/src/openssl/crypto/asn1/tasn_dec.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | #include <stddef.h> |
11 | | #include <string.h> |
12 | | #include <openssl/asn1.h> |
13 | | #include <openssl/asn1t.h> |
14 | | #include <openssl/objects.h> |
15 | | #include <openssl/buffer.h> |
16 | | #include <openssl/err.h> |
17 | | #include "internal/numbers.h" |
18 | | #include "asn1_local.h" |
19 | | |
20 | | /* |
21 | | * Constructed types with a recursive definition (such as can be found in PKCS7) |
22 | | * could eventually exceed the stack given malicious input with excessive |
23 | | * recursion. Therefore we limit the stack depth. This is the maximum number of |
24 | | * recursive invocations of asn1_item_embed_d2i(). |
25 | | */ |
26 | 45.2k | #define ASN1_MAX_CONSTRUCTED_NEST 30 |
27 | | |
28 | | static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in, |
29 | | long len, const ASN1_ITEM *it, |
30 | | int tag, int aclass, char opt, ASN1_TLC *ctx, |
31 | | int depth, OSSL_LIB_CTX *libctx, |
32 | | const char *propq); |
33 | | |
34 | | static int asn1_check_eoc(const unsigned char **in, long len); |
35 | | static int asn1_find_end(const unsigned char **in, long len, char inf); |
36 | | |
37 | | static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len, |
38 | | char inf, int tag, int aclass, int depth); |
39 | | |
40 | | static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen); |
41 | | |
42 | | static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass, |
43 | | char *inf, char *cst, |
44 | | const unsigned char **in, long len, |
45 | | int exptag, int expclass, char opt, ASN1_TLC *ctx); |
46 | | |
47 | | static int asn1_template_ex_d2i(ASN1_VALUE **pval, |
48 | | const unsigned char **in, long len, |
49 | | const ASN1_TEMPLATE *tt, char opt, |
50 | | ASN1_TLC *ctx, int depth, OSSL_LIB_CTX *libctx, |
51 | | const char *propq); |
52 | | static int asn1_template_noexp_d2i(ASN1_VALUE **val, |
53 | | const unsigned char **in, long len, |
54 | | const ASN1_TEMPLATE *tt, char opt, |
55 | | ASN1_TLC *ctx, int depth, |
56 | | OSSL_LIB_CTX *libctx, const char *propq); |
57 | | static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, |
58 | | const unsigned char **in, long len, |
59 | | const ASN1_ITEM *it, |
60 | | int tag, int aclass, char opt, |
61 | | ASN1_TLC *ctx); |
62 | | static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, |
63 | | int utype, char *free_cont, const ASN1_ITEM *it); |
64 | | |
65 | | /* Table to convert tags to bit values, used for MSTRING type */ |
66 | | static const unsigned long tag2bit[32] = { |
67 | | /* tags 0 - 3 */ |
68 | | 0, 0, 0, B_ASN1_BIT_STRING, |
69 | | /* tags 4- 7 */ |
70 | | B_ASN1_OCTET_STRING, 0, 0, B_ASN1_UNKNOWN, |
71 | | /* tags 8-11 */ |
72 | | B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, 0, B_ASN1_UNKNOWN, |
73 | | /* tags 12-15 */ |
74 | | B_ASN1_UTF8STRING, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, |
75 | | /* tags 16-19 */ |
76 | | B_ASN1_SEQUENCE, 0, B_ASN1_NUMERICSTRING, B_ASN1_PRINTABLESTRING, |
77 | | /* tags 20-22 */ |
78 | | B_ASN1_T61STRING, B_ASN1_VIDEOTEXSTRING, B_ASN1_IA5STRING, |
79 | | /* tags 23-24 */ |
80 | | B_ASN1_UTCTIME, B_ASN1_GENERALIZEDTIME, |
81 | | /* tags 25-27 */ |
82 | | B_ASN1_GRAPHICSTRING, B_ASN1_ISO64STRING, B_ASN1_GENERALSTRING, |
83 | | /* tags 28-31 */ |
84 | | B_ASN1_UNIVERSALSTRING, B_ASN1_UNKNOWN, B_ASN1_BMPSTRING, B_ASN1_UNKNOWN, |
85 | | }; |
86 | | |
87 | | unsigned long ASN1_tag2bit(int tag) |
88 | 0 | { |
89 | 0 | if ((tag < 0) || (tag > 30)) |
90 | 0 | return 0; |
91 | 0 | return tag2bit[tag]; |
92 | 0 | } |
93 | | |
94 | | /* Macro to initialize and invalidate the cache */ |
95 | | |
96 | 45.2k | #define asn1_tlc_clear(c) do { if ((c) != NULL) (c)->valid = 0; } while (0) |
97 | | /* Version to avoid compiler warning about 'c' always non-NULL */ |
98 | 16.0k | #define asn1_tlc_clear_nc(c) do {(c)->valid = 0; } while (0) |
99 | | |
100 | | /* |
101 | | * Decode an ASN1 item, this currently behaves just like a standard 'd2i' |
102 | | * function. 'in' points to a buffer to read the data from, in future we |
103 | | * will have more advanced versions that can input data a piece at a time and |
104 | | * this will simply be a special case. |
105 | | */ |
106 | | |
107 | | static int asn1_item_ex_d2i_intern(ASN1_VALUE **pval, const unsigned char **in, |
108 | | long len, const ASN1_ITEM *it, int tag, |
109 | | int aclass, char opt, ASN1_TLC *ctx, |
110 | | OSSL_LIB_CTX *libctx, const char *propq) |
111 | 16.0k | { |
112 | 16.0k | int rv; |
113 | | |
114 | 16.0k | if (pval == NULL || it == NULL) { |
115 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_PASSED_NULL_PARAMETER); |
116 | 0 | return 0; |
117 | 0 | } |
118 | 16.0k | rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx, 0, |
119 | 16.0k | libctx, propq); |
120 | 16.0k | if (rv <= 0) |
121 | 2.08k | ASN1_item_ex_free(pval, it); |
122 | 16.0k | return rv; |
123 | 16.0k | } |
124 | | |
125 | | int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, |
126 | | const ASN1_ITEM *it, |
127 | | int tag, int aclass, char opt, ASN1_TLC *ctx) |
128 | 0 | { |
129 | 0 | return asn1_item_ex_d2i_intern(pval, in, len, it, tag, aclass, opt, ctx, |
130 | 0 | NULL, NULL); |
131 | 0 | } |
132 | | |
133 | | ASN1_VALUE *ASN1_item_d2i_ex(ASN1_VALUE **pval, |
134 | | const unsigned char **in, long len, |
135 | | const ASN1_ITEM *it, OSSL_LIB_CTX *libctx, |
136 | | const char *propq) |
137 | 16.0k | { |
