/src/openssl36/crypto/asn1/a_d2i_fp.c

Source
/*
 * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <stdio.h>
#include <limits.h>
#include "internal/cryptlib.h"
#include "internal/numbers.h"
#include <openssl/buffer.h>
#include <openssl/asn1.h>
#include "internal/asn1.h"
#include "crypto/asn1.h"

#ifndef NO_OLD_ASN1
#ifndef OPENSSL_NO_STDIO

void *ASN1_d2i_fp(void *(*xnew)(void), d2i_of_void *d2i, FILE *in, void **x)
{
    BIO *b;
    void *ret;

    if ((b = BIO_new(BIO_s_file())) == NULL) {
        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
        return NULL;
    }
    BIO_set_fp(b, in, BIO_NOCLOSE);
    ret = ASN1_d2i_bio(xnew, d2i, b, x);
    BIO_free(b);
    return ret;
}
#endif

void *ASN1_d2i_bio(void *(*xnew)(void), d2i_of_void *d2i, BIO *in, void **x)
{
    BUF_MEM *b = NULL;
    const unsigned char *p;
    void *ret = NULL;
    int len;

    len = asn1_d2i_read_bio(in, &b);
    if (len < 0)
        goto err;

    p = (unsigned char *)b->data;
    ret = d2i(x, &p, len);
err:
    BUF_MEM_free(b);
    return ret;
}

#endif

void *ASN1_item_d2i_bio_ex(const ASN1_ITEM *it, BIO *in, void *x,
    OSSL_LIB_CTX *libctx, const char *propq)
{
    BUF_MEM *b = NULL;
    const unsigned char *p;
    void *ret = NULL;
    int len;

    if (in == NULL)
        return NULL;
    len = asn1_d2i_read_bio(in, &b);
    if (len < 0)
        goto err;

    p = (const unsigned char *)b->data;
    ret = ASN1_item_d2i_ex(x, &p, len, it, libctx, propq);
err:
    BUF_MEM_free(b);
    return ret;
}

void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x)
{
    return ASN1_item_d2i_bio_ex(it, in, x, NULL, NULL);
}

#ifndef OPENSSL_NO_STDIO
void *ASN1_item_d2i_fp_ex(const ASN1_ITEM *it, FILE *in, void *x,
    OSSL_LIB_CTX *libctx, const char *propq)
{
    BIO *b;
    char *ret;

    if ((b = BIO_new(BIO_s_file())) == NULL) {
        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
        return NULL;
    }
    BIO_set_fp(b, in, BIO_NOCLOSE);
    ret = ASN1_item_d2i_bio_ex(it, b, x, libctx, propq);
    BIO_free(b);
    return ret;
}

void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x)
{
    return ASN1_item_d2i_fp_ex(it, in, x, NULL, NULL);
}
#endif

#define HEADER_SIZE 2
#define ASN1_CHUNK_INITIAL_SIZE (16 * 1024)
int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
{
    BUF_MEM *b;
    unsigned char *p;
    size_t want = HEADER_SIZE;
    uint32_t eos = 0;
    size_t off = 0;
    size_t len = 0;
    size_t diff;

    const unsigned char *q;
    long slen;
    int inf, tag, xclass;

    b = BUF_MEM_new();
    if (b == NULL) {
        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
        return -1;
    }

    ERR_set_mark();
    for (;;) {
        diff = len - off;
        if (want >= diff) {
            int i;

            want -= diff;

