) |
73 | 15.4k | goto err; |
74 | 3.82M | } |
75 | 7.00M | len <<= 7L; |
76 | 7.00M | len |= *(p++) & 0x7f; |
77 | 7.00M | tag = (int)len; |
78 | 7.00M | if (--max == 0) |
79 | 15.9k | goto err; |
80 | 1.85G | } else { |
81 | 1.85G | tag = i; |
82 | 1.85G | p++; |
83 | 1.85G | if (--max == 0) |
84 | 185k | goto err; |
85 | 1.85G | } |
86 | 1.85G | *ptag = tag; |
87 | 1.85G | *pclass = xclass; |
88 | 1.85G | if (!asn1_get_length(&p, &inf, plength, max)) |
89 | 303k | goto err; |
90 | | |
91 | 1.85G | if (inf && !(ret & V_ASN1_CONSTRUCTED)) |
92 | 20.6k | goto err; |
93 | | |
94 | 1.85G | if (*plength > (omax - (p - *pp))) { |
95 | 77.9M | ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG); |
96 | | /* |
97 | | * Set this so that even if things are not long enough the values are |
98 | | * set correctly |
99 | | */ |
100 | 77.9M | ret |= 0x80; |
101 | 77.9M | } |
102 | 1.85G | *pp = p; |
103 | 1.85G | return ret | inf; |
104 | 565k | err: |
105 | 565k | ERR_raise(ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG); |
106 | 565k | return 0x80; |
107 | 1.85G | } |
108 | | |
109 | | /* |
110 | | * Decode a length field. |
111 | | * The short form is a single byte defining a length 0 - 127. |
112 | | * The long form is a byte 0 - 127 with the top bit set and this indicates |
113 | | * the number of following octets that contain the length. These octets |
114 | | * are stored most significant digit first. |
115 | | */ |
116 | | static int asn1_get_length(const unsigned char **pp, int *inf, long *rl, |
117 | | long max) |
118 | 1.85G | { |
119 | 1.85G | const unsigned char *p = *pp; |
120 | 1.85G | unsigned long ret = 0; |
121 | 1.85G | int i; |
122 | | |
123 | 1.85G | if (max-- < 1) |
124 | 0 | return 0; |
125 | 1.85G | if (*p == 0x80) { |
126 | 348M | *inf = 1; |
127 | 348M | p++; |
128 | 1.50G | } else { |
129 | 1.50G | *inf = 0; |
130 | 1.50G | i = *p & 0x7f; |
131 | 1.50G | if (*p++ & 0x80) { |
132 | 20.3M | if (max < i + 1) |
133 | 245k | return 0; |
134 | | /* Skip leading zeroes */ |
135 | 21.5M | while (i > 0 && *p == 0) { |
136 | 1.42M | p++; |
137 | 1.42M | i--; |
138 | 1.42M | } |
139 | 20.1M | if (i > (int)sizeof(long)) |
140 | 14.8k | return 0; |
141 | 43.1M | while (i > 0) { |
142 | 23.0M | ret <<= 8; |
143 | 23.0M | ret |= *p++; |
144 | 23.0M | i--; |
145 | 23.0M | } |
146 | 20.1M | if (ret > LONG_MAX) |
147 | 43.6k | return 0; |
148 | 1.48G | } else { |
149 | 1.48G | ret = i; |
150 | 1.48G | } |
151 | 1.50G | } |
152 | 1.85G | *pp = p; |
153 | 1.85G | *rl = (long)ret; |
154 | 1.85G | return 1; |
155 | 1.85G | } |
156 | | |
157 | | /* |
158 | | * constructed == 2 for indefinite length constructed |
159 | | */ |
160 | | void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag, |
161 | | int xclass) |
162 | 85.9M | { |
163 | 85.9M | unsigned char *p = *pp; |
164 | 85.9M | int i, ttag; |
165 | | |
166 | 85.9M | i = (constructed) ? V_ASN1_CONSTRUCTED : 0; |
167 | 85.9M | i |= (xclass & V_ASN1_PRIVATE); |
168 | 85.9M | if (tag < 31) { |
169 | 85.9M | *(p++) = i | (tag & V_ASN1_PRIMITIVE_TAG); |
170 | 85.9M | } else { |
171 | 15.8k | *(p++) = i | V_ASN1_PRIMITIVE_TAG; |
172 | 49.0k | for (i = 0, ttag = tag; ttag > 0; i++) |