138 | 16.0k | ASN1_TLC c; |
139 | 16.0k | ASN1_VALUE *ptmpval = NULL; |
140 | | |
141 | 16.0k | if (pval == NULL) |
142 | 16.0k | pval = &ptmpval; |
143 | 16.0k | asn1_tlc_clear_nc(&c); |
144 | 16.0k | if (asn1_item_ex_d2i_intern(pval, in, len, it, -1, 0, 0, &c, libctx, |
145 | 16.0k | propq) > 0) |
146 | 13.9k | return *pval; |
147 | 2.08k | return NULL; |
148 | 16.0k | } |
149 | | |
150 | | ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval, |
151 | | const unsigned char **in, long len, |
152 | | const ASN1_ITEM *it) |
153 | 16.0k | { |
154 | 16.0k | return ASN1_item_d2i_ex(pval, in, len, it, NULL, NULL); |
155 | 16.0k | } |
156 | | |
157 | | /* |
158 | | * Decode an item, taking care of IMPLICIT tagging, if any. If 'opt' set and |
159 | | * tag mismatch return -1 to handle OPTIONAL |
160 | | */ |
161 | | |
162 | | static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in, |
163 | | long len, const ASN1_ITEM *it, |
164 | | int tag, int aclass, char opt, ASN1_TLC *ctx, |
165 | | int depth, OSSL_LIB_CTX *libctx, |
166 | | const char *propq) |
167 | 45.2k | { |
168 | 45.2k | const ASN1_TEMPLATE *tt, *errtt = NULL; |
169 | 45.2k | const ASN1_EXTERN_FUNCS *ef; |
170 | 45.2k | const ASN1_AUX *aux; |
171 | 45.2k | ASN1_aux_cb *asn1_cb; |
172 | 45.2k | const unsigned char *p = NULL, *q; |
173 | 45.2k | unsigned char oclass; |
174 | 45.2k | char seq_eoc, seq_nolen, cst, isopt; |
175 | 45.2k | long tmplen; |
176 | 45.2k | int i; |
177 | 45.2k | int otag; |
178 | 45.2k | int ret = 0; |
179 | 45.2k | ASN1_VALUE **pchptr; |
180 | | |
181 | 45.2k | if (pval == NULL || it == NULL) { |
182 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_PASSED_NULL_PARAMETER); |
183 | 0 | return 0; |
184 | 0 | } |
185 | 45.2k | if (len <= 0) { |
186 | 24 | ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_SMALL); |
187 | 24 | return 0; |
188 | 24 | } |
189 | 45.2k | aux = it->funcs; |
190 | 45.2k | if (aux && aux->asn1_cb) |
191 | 45.2k | asn1_cb = aux->asn1_cb; |
192 | 0 | else |
193 | 0 | asn1_cb = 0; |
194 | | |
195 | 45.2k | if (++depth > ASN1_MAX_CONSTRUCTED_NEST) { |
196 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_NESTED_TOO_DEEP); |
197 | 0 | goto err; |
198 | 0 | } |
199 | | |
200 | 45.2k | switch (it->itype) { |
201 | 29.2k | case ASN1_ITYPE_PRIMITIVE: |
202 | 29.2k | if (it->templates) { |
203 | | /* |
204 | | * tagging or OPTIONAL is currently illegal on an item template |
205 | | * because the flags can't get passed down. In practice this |
206 | | * isn't a problem: we include the relevant flags from the item |
207 | | * template in the template itself. |
208 | | */ |
209 | 0 | if ((tag != -1) || opt) { |
210 | 0 | ERR_raise(ERR_LIB_ASN1, |
211 | 0 | ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE); |
212 | 0 | goto err; |
213 | 0 | } |
214 | 0 | return asn1_template_ex_d2i(pval, in, len, it->templates, opt, ctx, |
215 | 0 | depth, libctx, propq); |
216 | 0 | } |
217 | 29.2k | return asn1_d2i_ex_primitive(pval, in, len, it, |
218 | 29.2k | tag, aclass, opt, ctx); |
219 | | |
220 | 0 | case ASN1_ITYPE_MSTRING: |
221 | | /* |
222 | | * It never makes sense for multi-strings to have implicit tagging, so |
223 | | * if tag != -1, then this looks like an error in the template. |
224 | | */ |
225 | 0 | if (tag != -1) { |
226 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_BAD_TEMPLATE); |
227 | 0 | goto err; |
228 | 0 | } |
229 | | |
230 | 0 | p = *in; |
231 | | /* Just read in tag and class */ |
232 | 0 | ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL, |
233 | 0 | &p, len, -1, 0, 1, ctx); |
234 | 0 | if (!ret) { |
235 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
236 | 0 | goto err; |
237 | 0 | } |
238 | | |
239 | | /* Must be UNIVERSAL class */ |
240 | 0 | if (oclass != V_ASN1_UNIVERSAL) { |
241 | | /* If OPTIONAL, assume this is OK */ |
242 | 0 | if (opt) |
243 | 0 | return -1; |
244 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_MSTRING_NOT_UNIVERSAL); |
245 | 0 | goto err; |
246 | 0 | } |
247 | | |
248 | | /* Check tag matches bit map */ |
249 | 0 | if (!(ASN1_tag2bit(otag) & it->utype)) { |
250 | | /* If OPTIONAL, assume this is OK */ |
251 | 0 | if (opt) |
252 | 0 | return -1; |
253 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_MSTRING_WRONG_TAG); |
254 | 0 | goto err; |
255 | 0 | } |
256 | 0 | return asn1_d2i_ex_primitive(pval, in, len, it, otag, 0, 0, ctx); |
257 | | |
258 | 0 | case ASN1_ITYPE_EXTERN: |
259 | | /* Use new style d2i */ |
260 | 0 | ef = it->funcs; |
261 | 0 | if (ef->asn1_ex_d2i_ex != NULL) |
262 | 0 | return ef->asn1_ex_d2i_ex(pval, in, len, it, tag, aclass, opt, ctx, |
263 | 0 | libctx, propq); |
264 | 0 | return ef->asn1_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx); |
265 | | |
266 | 0 | case ASN1_ITYPE_CHOICE: |
267 | | /* |
268 | | * It never makes sense for CHOICE types to have implicit tagging, so |
269 | | * if tag != -1, then this looks like an error in the template. |
270 | | */ |
271 | 0 | if (tag != -1) { |
272 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_BAD_TEMPLATE); |
273 | 0 | goto err; |
274 | 0 | } |
275 | | |
276 | 0 | if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL)) |
277 | 0 | goto auxerr; |
278 | 0 | if (*pval) { |
279 | | /* Free up and zero CHOICE value if initialised */ |
280 | 0 | i = ossl_asn1_get_choice_selector(pval, it); |
281 | 0 | if ((i >= 0) && (i < it->tcount)) { |
282 | 0 | tt = it->templates + i; |
283 | 0 | pchptr = ossl_asn1_get_field_ptr(pval, tt); |