            if (len + want < len || !BUF_MEM_grow_clean(b, len + want)) {
                ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
                goto err;
            }
            i = BIO_read(in, &(b->data[len]), (int)want);
            if (i <= 0) {
                /*
                 * A read error (i < 0), an EOF in the middle of an object
                 * (diff != 0, some bytes already buffered), or an EOF while
                 * still inside an indefinite-length constructed value awaiting
                 * its end-of-contents octets (eos != 0) all mean the input is
                 * truncated.  Only a clean EOF at a top-level object boundary
                 * (i == 0, diff == 0, eos == 0) is the normal end of input:
                 * fail without queuing an error so that callers looping over
                 * concatenated DER values (e.g. the libcrypto d2i_*_bio()
                 * consumers in CPython's ssl module) terminate cleanly instead
                 * of seeing a spurious ASN1_R_NOT_ENOUGH_DATA.
                 */
                if (i < 0 || diff != 0 || eos != 0)
                    ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
                goto err;
            }
            if (i > 0) {
                if (len + i < len) {
                    ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
                    goto err;
                }
                len += i;
                if ((size_t)i < want)
                    continue;
            }
        }
        /* else data already loaded */

        /* make sure there is enough data for a complete header */
        p = (unsigned char *)&(b->data[off]);
        q = p;
        diff = len - off;
        if (diff < 2) {
            /* Failed sanity check */
            ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
            goto err;
        }

        diff--;
        if ((*(q++) & V_ASN1_PRIMITIVE_TAG) == V_ASN1_PRIMITIVE_TAG) {
            unsigned int i = 0;
            /* Multi-byte tag.  See if we have the whole thing yet */
            do {
                if (i > 4) {
                    /* The tag value must fit into int */
                    ERR_raise(ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG);
                    goto err;
                }
                ++i;
                diff--;
            } while (diff > 0 && *(q++) & 0x80);

            if (diff == 0) {
                /*
                 * End of current data, will need at least 1 more byte for
                 * length.  2 if the tag is still incomplete
                 */
                want = q - p + 2;
                if (*q & 0x80) {
                    want++;
                }
                continue;
            }
        }

        /* Check the length.  This should also work for indefinite length */
        diff--;
        if (*q & 0x80) {
            unsigned int i = *q & 0x7f;

            if (i > sizeof(long)) {
                ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
                goto err;
            }
            if (i > diff) {
                want = q - p + i + 1;
                continue;
            }
        }

        /*
         * We have a complete header now, assuming we didn't hit EOF. Parse the
         * tag and length
         */
        q = p;
        diff = len - off;
        inf = ASN1_get_object(&q, &slen, &tag, &xclass, (int)diff);
        if (inf & 0x80) {
            unsigned long e;

            e = ERR_GET_REASON(ERR_peek_last_error());
            if (e != ASN1_R_TOO_LONG)
                goto err;
            ERR_pop_to_mark();
            ERR_set_mark();
        }
        off += q - p; /* end of data */

        if (inf & 1) {
            /* no data body so go round again */
            if (eos == UINT32_MAX) {
                ERR_raise(ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG);
                goto err;
            }
            eos++;
            want = HEADER_SIZE;
        } else if (eos && (slen == 0) && (tag == V_ASN1_EOC)) {
            /* eos value, so go back and read another header */
            eos--;
            if (eos == 0)
                break;
            else
                want = HEADER_SIZE;
        } else {
            /* suck in slen bytes of data */
            want = slen;
            if (want > (len - off)) {
                size_t chunk_max = ASN1_CHUNK_INITIAL_SIZE;

                want -= (len - off);
                if (want > INT_MAX /* BIO_read takes an int length */ || len + want < len) {
                    ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
                    goto err;
                }
                while (want > 0) {
                    /*
                     * Read content in chunks of increasing size
                     * so we can return an error for EOF without
                     * having to allocate the entire content length
                     * in one go.
                     */
                    size_t chunk = want > chunk_max ? chunk_max : want;
                    int i;

                    if (!BUF_MEM_grow_clean(b, len + chunk)) {
                        ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
                        goto err;
                    }
                    want -= chunk;
                    while (chunk > 0) {
                        i = BIO_read(in, &(b->data[len]), (int)chunk);
                        if (i <= 0) {
                            ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
                            goto err;
                        }
                        /*
                         * This can't overflow because |len+want| didn't
                         * overflow.
                         */
                        len += i;
                        chunk -= i;
                    }
                    if (chunk_max < INT_MAX / 2)
                        chunk_max *= 2;
                }
            }
            if (off + slen < off) {
                ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
                goto err;
            }
            off += slen;
            if (eos == 0) {
                break;
            } else
                want = HEADER_SIZE;
        }
    }

    if (off > INT_MAX) {
        ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
        goto err;
    }

