1 /*
2 * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <stdio.h>
11 #include <limits.h>
12 #include "crypto/ctype.h"
13 #include "internal/cryptlib.h"
14 #include <openssl/buffer.h>
15 #include <openssl/asn1.h>
16 #include <openssl/objects.h>
17 #include <openssl/bn.h>
18 #include "crypto/asn1.h"
19 #include "asn1_local.h"
20
i2d_ASN1_OBJECT(const ASN1_OBJECT * a,unsigned char ** pp)21 int i2d_ASN1_OBJECT(const ASN1_OBJECT *a, unsigned char **pp)
22 {
23 unsigned char *p, *allocated = NULL;
24 int objsize;
25
26 if ((a == NULL) || (a->data == NULL))
27 return 0;
28
29 objsize = ASN1_object_size(0, a->length, V_ASN1_OBJECT);
30 if (pp == NULL || objsize == -1)
31 return objsize;
32
33 if (*pp == NULL) {
34 if ((p = allocated = OPENSSL_malloc(objsize)) == NULL) {
35 ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
36 return 0;
37 }
38 } else {
39 p = *pp;
40 }
41
42 ASN1_put_object(&p, 0, a->length, V_ASN1_OBJECT, V_ASN1_UNIVERSAL);
43 memcpy(p, a->data, a->length);
44
45 /*
46 * If a new buffer was allocated, just return it back.
47 * If not, return the incremented buffer pointer.
48 */
49 *pp = allocated != NULL ? allocated : p + a->length;
50 return objsize;
51 }
52
a2d_ASN1_OBJECT(unsigned char * out,int olen,const char * buf,int num)53 int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
54 {
55 int i, first, len = 0, c, use_bn;
56 char ftmp[24], *tmp = ftmp;
57 int tmpsize = sizeof(ftmp);
58 const char *p;
59 unsigned long l;
60 BIGNUM *bl = NULL;
61
62 if (num == 0)
63 return 0;
64 else if (num == -1)
65 num = strlen(buf);
66
67 p = buf;
68 c = *(p++);
69 num--;
70 if ((c >= '0') && (c <= '2')) {
71 first = c - '0';
72 } else {
73 ERR_raise(ERR_LIB_ASN1, ASN1_R_FIRST_NUM_TOO_LARGE);
74 goto err;
75 }
76
77 if (num <= 0) {
78 ERR_raise(ERR_LIB_ASN1, ASN1_R_MISSING_SECOND_NUMBER);
79 goto err;
80 }
81 c = *(p++);
82 num--;
83 for (;;) {
84 if (num <= 0)
85 break;
86 if ((c != '.') && (c != ' ')) {
87 ERR_raise(ERR_LIB_ASN1, ASN1_R_INVALID_SEPARATOR);
88 goto err;
89 }
90 l = 0;
91 use_bn = 0;
92 for (;;) {
93 if (num <= 0)
94 break;
95 num--;
96 c = *(p++);
97 if ((c == ' ') || (c == '.'))
98 break;
99 if (!ossl_isdigit(c)) {
100 ERR_raise(ERR_LIB_ASN1, ASN1_R_INVALID_DIGIT);
101 goto err;
102 }
103 if (!use_bn && l >= ((ULONG_MAX - 80) / 10L)) {
104 use_bn = 1;
105 if (bl == NULL)
106 bl = BN_new();
107 if (bl == NULL || !BN_set_word(bl, l))
108 goto err;
109 }
110 if (use_bn) {
111 if (!BN_mul_word(bl, 10L)
112 || !BN_add_word(bl, c - '0'))
113 goto err;
114 } else
115 l = l * 10L + (long)(c - '0');
116 }
117 if (len == 0) {
118 if ((first < 2) && (l >= 40)) {
119 ERR_raise(ERR_LIB_ASN1, ASN1_R_SECOND_NUMBER_TOO_LARGE);
120 goto err;
121 }
122 if (use_bn) {
123 if (!BN_add_word(bl, first * 40))
124 goto err;
125 } else
126 l += (long)first *40;
127 }
128 i = 0;
129 if (use_bn) {
130 int blsize;
131 blsize = BN_num_bits(bl);
132 blsize = (blsize + 6) / 7;
133 if (blsize > tmpsize) {
134 if (tmp != ftmp)
135 OPENSSL_free(tmp);
136 tmpsize = blsize + 32;
137 tmp = OPENSSL_malloc(tmpsize);
138 if (tmp == NULL) {
139 ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
140 goto err;
141 }
142 }
143 while (blsize--) {