284 | 0 | ossl_asn1_template_free(pchptr, tt); |
285 | 0 | ossl_asn1_set_choice_selector(pval, -1, it); |
286 | 0 | } |
287 | 0 | } else if (!ossl_asn1_item_ex_new_intern(pval, it, libctx, propq)) { |
288 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
289 | 0 | goto err; |
290 | 0 | } |
291 | | /* CHOICE type, try each possibility in turn */ |
292 | 0 | p = *in; |
293 | 0 | for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) { |
294 | 0 | pchptr = ossl_asn1_get_field_ptr(pval, tt); |
295 | | /* |
296 | | * We mark field as OPTIONAL so its absence can be recognised. |
297 | | */ |
298 | 0 | ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx, depth, |
299 | 0 | libctx, propq); |
300 | | /* If field not present, try the next one */ |
301 | 0 | if (ret == -1) |
302 | 0 | continue; |
303 | | /* If positive return, read OK, break loop */ |
304 | 0 | if (ret > 0) |
305 | 0 | break; |
306 | | /* |
307 | | * Must be an ASN1 parsing error. |
308 | | * Free up any partial choice value |
309 | | */ |
310 | 0 | ossl_asn1_template_free(pchptr, tt); |
311 | 0 | errtt = tt; |
312 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
313 | 0 | goto err; |
314 | 0 | } |
315 | | |
316 | | /* Did we fall off the end without reading anything? */ |
317 | 0 | if (i == it->tcount) { |
318 | | /* If OPTIONAL, this is OK */ |
319 | 0 | if (opt) { |
320 | | /* Free and zero it */ |
321 | 0 | ASN1_item_ex_free(pval, it); |
322 | 0 | return -1; |
323 | 0 | } |
324 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_NO_MATCHING_CHOICE_TYPE); |
325 | 0 | goto err; |
326 | 0 | } |
327 | | |
328 | 0 | ossl_asn1_set_choice_selector(pval, i, it); |
329 | |
|
330 | 0 | if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL)) |
331 | 0 | goto auxerr; |
332 | 0 | *in = p; |
333 | 0 | return 1; |
334 | | |
335 | 0 | case ASN1_ITYPE_NDEF_SEQUENCE: |
336 | 15.9k | case ASN1_ITYPE_SEQUENCE: |
337 | 15.9k | p = *in; |
338 | 15.9k | tmplen = len; |
339 | | |
340 | | /* If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL */ |
341 | 15.9k | if (tag == -1) { |
342 | 15.9k | tag = V_ASN1_SEQUENCE; |
343 | 15.9k | aclass = V_ASN1_UNIVERSAL; |
344 | 15.9k | } |
345 | | /* Get SEQUENCE length and update len, p */ |
346 | 15.9k | ret = asn1_check_tlen(&len, NULL, NULL, &seq_eoc, &cst, |
347 | 15.9k | &p, len, tag, aclass, opt, ctx); |
348 | 15.9k | if (!ret) { |
349 | 906 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
350 | 906 | goto err; |
351 | 15.0k | } else if (ret == -1) |
352 | 0 | return -1; |
353 | 15.0k | if (aux && (aux->flags & ASN1_AFLG_BROKEN)) { |
354 | 0 | len = tmplen - (p - *in); |
355 | 0 | seq_nolen = 1; |
356 | 0 | } |
357 | | /* If indefinite we don't do a length check */ |
358 | 15.0k | else |
359 | 15.0k | seq_nolen = seq_eoc; |
360 | 15.0k | if (!cst) { |
361 | 6 | ERR_raise(ERR_LIB_ASN1, ASN1_R_SEQUENCE_NOT_CONSTRUCTED); |
362 | 6 | goto err; |
363 | 6 | } |
364 | | |
365 | 15.0k | if (*pval == NULL |
366 | 15.0k | && !ossl_asn1_item_ex_new_intern(pval, it, libctx, propq)) { |
367 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
368 | 0 | goto err; |
369 | 0 | } |
370 | | |
371 | 15.0k | if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL)) |
372 | 0 | goto auxerr; |
373 | | |
374 | | /* Free up and zero any ADB found */ |
375 | 45.2k | for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) { |
376 | 30.1k | if (tt->flags & ASN1_TFLG_ADB_MASK) { |
377 | 0 | const ASN1_TEMPLATE *seqtt; |
378 | 0 | ASN1_VALUE **pseqval; |
379 | 0 | seqtt = ossl_asn1_do_adb(*pval, tt, 0); |
380 | 0 | if (seqtt == NULL) |
381 | 0 | continue; |
382 | 0 | pseqval = ossl_asn1_get_field_ptr(pval, seqtt); |
383 | 0 | ossl_asn1_template_free(pseqval, seqtt); |
384 | 0 | } |
385 | 30.1k | } |
386 | | |
387 | | /* Get each field entry */ |
388 | 43.9k | for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) { |
389 | 29.8k | const ASN1_TEMPLATE *seqtt; |
390 | 29.8k | ASN1_VALUE **pseqval; |
391 | 29.8k | seqtt = ossl_asn1_do_adb(*pval, tt, 1); |
392 | 29.8k | if (seqtt == NULL) |
393 | 0 | goto err; |
394 | 29.8k | pseqval = ossl_asn1_get_field_ptr(pval, seqtt); |
395 | | /* Have we ran out of data? */ |
396 | 29.8k | if (!len) |
397 | 513 | break; |
398 | 29.3k | q = p; |
399 | 29.3k | if (asn1_check_eoc(&p, len)) { |
400 | 36 | if (!seq_eoc) { |
401 | 3 | ERR_raise(ERR_LIB_ASN1, ASN1_R_UNEXPECTED_EOC); |
402 | 3 | goto err; |
403 | 3 | } |
404 | 33 | len -= p - q; |
405 | 33 | seq_eoc = 0; |
406 | 33 | break; |
407 | 36 | } |
408 | | /* |
409 | | * This determines the OPTIONAL flag value. The field cannot be |
410 | | * omitted if it is the last of a SEQUENCE and there is still |
411 | | * data to be read. This isn't strictly necessary but it |
412 | | * increases efficiency in some cases. |
413 | | */ |
414 | 29.2k | if (i == (it->tcount - 1)) |
415 | 14.2k | isopt = 0; |
416 | 14.9k | else |
417 | 14.9k | isopt = (char)(seqtt->flags & ASN1_TFLG_OPTIONAL); |
418 | | /* |
419 | | * attempt to read in field, allowing each to be OPTIONAL |
420 | | */ |
421 | | |
422 | 29.2k | ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx, |
423 | 29.2k | depth, libctx, propq); |
424 | 29.2k | if (!ret) { |
425 | 420 | errtt = seqtt; |
426 | 420 | goto err; |
427 | 28.8k | } else if (ret == -1) { |
428 | | /* |
429 | | * OPTIONAL component absent. Free and zero the field. |
430 | | */ |
431 | 0 | ossl_asn1_template_free(pseqval, seqtt); |
432 | 0 | continue; |
433 | 0 | } |