    *pb = b;
    ERR_clear_last_mark();
    return (int)off;
err:
    ERR_clear_last_mark();
    BUF_MEM_free(b);
    return -1;
}

Coverage Report

Created: 2026-07-23 06:28

Line	Count	Source
1		/*
2		* Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10		#include <stdio.h>
11		#include <limits.h>
12		#include "internal/cryptlib.h"
13		#include "internal/numbers.h"
14		#include <openssl/buffer.h>
15		#include <openssl/asn1.h>
16		#include "internal/asn1.h"
17		#include "crypto/asn1.h"
18
19		#ifndef NO_OLD_ASN1
20		#ifndef OPENSSL_NO_STDIO
21
22		void ASN1_d2i_fp(void (xnew)(void), d2i_of_void d2i, FILE in, void *x)
23	0	{
24	0	BIO *b;
25	0	void *ret;
26
27	0	if ((b = BIO_new(BIO_s_file())) == NULL) {
28	0	ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
29	0	return NULL;
30	0	}
31	0	BIO_set_fp(b, in, BIO_NOCLOSE);
32	0	ret = ASN1_d2i_bio(xnew, d2i, b, x);
33	0	BIO_free(b);
34	0	return ret;
35	0	}
36		#endif
37
38		void ASN1_d2i_bio(void (xnew)(void), d2i_of_void d2i, BIO in, void *x)
39	0	{
40	0	BUF_MEM *b = NULL;
41	0	const unsigned char *p;
42	0	void *ret = NULL;
43	0	int len;
44
45	0	len = asn1_d2i_read_bio(in, &b);
46	0	if (len < 0)
47	0	goto err;
48
49	0	p = (unsigned char *)b->data;
50	0	ret = d2i(x, &p, len);
51	0	err:
52	0	BUF_MEM_free(b);
53	0	return ret;
54	0	}
55
56		#endif
57
58		void ASN1_item_d2i_bio_ex(const ASN1_ITEM it, BIO in, void x,
59		OSSL_LIB_CTX libctx, const char propq)
60	126k	{
61	126k	BUF_MEM *b = NULL;
62	126k	const unsigned char *p;
63	126k	void *ret = NULL;
64	126k	int len;
65
66	126k	if (in == NULL)
67	0	return NULL;
68	126k	len = asn1_d2i_read_bio(in, &b);
69	126k	if (len < 0)
70	11.2k	goto err;
71
72	114k	p = (const unsigned char *)b->data;
73	114k	ret = ASN1_item_d2i_ex(x, &p, len, it, libctx, propq);
74	126k	err:
75	126k	BUF_MEM_free(b);
76	126k	return ret;
77	114k	}
78
79		void ASN1_item_d2i_bio(const ASN1_ITEM it, BIO in, void x)
80	0	{
81	0	return ASN1_item_d2i_bio_ex(it, in, x, NULL, NULL);
82	0	}
83
84		#ifndef OPENSSL_NO_STDIO
85		void ASN1_item_d2i_fp_ex(const ASN1_ITEM it, FILE in, void x,
86		OSSL_LIB_CTX libctx, const char propq)
87	0	{
88	0	BIO *b;
89	0	char *ret;
90
91	0	if ((b = BIO_new(BIO_s_file())) == NULL) {
92	0	ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
93	0	return NULL;
94	0	}
95	0	BIO_set_fp(b, in, BIO_NOCLOSE);
96	0	ret = ASN1_item_d2i_bio_ex(it, b, x, libctx, propq);
97	0	BIO_free(b);
98	0	return ret;
99	0	}
100
101		void ASN1_item_d2i_fp(const ASN1_ITEM it, FILE in, void x)
102	0	{
103	0	return ASN1_item_d2i_fp_ex(it, in, x, NULL, NULL);
104	0	}
105		#endif
106
107	1.16G	#define HEADER_SIZE 2
108	353M	#define ASN1_CHUNK_INITIAL_SIZE (16 * 1024)
109		int asn1_d2i_read_bio(BIO in, BUF_MEM *pb)
110	5.02M	{
111	5.02M	BUF_MEM *b;
112	5.02M	unsigned char *p;
113	5.02M	size_t want = HEADER_SIZE;
114	5.02M	uint32_t eos = 0;
115	5.02M	size_t off = 0;
116	5.02M	size_t len = 0;
117	5.02M	size_t diff;
118
119	5.02M	const unsigned char *q;