173 | 33.2k | ttag >>= 7; |
174 | 15.8k | ttag = i; |
175 | 49.0k | while (i-- > 0) { |
176 | 33.2k | p[i] = tag & 0x7f; |
177 | 33.2k | if (i != (ttag - 1)) |
178 | 17.3k | p[i] |= 0x80; |
179 | 33.2k | tag >>= 7; |
180 | 33.2k | } |
181 | 15.8k | p += ttag; |
182 | 15.8k | } |
183 | 85.9M | if (constructed == 2) |
184 | 0 | *(p++) = 0x80; |
185 | 85.9M | else |
186 | 85.9M | asn1_put_length(&p, length); |
187 | 85.9M | *pp = p; |
188 | 85.9M | } |
189 | | |
190 | | int ASN1_put_eoc(unsigned char **pp) |
191 | 0 | { |
192 | 0 | unsigned char *p = *pp; |
193 | |
|
194 | 0 | *p++ = 0; |
195 | 0 | *p++ = 0; |
196 | 0 | *pp = p; |
197 | 0 | return 2; |
198 | 0 | } |
199 | | |
200 | | static void asn1_put_length(unsigned char **pp, int length) |
201 | 85.9M | { |
202 | 85.9M | unsigned char *p = *pp; |
203 | 85.9M | int i, len; |
204 | | |
205 | 85.9M | if (length <= 127) { |
206 | 85.3M | *(p++) = (unsigned char)length; |
207 | 85.3M | } else { |
208 | 605k | len = length; |
209 | 1.69M | for (i = 0; len > 0; i++) |
210 | 1.08M | len >>= 8; |
211 | 605k | *(p++) = i | 0x80; |
212 | 605k | len = i; |
213 | 1.69M | while (i-- > 0) { |
214 | 1.08M | p[i] = length & 0xff; |
215 | 1.08M | length >>= 8; |
216 | 1.08M | } |
217 | 605k | p += len; |
218 | 605k | } |
219 | 85.9M | *pp = p; |
220 | 85.9M | } |
221 | | |
222 | | int ASN1_object_size(int constructed, int length, int tag) |
223 | 329M | { |
224 | 329M | int ret = 1; |
225 | | |
226 | 329M | if (length < 0) |
227 | 0 | return -1; |
228 | 329M | if (tag >= 31) { |
229 | 293k | while (tag > 0) { |
230 | 194k | tag >>= 7; |
231 | 194k | ret++; |
232 | 194k | } |
233 | 99.5k | } |
234 | 329M | if (constructed == 2) { |
235 | 0 | ret += 3; |
236 | 329M | } else { |
237 | 329M | ret++; |
238 | 329M | if (length > 127) { |
239 | 2.26M | int tmplen = length; |
240 | 6.29M | while (tmplen > 0) { |
241 | 4.03M | tmplen >>= 8; |
242 | 4.03M | ret++; |
243 | 4.03M | } |
244 | 2.26M | } |
245 | 329M | } |
246 | 329M | if (ret >= INT_MAX - length) |
247 | 0 | return -1; |
248 | 329M | return ret + length; |
249 | 329M | } |
250 | | |
251 | | void ossl_asn1_string_set_bits_left(ASN1_STRING *str, unsigned int num) |
252 | 2.09M | { |
253 | 2.09M | str->flags &= ~0x07; |
254 | 2.09M | str->flags |= ASN1_STRING_FLAG_BITS_LEFT | (num & 0x07); |
255 | 2.09M | } |
256 | | |
257 | | int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str) |
258 | 9.31M | { |
259 | 9.31M | if (str == NULL) |
260 | 0 | return 0; |
261 | 9.31M | dst->type = str->type; |
262 | 9.31M | if (!ASN1_STRING_set(dst, str->data, str->length)) |
263 | 0 | return 0; |
264 | | /* Copy flags but preserve embed value */ |
265 | 9.31M | dst->flags &= ASN1_STRING_FLAG_EMBED; |
266 | 9.31M | dst->flags |= str->flags & ~ASN1_STRING_FLAG_EMBED; |
267 | 9.31M | return 1; |
268 | 9.31M | } |
269 | | |
270 | | ASN1_STRING *ASN1_STRING_dup(const ASN1_STRING *str) |
271 | 78.3k | { |
272 | 78.3k | ASN1_STRING *ret; |
273 | | |
274 | 78.3k | if (!str) |
275 | 0 | return NULL; |
276 | 78.3k | ret = ASN1_STRING_new(); |
277 | 78.3k | if (ret == NULL) |
278 | 0 | return NULL; |
279 | 78.3k | if (!ASN1_STRING_copy(ret, str)) { |