434 | | /* Update length */ |
435 | 28.8k | len -= p - q; |
436 | 28.8k | } |
437 | | |
438 | | /* Check for EOC if expecting one */ |
439 | 14.6k | if (seq_eoc && !asn1_check_eoc(&p, len)) { |
440 | 609 | ERR_raise(ERR_LIB_ASN1, ASN1_R_MISSING_EOC); |
441 | 609 | goto err; |
442 | 609 | } |
443 | | /* Check all data read */ |
444 | 14.0k | if (!seq_nolen && len) { |
445 | 9 | ERR_raise(ERR_LIB_ASN1, ASN1_R_SEQUENCE_LENGTH_MISMATCH); |
446 | 9 | goto err; |
447 | 9 | } |
448 | | |
449 | | /* |
450 | | * If we get here we've got no more data in the SEQUENCE, however we |
451 | | * may not have read all fields so check all remaining are OPTIONAL |
452 | | * and clear any that are. |
453 | | */ |
454 | 14.0k | for (; i < it->tcount; tt++, i++) { |
455 | 108 | const ASN1_TEMPLATE *seqtt; |
456 | 108 | seqtt = ossl_asn1_do_adb(*pval, tt, 1); |
457 | 108 | if (seqtt == NULL) |
458 | 0 | goto err; |
459 | 108 | if (seqtt->flags & ASN1_TFLG_OPTIONAL) { |
460 | 0 | ASN1_VALUE **pseqval; |
461 | 0 | pseqval = ossl_asn1_get_field_ptr(pval, seqtt); |
462 | 0 | ossl_asn1_template_free(pseqval, seqtt); |
463 | 108 | } else { |
464 | 108 | errtt = seqtt; |
465 | 108 | ERR_raise(ERR_LIB_ASN1, ASN1_R_FIELD_MISSING); |
466 | 108 | goto err; |
467 | 108 | } |
468 | 108 | } |
469 | | /* Save encoding */ |
470 | 13.9k | if (!ossl_asn1_enc_save(pval, *in, p - *in, it)) |
471 | 0 | goto auxerr; |
472 | 13.9k | if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL)) |
473 | 0 | goto auxerr; |
474 | 13.9k | *in = p; |
475 | 13.9k | return 1; |
476 | | |
477 | 0 | default: |
478 | 0 | return 0; |
479 | 45.2k | } |
480 | 0 | auxerr: |
481 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_AUX_ERROR); |
482 | 2.06k | err: |
483 | 2.06k | if (errtt) |
484 | 528 | ERR_add_error_data(4, "Field=", errtt->field_name, |
485 | 528 | ", Type=", it->sname); |
486 | 1.53k | else |
487 | 1.53k | ERR_add_error_data(2, "Type=", it->sname); |
488 | 2.06k | return 0; |
489 | 0 | } |
490 | | |
491 | | /* |
492 | | * Templates are handled with two separate functions. One handles any |
493 | | * EXPLICIT tag and the other handles the rest. |
494 | | */ |
495 | | |
496 | | static int asn1_template_ex_d2i(ASN1_VALUE **val, |
497 | | const unsigned char **in, long inlen, |
498 | | const ASN1_TEMPLATE *tt, char opt, |
499 | | ASN1_TLC *ctx, int depth, |
500 | | OSSL_LIB_CTX *libctx, const char *propq) |
501 | 29.2k | { |
502 | 29.2k | int flags, aclass; |
503 | 29.2k | int ret; |
504 | 29.2k | long len; |
505 | 29.2k | const unsigned char *p, *q; |
506 | 29.2k | char exp_eoc; |
507 | 29.2k | if (!val) |
508 | 0 | return 0; |
509 | 29.2k | flags = tt->flags; |
510 | 29.2k | aclass = flags & ASN1_TFLG_TAG_CLASS; |
511 | | |
512 | 29.2k | p = *in; |
513 | | |
514 | | /* Check if EXPLICIT tag expected */ |
515 | 29.2k | if (flags & ASN1_TFLG_EXPTAG) { |
516 | 0 | char cst; |
517 | | /* |
518 | | * Need to work out amount of data available to the inner content and |
519 | | * where it starts: so read in EXPLICIT header to get the info. |
520 | | */ |
521 | 0 | ret = asn1_check_tlen(&len, NULL, NULL, &exp_eoc, &cst, |
522 | 0 | &p, inlen, tt->tag, aclass, opt, ctx); |
523 | 0 | q = p; |
524 | 0 | if (!ret) { |
525 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
526 | 0 | return 0; |
527 | 0 | } else if (ret == -1) |
528 | 0 | return -1; |
529 | 0 | if (!cst) { |
530 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED); |
531 | 0 | return 0; |
532 | 0 | } |
533 | | /* We've found the field so it can't be OPTIONAL now */ |
534 | 0 | ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx, depth, libctx, |
535 | 0 | propq); |
536 | 0 | if (!ret) { |
537 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
538 | 0 | return 0; |
539 | 0 | } |
540 | | /* We read the field in OK so update length */ |
541 | 0 | len -= p - q; |
542 | 0 | if (exp_eoc) { |
543 | | /* If NDEF we must have an EOC here */ |
544 | 0 | if (!asn1_check_eoc(&p, len)) { |
545 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_MISSING_EOC); |
546 | 0 | goto err; |
547 | 0 | } |
548 | 0 | } else { |
549 | | /* |
550 | | * Otherwise we must hit the EXPLICIT tag end or its an error |
551 | | */ |
552 | 0 | if (len) { |
553 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_EXPLICIT_LENGTH_MISMATCH); |
554 | 0 | goto err; |
555 | 0 | } |
556 | 0 | } |
557 | 0 | } else |
558 | 29.2k | return asn1_template_noexp_d2i(val, in, inlen, tt, opt, ctx, depth, |
559 | 29.2k | libctx, propq); |
560 | | |
561 | 0 | *in = p; |
562 | 0 | return 1; |
563 | | |
564 | 0 | err: |
565 | 0 | return 0; |
566 | 29.2k | } |
567 | | |
568 | | static int asn1_template_noexp_d2i(ASN1_VALUE **val, |
569 | | const unsigned char **in, long len, |
570 | | const ASN1_TEMPLATE *tt, char opt, |
571 | | ASN1_TLC *ctx, int depth, |
572 | | OSSL_LIB_CTX *libctx, const char *propq) |
573 | 29.2k | { |
574 | 29.2k | int flags, aclass; |
575 | 29.2k | int ret; |
576 | 29.2k | ASN1_VALUE *tval; |
577 | 29.2k | const unsigned char *p, *q; |
578 | 29.2k | if (!val) |
579 | 0 | return 0; |
580 | 29.2k | flags = tt->flags; |
581 | 29.2k | aclass = flags & ASN1_TFLG_TAG_CLASS; |
582 | | |
583 | 29.2k | p = *in; |
584 | | |
585 | | /* |
586 | | * If field is embedded then val needs fixing so it is a pointer to |
587 | | * a pointer to a field. |
588 | | */ |
589 | 29.2k | if (tt->flags & ASN1_TFLG_EMBED) { |
590 | 0 | tval = (ASN1_VALUE *)val; |
591 | 0 | val = &tval; |
592 | 0 | } |
593 | | |