120	5.02M	long slen;
121	5.02M	int inf, tag, xclass;
122
123	5.02M	b = BUF_MEM_new();
124	5.02M	if (b == NULL) {
125	0	ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
126	0	return -1;
127	0	}
128
129	5.02M	ERR_set_mark();
130	1.18G	for (;;) {
131	1.18G	diff = len - off;
132	1.18G	if (want >= diff) {
133	1.18G	int i;
134
135	1.18G	want -= diff;
136
137	1.18G	if (len + want < len \|\| !BUF_MEM_grow_clean(b, len + want)) {
138	0	ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
139	0	goto err;
140	0	}
141	1.18G	i = BIO_read(in, &(b->data[len]), (int)want);
142	1.18G	if (i <= 0) {
143		/*
144		* A read error (i < 0), an EOF in the middle of an object
145		* (diff != 0, some bytes already buffered), or an EOF while
146		* still inside an indefinite-length constructed value awaiting
147		* its end-of-contents octets (eos != 0) all mean the input is
148		* truncated. Only a clean EOF at a top-level object boundary
149		* (i == 0, diff == 0, eos == 0) is the normal end of input:
150		* fail without queuing an error so that callers looping over
151		* concatenated DER values (e.g. the libcrypto d2i_*_bio()
152		* consumers in CPython's ssl module) terminate cleanly instead
153		* of seeing a spurious ASN1_R_NOT_ENOUGH_DATA.
154		*/
155	214k	if (i < 0 \|\| diff != 0 \|\| eos != 0)
156	214k	ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
157	214k	goto err;
158	214k	}
159	1.18G	if (i > 0) {
160	1.18G	if (len + i < len) {
161	0	ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
162	0	goto err;
163	0	}
164	1.18G	len += i;
165	1.18G	if ((size_t)i < want)
166	69.2k	continue;
167	1.18G	}
168	1.18G	}
169		/* else data already loaded */
170
171		/* make sure there is enough data for a complete header */
172	1.18G	p = (unsigned char *)&(b->data[off]);
173	1.18G	q = p;
174	1.18G	diff = len - off;
175	1.18G	if (diff < 2) {
176		/* Failed sanity check */
177	0	ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
178	0	goto err;
179	0	}
180
181	1.18G	diff--;
182	1.18G	if ((*(q++) & V_ASN1_PRIMITIVE_TAG) == V_ASN1_PRIMITIVE_TAG) {
183	25.0M	unsigned int i = 0;
184		/* Multi-byte tag. See if we have the whole thing yet */
185	29.8M	do {
186	29.8M	if (i > 4) {
187		/* The tag value must fit into int */
188	17.9k	ERR_raise(ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG);
189	17.9k	goto err;
190	17.9k	}
191	29.8M	++i;
192	29.8M	diff--;
193	29.8M	} while (diff > 0 && *(q++) & 0x80);
194
195	24.9M	if (diff == 0) {
196		/*
197		* End of current data, will need at least 1 more byte for
198		* length. 2 if the tag is still incomplete
199		*/
200	12.7M	want = q - p + 2;
201	12.7M	if (*q & 0x80) {
202	3.41M	want++;
203	3.41M	}
204	12.7M	continue;
205	12.7M	}
206	24.9M	}
207
208		/* Check the length. This should also work for indefinite length */
209	1.17G	diff--;
210	1.17G	if (*q & 0x80) {
211	351M	unsigned int i = *q & 0x7f;
212
213	351M	if (i > sizeof(long)) {
214	77.1k	ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