280 | 0 | ASN1_STRING_free(ret); |
281 | 0 | return NULL; |
282 | 0 | } |
283 | 78.3k | return ret; |
284 | 78.3k | } |
285 | | |
286 | | int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len_in) |
287 | 48.9M | { |
288 | 48.9M | unsigned char *c; |
289 | 48.9M | const char *data = _data; |
290 | 48.9M | size_t len; |
291 | | |
292 | 48.9M | if (len_in < 0) { |
293 | 85.6k | if (data == NULL) |
294 | 0 | return 0; |
295 | 85.6k | len = strlen(data); |
296 | 48.8M | } else { |
297 | 48.8M | len = (size_t)len_in; |
298 | 48.8M | } |
299 | | /* |
300 | | * Verify that the length fits within an integer for assignment to |
301 | | * str->length below. The additional 1 is subtracted to allow for the |
302 | | * '\0' terminator even though this isn't strictly necessary. |
303 | | */ |
304 | 48.9M | if (len > INT_MAX - 1) { |
305 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LARGE); |
306 | 0 | return 0; |
307 | 0 | } |
308 | 48.9M | if ((size_t)str->length <= len || str->data == NULL) { |
309 | 48.9M | c = str->data; |
310 | 48.9M | #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION |
311 | | /* No NUL terminator in fuzzing builds */ |
312 | 48.9M | str->data = OPENSSL_realloc(c, len != 0 ? len : 1); |
313 | | #else |
314 | | str->data = OPENSSL_realloc(c, len + 1); |
315 | | #endif |
316 | 48.9M | if (str->data == NULL) { |
317 | 0 | str->data = c; |
318 | 0 | return 0; |
319 | 0 | } |
320 | 48.9M | } |
321 | 48.9M | str->length = len; |
322 | 48.9M | if (data != NULL) { |
323 | 43.5M | memcpy(str->data, data, len); |
324 | 43.5M | #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION |
325 | | /* Set the unused byte to something non NUL and printable. */ |
326 | 43.5M | if (len == 0) |
327 | 15.7M | str->data[len] = '~'; |
328 | | #else |
329 | | /* |
330 | | * Add a NUL terminator. This should not be necessary - but we add it as |
331 | | * a safety precaution |
332 | | */ |
333 | | str->data[len] = '\0'; |
334 | | #endif |
335 | 43.5M | } |
336 | 48.9M | return 1; |
337 | 48.9M | } |
338 | | |
339 | | void ASN1_STRING_set0(ASN1_STRING *str, void *data, int len) |
340 | 16.4M | { |
341 | 16.4M | OPENSSL_free(str->data); |
342 | 16.4M | str->data = data; |
343 | 16.4M | str->length = len; |
344 | 16.4M | } |
345 | | |
346 | | ASN1_STRING *ASN1_STRING_new(void) |
347 | 87.9k | { |
348 | 87.9k | return ASN1_STRING_type_new(V_ASN1_OCTET_STRING); |
349 | 87.9k | } |
350 | | |
351 | | ASN1_STRING *ASN1_STRING_type_new(int type) |
352 | 72.6M | { |
353 | 72.6M | ASN1_STRING *ret; |
354 | | |
355 | 72.6M | ret = OPENSSL_zalloc(sizeof(*ret)); |
356 | 72.6M | if (ret == NULL) |
357 | 0 | return NULL; |
358 | 72.6M | ret->type = type; |
359 | 72.6M | return ret; |
360 | 72.6M | } |
361 | | |
362 | | void ossl_asn1_string_embed_free(ASN1_STRING *a, int embed) |
363 | 77.0M | { |
364 | 77.0M | if (a == NULL) |
365 | 0 | return; |
366 | 77.0M | if (!(a->flags & ASN1_STRING_FLAG_NDEF)) |
367 | 77.0M | OPENSSL_free(a->data); |
368 | 77.0M | if (embed == 0) |
369 | 72.6M | OPENSSL_free(a); |
370 | 77.0M | } |
371 | | |
372 | | void ASN1_STRING_free(ASN1_STRING *a) |
373 | 16.6M | { |
374 | 16.6M | if (a == NULL) |