594 | 29.2k | if (flags & ASN1_TFLG_SK_MASK) { |
595 | | /* SET OF, SEQUENCE OF */ |
596 | 0 | int sktag, skaclass; |
597 | 0 | char sk_eoc; |
598 | | /* First work out expected inner tag value */ |
599 | 0 | if (flags & ASN1_TFLG_IMPTAG) { |
600 | 0 | sktag = tt->tag; |
601 | 0 | skaclass = aclass; |
602 | 0 | } else { |
603 | 0 | skaclass = V_ASN1_UNIVERSAL; |
604 | 0 | if (flags & ASN1_TFLG_SET_OF) |
605 | 0 | sktag = V_ASN1_SET; |
606 | 0 | else |
607 | 0 | sktag = V_ASN1_SEQUENCE; |
608 | 0 | } |
609 | | /* Get the tag */ |
610 | 0 | ret = asn1_check_tlen(&len, NULL, NULL, &sk_eoc, NULL, |
611 | 0 | &p, len, sktag, skaclass, opt, ctx); |
612 | 0 | if (!ret) { |
613 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
614 | 0 | return 0; |
615 | 0 | } else if (ret == -1) |
616 | 0 | return -1; |
617 | 0 | if (*val == NULL) |
618 | 0 | *val = (ASN1_VALUE *)sk_ASN1_VALUE_new_null(); |
619 | 0 | else { |
620 | | /* |
621 | | * We've got a valid STACK: free up any items present |
622 | | */ |
623 | 0 | STACK_OF(ASN1_VALUE) *sktmp = (STACK_OF(ASN1_VALUE) *)*val; |
624 | 0 | ASN1_VALUE *vtmp; |
625 | 0 | while (sk_ASN1_VALUE_num(sktmp) > 0) { |
626 | 0 | vtmp = sk_ASN1_VALUE_pop(sktmp); |
627 | 0 | ASN1_item_ex_free(&vtmp, ASN1_ITEM_ptr(tt->item)); |
628 | 0 | } |
629 | 0 | } |
630 | |
|
631 | 0 | if (*val == NULL) { |
632 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_CRYPTO_LIB); |
633 | 0 | goto err; |
634 | 0 | } |
635 | | |
636 | | /* Read as many items as we can */ |
637 | 0 | while (len > 0) { |
638 | 0 | ASN1_VALUE *skfield; |
639 | 0 | q = p; |
640 | | /* See if EOC found */ |
641 | 0 | if (asn1_check_eoc(&p, len)) { |
642 | 0 | if (!sk_eoc) { |
643 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_UNEXPECTED_EOC); |
644 | 0 | goto err; |
645 | 0 | } |
646 | 0 | len -= p - q; |
647 | 0 | sk_eoc = 0; |
648 | 0 | break; |
649 | 0 | } |
650 | 0 | skfield = NULL; |
651 | 0 | if (asn1_item_embed_d2i(&skfield, &p, len, |
652 | 0 | ASN1_ITEM_ptr(tt->item), -1, 0, 0, ctx, |
653 | 0 | depth, libctx, propq) <= 0) { |
654 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
655 | | /* |skfield| may be partially allocated despite failure. */ |
656 | 0 | ASN1_item_free(skfield, ASN1_ITEM_ptr(tt->item)); |
657 | 0 | goto err; |
658 | 0 | } |
659 | 0 | len -= p - q; |
660 | 0 | if (!sk_ASN1_VALUE_push((STACK_OF(ASN1_VALUE) *)*val, skfield)) { |
661 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_CRYPTO_LIB); |
662 | 0 | ASN1_item_free(skfield, ASN1_ITEM_ptr(tt->item)); |
663 | 0 | goto err; |
664 | 0 | } |
665 | 0 | } |
666 | 0 | if (sk_eoc) { |
667 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_MISSING_EOC); |
668 | 0 | goto err; |
669 | 0 | } |
670 | 29.2k | } else if (flags & ASN1_TFLG_IMPTAG) { |
671 | | /* IMPLICIT tagging */ |
672 | 0 | ret = asn1_item_embed_d2i(val, &p, len, |
673 | 0 | ASN1_ITEM_ptr(tt->item), tt->tag, aclass, opt, |
674 | 0 | ctx, depth, libctx, propq); |
675 | 0 | if (!ret) { |
676 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
677 | 0 | goto err; |
678 | 0 | } else if (ret == -1) |
679 | 0 | return -1; |
680 | 29.2k | } else { |
681 | | /* Nothing special */ |
682 | 29.2k | ret = asn1_item_embed_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item), |
683 | 29.2k | -1, 0, opt, ctx, depth, libctx, propq); |
684 | 29.2k | if (!ret) { |
685 | 420 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
686 | 420 | goto err; |
687 | 28.8k | } else if (ret == -1) |
688 | 0 | return -1; |
689 | 29.2k | } |
690 | | |
691 | 28.8k | *in = p; |
692 | 28.8k | return 1; |
693 | | |
694 | 420 | err: |
695 | 420 | return 0; |
696 | 29.2k | } |
697 | | |
698 | | static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, |
699 | | const unsigned char **in, long inlen, |
700 | | const ASN1_ITEM *it, |
701 | | int tag, int aclass, char opt, ASN1_TLC *ctx) |
702 | 29.2k | { |
703 | 29.2k | int ret = 0, utype; |
704 | 29.2k | long plen; |
705 | 29.2k | char cst, inf, free_cont = 0; |
706 | 29.2k | const unsigned char *p; |
707 | 29.2k | BUF_MEM buf = { 0, NULL, 0, 0 }; |
708 | 29.2k | const unsigned char *cont = NULL; |
709 | 29.2k | long len; |
710 | | |
711 | 29.2k | if (pval == NULL) { |
712 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_ILLEGAL_NULL); |
713 | 0 | return 0; /* Should never happen */ |
714 | 0 | } |
715 | | |
716 | 29.2k | if (it->itype == ASN1_ITYPE_MSTRING) { |
717 | 0 | utype = tag; |
718 | 0 | tag = -1; |
719 | 0 | } else |
720 | 29.2k | utype = it->utype; |
721 | | |
722 | 29.2k | if (utype == V_ASN1_ANY) { |
723 | | /* If type is ANY need to figure out type from tag */ |
724 | 0 | unsigned char oclass; |
725 | 0 | if (tag >= 0) { |
726 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_ILLEGAL_TAGGED_ANY); |
727 | 0 | return 0; |
728 | 0 | } |
729 | 0 | if (opt) { |
730 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_ILLEGAL_OPTIONAL_ANY); |
731 | 0 | return 0; |
732 | 0 | } |
733 | 0 | p = *in; |
734 | 0 | ret = asn1_check_tlen(NULL, &utype, &oclass, NULL, NULL, |
735 | 0 | &p, inlen, -1, 0, 0, ctx); |
736 | 0 | if (!ret) { |
737 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
738 | 0 | return 0; |
739 | 0 | } |
740 | 0 | if (oclass != V_ASN1_UNIVERSAL) |
741 | 0 | utype = V_ASN1_OTHER; |
742 | 0 | } |
743 | 29.2k | if (tag == -1) { |
744 | 29.2k | tag = utype; |
745 | 29.2k | aclass = V_ASN1_UNIVERSAL; |
746 | 29.2k | } |
747 | 29.2k | p = *in; |
748 | | /* Check header */ |