215	77.1k	goto err;
216	77.1k	}
217	351M	if (i > diff) {
218	13.8M	want = q - p + i + 1;
219	13.8M	continue;
220	13.8M	}
221	351M	}
222
223		/*
224		* We have a complete header now, assuming we didn't hit EOF. Parse the
225		* tag and length
226		*/
227	1.16G	q = p;
228	1.16G	diff = len - off;
229	1.16G	inf = ASN1_get_object(&q, &slen, &tag, &xclass, (int)diff);
230	1.16G	if (inf & 0x80) {
231	353M	unsigned long e;
232
233	353M	e = ERR_GET_REASON(ERR_peek_last_error());
234	353M	if (e != ASN1_R_TOO_LONG)
235	22.1k	goto err;
236	353M	ERR_pop_to_mark();
237	353M	ERR_set_mark();
238	353M	}
239	1.16G	off += q - p; /* end of data */
240
241	1.16G	if (inf & 1) {
242		/* no data body so go round again */
243	324M	if (eos == UINT32_MAX) {
244	0	ERR_raise(ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG);
245	0	goto err;
246	0	}
247	324M	eos++;
248	324M	want = HEADER_SIZE;
249	838M	} else if (eos && (slen == 0) && (tag == V_ASN1_EOC)) {
250		/* eos value, so go back and read another header */
251	89.5M	eos--;
252	89.5M	if (eos == 0)
253	2.56M	break;
254	86.9M	else
255	86.9M	want = HEADER_SIZE;
256	748M	} else {
257		/* suck in slen bytes of data */
258	748M	want = slen;
259	748M	if (want > (len - off)) {
260	353M	size_t chunk_max = ASN1_CHUNK_INITIAL_SIZE;
261
262	353M	want -= (len - off);
263	353M	if (want > INT_MAX /* BIO_read takes an int length */ \|\| len + want < len) {
264	40.9k	ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
265	40.9k	goto err;
266	40.9k	}
267	706M	while (want > 0) {
268		/*
269		* Read content in chunks of increasing size
270		* so we can return an error for EOF without
271		* having to allocate the entire content length
272		* in one go.
273		*/
274	353M	size_t chunk = want > chunk_max ? chunk_max : want;
275	353M	int i;
276
277	353M	if (!BUF_MEM_grow_clean(b, len + chunk)) {
278	0	ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
279	0	goto err;
280	0	}
281	353M	want -= chunk;
282	707M	while (chunk > 0) {
283	353M	i = BIO_read(in, &(b->data[len]), (int)chunk);
284	353M	if (i <= 0) {
285	201k	ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
286	201k	goto err;
287	201k	}
288		/*
289		* This can't overflow because \|len+want\| didn't
290		* overflow.
291		*/
292	353M	len += i;
293	353M	chunk -= i;
294	353M	}
295	353M	if (chunk_max < INT_MAX / 2)
296	353M	chunk_max *= 2;
297	353M	}
298	353M	}
299	748M	if (off + slen < off) {
300	0	ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
301	0	goto err;
302	0	}
303	748M	off += slen;
304	748M	if (eos == 0) {
305	1.88M	break;
306	1.88M	} else
307	746M	want = HEADER_SIZE;
308	748M	}
309	1.16G	}
310
311	4.44M	if (off > INT_MAX) {
312	0	ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
313	0	goto err;
314	0	}
315
316	4.44M	*pb = b;
317	4.44M	ERR_clear_last_mark();
318	4.44M	return (int)off;
319	573k	err:
320	573k	ERR_clear_last_mark();
321	573k	BUF_MEM_free(b);
322	573k	return -1;
323	4.44M	}