375 | 13.0M | return; |
376 | 3.62M | ossl_asn1_string_embed_free(a, a->flags & ASN1_STRING_FLAG_EMBED); |
377 | 3.62M | } |
378 | | |
379 | | void ASN1_STRING_clear_free(ASN1_STRING *a) |
380 | 2.31k | { |
381 | 2.31k | if (a == NULL) |
382 | 104 | return; |
383 | 2.21k | if (a->data && !(a->flags & ASN1_STRING_FLAG_NDEF)) |
384 | 2.21k | OPENSSL_cleanse(a->data, a->length); |
385 | 2.21k | ASN1_STRING_free(a); |
386 | 2.21k | } |
387 | | |
388 | | int ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b) |
389 | 21.8k | { |
390 | 21.8k | int i; |
391 | | |
392 | 21.8k | i = (a->length - b->length); |
393 | 21.8k | if (i == 0) { |
394 | 19.0k | if (a->length != 0) |
395 | 18.9k | i = memcmp(a->data, b->data, a->length); |
396 | 19.0k | if (i == 0) |
397 | 14.9k | return a->type - b->type; |
398 | 4.16k | else |
399 | 4.16k | return i; |
400 | 19.0k | } else { |
401 | 2.82k | return i; |
402 | 2.82k | } |
403 | 21.8k | } |
404 | | |
405 | | int ASN1_STRING_length(const ASN1_STRING *x) |
406 | 1.81M | { |
407 | 1.81M | return x->length; |
408 | 1.81M | } |
409 | | |
410 | | #ifndef OPENSSL_NO_DEPRECATED_3_0 |
411 | | void ASN1_STRING_length_set(ASN1_STRING *x, int len) |
412 | 0 | { |
413 | 0 | x->length = len; |
414 | 0 | } |
415 | | #endif |
416 | | |
417 | | int ASN1_STRING_type(const ASN1_STRING *x) |
418 | 0 | { |
419 | 0 | return x->type; |
420 | 0 | } |
421 | | |
422 | | const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x) |
423 | 1.86M | { |
424 | 1.86M | return x->data; |
425 | 1.86M | } |
426 | | |
427 | | #ifndef OPENSSL_NO_DEPRECATED_1_1_0 |
428 | | unsigned char *ASN1_STRING_data(ASN1_STRING *x) |
429 | 0 | { |
430 | 0 | return x->data; |
431 | 0 | } |
432 | | #endif |
433 | | |
434 | | /* |max_len| excludes NUL terminator and may be 0 to indicate no restriction */ |
435 | | char *ossl_sk_ASN1_UTF8STRING2text(STACK_OF(ASN1_UTF8STRING) *text, |
436 | | const char *sep, size_t max_len) |
437 | 0 | { |
438 | 0 | int i; |
439 | 0 | ASN1_UTF8STRING *current; |
440 | 0 | size_t length = 0, sep_len; |
441 | 0 | char *result = NULL; |
442 | 0 | char *p; |
443 | |
|
444 | 0 | if (sep == NULL) |
445 | 0 | sep = ""; |
446 | 0 | sep_len = strlen(sep); |
447 | |
|
448 | 0 | for (i = 0; i < sk_ASN1_UTF8STRING_num(text); i++) { |
449 | 0 | current = sk_ASN1_UTF8STRING_value(text, i); |
450 | 0 | if (i > 0) |
451 | 0 | length += sep_len; |
452 | 0 | length += ASN1_STRING_length(current); |
453 | 0 | if (max_len != 0 && length > max_len) |
454 | 0 | return NULL; |
455 | 0 | } |
456 | 0 | if ((result = OPENSSL_malloc(length + 1)) == NULL) |
457 | 0 | return NULL; |
458 | | |
459 | 0 | p = result; |
460 | 0 | for (i = 0; i < sk_ASN1_UTF8STRING_num(text); i++) { |
461 | 0 | current = sk_ASN1_UTF8STRING_value(text, i); |
462 | 0 | length = ASN1_STRING_length(current); |
463 | 0 | if (i > 0 && sep_len > 0) { |
464 | 0 | strncpy(p, sep, sep_len + 1); /* using + 1 to silence gcc warning */ |
465 | 0 | p += sep_len; |
466 | 0 | } |
467 | 0 | strncpy(p, (const char *)ASN1_STRING_get0_data(current), length); |
468 | 0 | p += length; |
469 | 0 | } |
470 | 0 | *p = '\0'; |
471 | |
|
472 | 0 | return result; |
473 | 0 | } |