749 | 29.2k | ret = asn1_check_tlen(&plen, NULL, NULL, &inf, &cst, |
750 | 29.2k | &p, inlen, tag, aclass, opt, ctx); |
751 | 29.2k | if (!ret) { |
752 | 402 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
753 | 402 | return 0; |
754 | 28.8k | } else if (ret == -1) |
755 | 0 | return -1; |
756 | 28.8k | ret = 0; |
757 | | /* SEQUENCE, SET and "OTHER" are left in encoded form */ |
758 | 28.8k | if ((utype == V_ASN1_SEQUENCE) |
759 | 28.8k | || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER)) { |
760 | | /* |
761 | | * Clear context cache for type OTHER because the auto clear when we |
762 | | * have a exact match won't work |
763 | | */ |
764 | 0 | if (utype == V_ASN1_OTHER) { |
765 | 0 | asn1_tlc_clear(ctx); |
766 | 0 | } |
767 | | /* SEQUENCE and SET must be constructed */ |
768 | 0 | else if (!cst) { |
769 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_TYPE_NOT_CONSTRUCTED); |
770 | 0 | return 0; |
771 | 0 | } |
772 | | |
773 | 0 | cont = *in; |
774 | | /* If indefinite length constructed find the real end */ |
775 | 0 | if (inf) { |
776 | 0 | if (!asn1_find_end(&p, plen, inf)) |
777 | 0 | goto err; |
778 | 0 | len = p - cont; |
779 | 0 | } else { |
780 | 0 | len = p - cont + plen; |
781 | 0 | p += plen; |
782 | 0 | } |
783 | 28.8k | } else if (cst) { |
784 | 18 | if (utype == V_ASN1_NULL || utype == V_ASN1_BOOLEAN |
785 | 18 | || utype == V_ASN1_OBJECT || utype == V_ASN1_INTEGER |
786 | 18 | || utype == V_ASN1_ENUMERATED) { |
787 | 18 | ERR_raise(ERR_LIB_ASN1, ASN1_R_TYPE_NOT_PRIMITIVE); |
788 | 18 | return 0; |
789 | 18 | } |
790 | | |
791 | | /* Free any returned 'buf' content */ |
792 | 0 | free_cont = 1; |
793 | | /* |
794 | | * Should really check the internal tags are correct but some things |
795 | | * may get this wrong. The relevant specs say that constructed string |
796 | | * types should be OCTET STRINGs internally irrespective of the type. |
797 | | * So instead just check for UNIVERSAL class and ignore the tag. |
798 | | */ |
799 | 0 | if (!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL, 0)) { |
800 | 0 | goto err; |
801 | 0 | } |
802 | 0 | len = buf.length; |
803 | | /* Append a final null to string */ |
804 | 0 | if (!BUF_MEM_grow_clean(&buf, len + 1)) { |
805 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB); |
806 | 0 | goto err; |
807 | 0 | } |
808 | 0 | buf.data[len] = 0; |
809 | 0 | cont = (const unsigned char *)buf.data; |
810 | 28.8k | } else { |
811 | 28.8k | cont = p; |
812 | 28.8k | len = plen; |
813 | 28.8k | p += plen; |
814 | 28.8k | } |
815 | | |
816 | | /* We now have content length and type: translate into a structure */ |
817 | | /* asn1_ex_c2i may reuse allocated buffer, and so sets free_cont to 0 */ |
818 | 28.8k | if (!asn1_ex_c2i(pval, cont, len, utype, &free_cont, it)) |
819 | 0 | goto err; |
820 | | |
821 | 28.8k | *in = p; |
822 | 28.8k | ret = 1; |
823 | 28.8k | err: |
824 | 28.8k | if (free_cont) |
825 | 0 | OPENSSL_free(buf.data); |
826 | 28.8k | return ret; |
827 | 28.8k | } |
828 | | |
829 | | /* Translate ASN1 content octets into a structure */ |
830 | | |
831 | | static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, |
832 | | int utype, char *free_cont, const ASN1_ITEM *it) |
833 | 28.8k | { |
834 | 28.8k | ASN1_VALUE **opval = NULL; |
835 | 28.8k | ASN1_STRING *stmp; |
836 | 28.8k | ASN1_TYPE *typ = NULL; |
837 | 28.8k | int ret = 0; |
838 | 28.8k | const ASN1_PRIMITIVE_FUNCS *pf; |
839 | 28.8k | ASN1_INTEGER **tint; |
840 | 28.8k | pf = it->funcs; |
841 | | |
842 | 28.8k | if (pf && pf->prim_c2i) |
843 | 28.8k | return pf->prim_c2i(pval, cont, len, utype, free_cont, it); |
844 | | /* If ANY type clear type and set pointer to internal value */ |
845 | 0 | if (it->utype == V_ASN1_ANY) { |
846 | 0 | if (*pval == NULL) { |
847 | 0 | typ = ASN1_TYPE_new(); |
848 | 0 | if (typ == NULL) |
849 | 0 | goto err; |
850 | 0 | *pval = (ASN1_VALUE *)typ; |
851 | 0 | } else |
852 | 0 | typ = (ASN1_TYPE *)*pval; |
853 | | |
854 | 0 | if (utype != typ->type) |
855 | 0 | ASN1_TYPE_set(typ, utype, NULL); |
856 | 0 | opval = pval; |
857 | 0 | pval = &typ->value.asn1_value; |
858 | 0 | } |
859 | 0 | switch (utype) { |
860 | 0 | case V_ASN1_OBJECT: |
861 | 0 | if (!ossl_c2i_ASN1_OBJECT((ASN1_OBJECT **)pval, &cont, len)) |
862 | 0 | goto err; |
863 | 0 | break; |
864 | | |
865 | 0 | case V_ASN1_NULL: |
866 | 0 | if (len) { |
867 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_NULL_IS_WRONG_LENGTH); |
868 | 0 | goto err; |
869 | 0 | } |
870 | 0 | *pval = (ASN1_VALUE *)1; |
871 | 0 | break; |
872 | | |
873 | 0 | case V_ASN1_BOOLEAN: |
874 | 0 | if (len != 1) { |
875 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_BOOLEAN_IS_WRONG_LENGTH); |
876 | 0 | goto err; |
877 | 0 | } else { |
878 | 0 | ASN1_BOOLEAN *tbool; |
879 | 0 | tbool = (ASN1_BOOLEAN *)pval; |
880 | 0 | *tbool = *cont; |
881 | 0 | } |
882 | 0 | break; |
883 | | |
884 | 0 | case V_ASN1_BIT_STRING: |
885 | 0 | if (!ossl_c2i_ASN1_BIT_STRING((ASN1_BIT_STRING **)pval, &cont, len)) |
886 | 0 | goto err; |
887 | 0 | break; |
888 | | |
889 | 0 | case V_ASN1_INTEGER: |
890 | 0 | case V_ASN1_ENUMERATED: |
891 | 0 | tint = (ASN1_INTEGER **)pval; |
892 | 0 | if (!ossl_c2i_ASN1_INTEGER(tint, &cont, len)) |
893 | 0 | goto err; |
894 | | /* Fixup type to match the expected form */ |
895 | 0 | (*tint)->type = utype | ((*tint)->type & V_ASN1_NEG); |
896 | 0 | break; |
897 | | |
898 | 0 | case V_ASN1_OCTET_STRING: |
899 | 0 | case V_ASN1_NUMERICSTRING: |
900 | 0 | case V_ASN1_PRINTABLESTRING: |
901 | 0 | case V_ASN1_T61STRING: |
902 | 0 | case V_ASN1_VIDEOTEXSTRING: |
903 | 0 | case V_ASN1_IA5STRING: |
904 | 0 | case V_ASN1_UTCTIME: |
905 | 0 | case V_ASN1_GENERALIZEDTIME: |
906 | 0 | case V_ASN1_GRAPHICSTRING: |
907 | 0 | case V_ASN1_VISIBLESTRING: |
908 | 0 | case V_ASN1_GENERALSTRING: |
909 | 0 | case V_ASN1_UNIVERSALSTRING: |
910 | 0 | case V_ASN1_BMPSTRING: |
911 | 0 | case V_ASN1_UTF8STRING: |
912 | 0 | case V_ASN1_OTHER: |
913 | 0 | case V_ASN1_SET: |
914 | 0 | case V_ASN1_SEQUENCE: |
915 | 0 | default: |
916 | 0 | if (utype == V_ASN1_BMPSTRING && (len & 1)) { |
917 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_BMPSTRING_IS_WRONG_LENGTH); |
918 | 0 | goto err; |
919 | 0 | } |
920 | 0 | if (utype == V_ASN1_UNIVERSALSTRING && (len & 3)) { |
921 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH); |
922 | 0 | goto err; |
923 | 0 | } |
924 | | /* All based on ASN1_STRING and handled the same */ |
925 | 0 | if (*pval == NULL) { |
926 | 0 | stmp = ASN1_STRING_type_new(utype); |
927 | 0 | if (stmp == NULL) { |
928 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB); |
929 | 0 | goto err; |
930 | 0 | } |
931 | 0 | *pval = (ASN1_VALUE *)stmp; |
932 | 0 | } else { |
933 | 0 | stmp = (ASN1_STRING *)*pval; |
934 | 0 | stmp->type = utype; |
935 | 0 | } |
936 | | /* If we've already allocated a buffer use it */ |
937 | 0 | if (*free_cont) { |
938 | 0 | ASN1_STRING_set0(stmp, (unsigned char *)cont /* UGLY CAST! */, len); |
939 | 0 | *free_cont = 0; |
940 | 0 | } else { |
941 | 0 | if (!ASN1_STRING_set(stmp, cont, len)) { |
942 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB); |
943 | 0 | ASN1_STRING_free(stmp); |
944 | 0 | *pval = NULL; |
945 | 0 | goto err; |
946 | 0 | } |
947 | 0 | } |
948 | 0 | break; |
949 | 0 | } |
950 | | /* If ASN1_ANY and NULL type fix up value */ |
951 | 0 | if (typ && (utype == V_ASN1_NULL)) |
952 | 0 | typ->value.ptr = NULL; |
953 | |
|
954 | 0 | ret = 1; |
955 | 0 | err: |
956 | 0 | if (!ret) { |
957 | 0 | ASN1_TYPE_free(typ); |
958 | 0 | if (opval) |
959 | 0 | *opval = NULL; |
960 | 0 | } |
961 | 0 | return ret; |
962 | 0 | } |
963 | | |
964 | | /* |
965 | | * This function finds the end of an ASN1 structure when passed its maximum |
966 | | * length, whether it is indefinite length and a pointer to the content. This |
967 | | * is more efficient than calling asn1_collect because it does not recurse on |
968 | | * each indefinite length header. |
969 | | */ |
970 | | |
971 | | static int asn1_find_end(const unsigned char **in, long len, char inf) |
972 | 0 | { |
973 | 0 | uint32_t expected_eoc; |
974 | 0 | long plen; |
975 | 0 | const unsigned char *p = *in, *q; |
976 | | /* If not indefinite length constructed just add length */ |
977 | 0 | if (inf == 0) { |
978 | 0 | *in += len; |
979 | 0 | return 1; |
980 | 0 | } |
981 | 0 | expected_eoc = 1; |
982 | | /* |
983 | | * Indefinite length constructed form. Find the end when enough EOCs are |
984 | | * found. If more indefinite length constructed headers are encountered |
985 | | * increment the expected eoc count otherwise just skip to the end of the |
986 | | * data. |
987 | | */ |
988 | 0 | while (len > 0) { |
989 | 0 | if (asn1_check_eoc(&p, len)) { |
990 | 0 | expected_eoc--; |
991 | 0 | if (expected_eoc == 0) |
992 | 0 | break; |
993 | 0 | len -= 2; |
994 | 0 | continue; |
995 | 0 | } |
996 | 0 | q = p; |
997 | | /* Just read in a header: only care about the length */ |
998 | 0 | if (!asn1_check_tlen(&plen, NULL, NULL, &inf, NULL, &p, len, |
999 | 0 | -1, 0, 0, NULL)) { |
1000 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
1001 | 0 | return 0; |
1002 | 0 | } |
1003 | 0 | if (inf) { |
1004 | 0 | if (expected_eoc == UINT32_MAX) { |
1005 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
1006 | 0 | return 0; |
1007 | 0 | } |
1008 | 0 | expected_eoc++; |
1009 | 0 | } else { |
1010 | 0 | p += plen; |
1011 | 0 | } |
1012 | 0 | len -= p - q; |
1013 | 0 | } |
1014 | 0 | if (expected_eoc) { |
1015 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_MISSING_EOC); |
1016 | 0 | return 0; |
1017 | 0 | } |
1018 | 0 | *in = p; |
1019 | 0 | return 1; |
1020 | 0 | } |
1021 | | |
1022 | | /* |
1023 | | * This function collects the asn1 data from a constructed string type into |
1024 | | * a buffer. The values of 'in' and 'len' should refer to the contents of the |
1025 | | * constructed type and 'inf' should be set if it is indefinite length. |
1026 | | */ |
1027 | | |
1028 | | #ifndef ASN1_MAX_STRING_NEST |
1029 | | /* |
1030 | | * This determines how many levels of recursion are permitted in ASN1 string |
1031 | | * types. If it is not limited stack overflows can occur. If set to zero no |
1032 | | * recursion is allowed at all. Although zero should be adequate examples |
1033 | | * exist that require a value of 1. So 5 should be more than enough. |
1034 | | */ |
1035 | 0 | # define ASN1_MAX_STRING_NEST 5 |
1036 | | #endif |
1037 | | |
1038 | | static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len, |
1039 | | char inf, int tag, int aclass, int depth) |
1040 | 0 | { |
1041 | 0 | const unsigned char *p, *q; |
1042 | 0 | long plen; |
1043 | 0 | char cst, ininf; |
1044 | 0 | p = *in; |
1045 | 0 | inf &= 1; |
1046 | | /* |
1047 | | * If no buffer and not indefinite length constructed just pass over the |
1048 | | * encoded data |
1049 | | */ |
1050 | 0 | if (!buf && !inf) { |
1051 | 0 | *in += len; |
1052 | 0 | return 1; |
1053 | 0 | } |
1054 | 0 | while (len > 0) { |
1055 | 0 | q = p; |
1056 | | /* Check for EOC */ |
1057 | 0 | if (asn1_check_eoc(&p, len)) { |
1058 | | /* |
1059 | | * EOC is illegal outside indefinite length constructed form |
1060 | | */ |
1061 | 0 | if (!inf) { |
1062 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_UNEXPECTED_EOC); |
1063 | 0 | return 0; |
1064 | 0 | } |
1065 | 0 | inf = 0; |
1066 | 0 | break; |
1067 | 0 | } |
1068 | | |
1069 | 0 | if (!asn1_check_tlen(&plen, NULL, NULL, &ininf, &cst, &p, |
1070 | 0 | len, tag, aclass, 0, NULL)) { |
1071 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR); |
1072 | 0 | return 0; |
1073 | 0 | } |
1074 | | |
1075 | | /* If indefinite length constructed update max length */ |
1076 | 0 | if (cst) { |
1077 | 0 | if (depth >= ASN1_MAX_STRING_NEST) { |
1078 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_NESTED_ASN1_STRING); |
1079 | 0 | return 0; |
1080 | 0 | } |
1081 | 0 | if (!asn1_collect(buf, &p, plen, ininf, tag, aclass, depth + 1)) |
1082 | 0 | return 0; |
1083 | 0 | } else if (plen && !collect_data(buf, &p, plen)) |
1084 | 0 | return 0; |
1085 | 0 | len -= p - q; |
1086 | 0 | } |
1087 | 0 | if (inf) { |
1088 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_MISSING_EOC); |
1089 | 0 | return 0; |
1090 | 0 | } |
1091 | 0 | *in = p; |
1092 | 0 | return 1; |
1093 | 0 | } |
1094 | | |
1095 | | static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen) |
1096 | 0 | { |
1097 | 0 | int len; |
1098 | 0 | if (buf) { |
1099 | 0 | len = buf->length; |
1100 | 0 | if (!BUF_MEM_grow_clean(buf, len + plen)) { |
1101 | 0 | ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB); |
1102 | 0 | return 0; |
1103 | 0 | } |
1104 | 0 | memcpy(buf->data + len, *p, plen); |
1105 | 0 | } |
1106 | 0 | *p += plen; |
1107 | 0 | return 1; |
1108 | 0 | } |
1109 | | |
1110 | | /* Check for ASN1 EOC and swallow it if found */ |
1111 | | |
1112 | | static int asn1_check_eoc(const unsigned char **in, long len) |
1113 | 41.0k | { |
1114 | 41.0k | const unsigned char *p; |
1115 | | |
1116 | 41.0k | if (len < 2) |
1117 | 657 | return 0; |
1118 | 40.4k | p = *in; |
1119 | 40.4k | if (p[0] == '\0' && p[1] == '\0') { |
1120 | 11.1k | *in += 2; |
1121 | 11.1k | return 1; |
1122 | 11.1k | } |
1123 | 29.2k | return 0; |
1124 | 40.4k | } |
1125 | | |
1126 | | /* |
1127 | | * Check an ASN1 tag and length: a bit like ASN1_get_object but it sets the |
1128 | | * length for indefinite length constructed form, we don't know the exact |
1129 | | * length but we can set an upper bound to the amount of data available minus |
1130 | | * the header length just read. |
1131 | | */ |
1132 | | |
1133 | | static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass, |
1134 | | char *inf, char *cst, |
1135 | | const unsigned char **in, long len, |
1136 | | int exptag, int expclass, char opt, ASN1_TLC *ctx) |
1137 | 45.2k | { |
1138 | 45.2k | int i; |
1139 | 45.2k | int ptag, pclass; |
1140 | 45.2k | long plen; |
1141 | 45.2k | const unsigned char *p, *q; |
1142 | 45.2k | p = *in; |
1143 | 45.2k | q = p; |
1144 | | |
1145 | 45.2k | if (len <= 0) { |
1146 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_SMALL); |
1147 | 0 | goto err; |
1148 | 0 | } |
1149 | 45.2k | if (ctx != NULL && ctx->valid) { |
1150 | 0 | i = ctx->ret; |
1151 | 0 | plen = ctx->plen; |
1152 | 0 | pclass = ctx->pclass; |
1153 | 0 | ptag = ctx->ptag; |
1154 | 0 | p += ctx->hdrlen; |
1155 | 45.2k | } else { |
1156 | 45.2k | i = ASN1_get_object(&p, &plen, &ptag, &pclass, len); |
1157 | 45.2k | if (ctx != NULL) { |
1158 | 45.2k | ctx->ret = i; |
1159 | 45.2k | ctx->plen = plen; |
1160 | 45.2k | ctx->pclass = pclass; |
1161 | 45.2k | ctx->ptag = ptag; |
1162 | 45.2k | ctx->hdrlen = p - q; |
1163 | 45.2k | ctx->valid = 1; |
1164 | | /* |
1165 | | * If definite length, and no error, length + header can't exceed |
1166 | | * total amount of data available. |
1167 | | */ |
1168 | 45.2k | if ((i & 0x81) == 0 && (plen + ctx->hdrlen) > len) { |
1169 | 0 | ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG); |
1170 | 0 | goto err; |
1171 | 0 | } |
1172 | 45.2k | } |
1173 | 45.2k | } |
1174 | | |
1175 | 45.2k | if ((i & 0x80) != 0) { |
1176 | 1.09k | ERR_raise(ERR_LIB_ASN1, ASN1_R_BAD_OBJECT_HEADER); |
1177 | 1.09k | goto err; |
1178 | 1.09k | } |
1179 | 44.1k | if (exptag >= 0) { |
1180 | 44.1k | if (exptag != ptag || expclass != pclass) { |
1181 | | /* |
1182 | | * If type is OPTIONAL, not an error: indicate missing type. |
1183 | | */ |
1184 | 210 | if (opt != 0) |
1185 | 0 | return -1; |
1186 | 210 | ERR_raise(ERR_LIB_ASN1, ASN1_R_WRONG_TAG); |
1187 | 210 | goto err; |
1188 | 210 | } |
1189 | | /* |
1190 | | * We have a tag and class match: assume we are going to do something |
1191 | | * with it |
1192 | | */ |
1193 | 43.9k | asn1_tlc_clear(ctx); |
1194 | 43.9k | } |
1195 | | |
1196 | 43.9k | if ((i & 1) != 0) |
1197 | 12.1k | plen = len - (p - q); |
1198 | | |
1199 | 43.9k | if (inf != NULL) |
1200 | 43.9k | *inf = i & 1; |
1201 | | |
1202 | 43.9k | if (cst != NULL) |
1203 | 43.9k | *cst = i & V_ASN1_CONSTRUCTED; |
1204 | | |
1205 | 43.9k | if (olen != NULL) |
1206 | 43.9k | *olen = plen; |
1207 | | |
1208 | 43.9k | if (oclass != NULL) |
1209 | 0 | *oclass = pclass; |
1210 | | |
1211 | 43.9k | if (otag != NULL) |
1212 | 0 | *otag = ptag; |
1213 | | |
1214 | 43.9k | *in = p; |
1215 | 43.9k | return 1; |
1216 | | |
1217 | 1.30k | err: |
1218 | 1.30k | asn1_tlc_clear(ctx); |
1219 | 1.30k | return 0; |
1220 | 44.1k | } |