144 BN_ULONG t = BN_div_word(bl, 0x80L);
145 if (t == (BN_ULONG)-1)
146 goto err;
147 tmp[i++] = (unsigned char)t;
148 }
149 } else {
150
151 for (;;) {
152 tmp[i++] = (unsigned char)l & 0x7f;
153 l >>= 7L;
154 if (l == 0L)
155 break;
156 }
157
158 }
159 if (out != NULL) {
160 if (len + i > olen) {
161 ERR_raise(ERR_LIB_ASN1, ASN1_R_BUFFER_TOO_SMALL);
162 goto err;
163 }
164 while (--i > 0)
165 out[len++] = tmp[i] | 0x80;
166 out[len++] = tmp[0];
167 } else
168 len += i;
169 }
170 if (tmp != ftmp)
171 OPENSSL_free(tmp);
172 BN_free(bl);
173 return len;
174 err:
175 if (tmp != ftmp)
176 OPENSSL_free(tmp);
177 BN_free(bl);
178 return 0;
179 }
180
i2t_ASN1_OBJECT(char * buf,int buf_len,const ASN1_OBJECT * a)181 int i2t_ASN1_OBJECT(char *buf, int buf_len, const ASN1_OBJECT *a)
182 {
183 return OBJ_obj2txt(buf, buf_len, a, 0);
184 }
185
i2a_ASN1_OBJECT(BIO * bp,const ASN1_OBJECT * a)186 int i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *a)
187 {
188 char buf[80], *p = buf;
189 int i;
190
191 if ((a == NULL) || (a->data == NULL))
192 return BIO_write(bp, "NULL", 4);
193 i = i2t_ASN1_OBJECT(buf, sizeof(buf), a);
194 if (i > (int)(sizeof(buf) - 1)) {
195 if (i > INT_MAX - 1) { /* catch an integer overflow */
196 ERR_raise(ERR_LIB_ASN1, ASN1_R_LENGTH_TOO_LONG);
197 return -1;
198 }
199 if ((p = OPENSSL_malloc(i + 1)) == NULL) {
200 ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
201 return -1;
202 }
203 i2t_ASN1_OBJECT(p, i + 1, a);
204 }
205 if (i <= 0) {
206 i = BIO_write(bp, "<INVALID>", 9);
207 i += BIO_dump(bp, (const char *)a->data, a->length);
208 return i;
209 }
210 BIO_write(bp, p, i);
211 if (p != buf)
212 OPENSSL_free(p);
213 return i;
214 }
215
d2i_ASN1_OBJECT(ASN1_OBJECT ** a,const unsigned char ** pp,long length)216 ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
217 long length)
218 {
219 const unsigned char *p;
220 long len;
221 int tag, xclass;
222 int inf, i;
223 ASN1_OBJECT *ret = NULL;
224 p = *pp;
225 inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
226 if (inf & 0x80) {
227 i = ASN1_R_BAD_OBJECT_HEADER;
228 goto err;
229 }
230
231 if (tag != V_ASN1_OBJECT) {
232 i = ASN1_R_EXPECTING_AN_OBJECT;
233 goto err;
234 }
235 ret = ossl_c2i_ASN1_OBJECT(a, &p, len);
236 if (ret)
237 *pp = p;
238 return ret;
239 err:
240 ERR_raise(ERR_LIB_ASN1, i);
241 return NULL;
242 }
243
ossl_c2i_ASN1_OBJECT(ASN1_OBJECT ** a,const unsigned char ** pp,long len)244 ASN1_OBJECT *ossl_c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
245 long len)
246 {
247 ASN1_OBJECT *ret = NULL, tobj;
248 const unsigned char *p;
249 unsigned char *data;
250 int i, length;
251
252 /*
253 * Sanity check OID encoding. Need at least one content octet. MSB must
254 * be clear in the last octet. can't have leading 0x80 in subidentifiers,
255 * see: X.690 8.19.2
256 */
257 if (len <= 0 || len > INT_MAX || pp == NULL || (p = *pp) == NULL ||
258 p[len - 1] & 0x80) {
259 ERR_raise(ERR_LIB_ASN1, ASN1_R_INVALID_OBJECT_ENCODING);
260 return NULL;
261 }
262 /* Now 0 < len <= INT_MAX, so the cast is safe. */
263 length = (int)len;
264 /*
265 * Try to lookup OID in table: these are all valid encodings so if we get
266 * a match we know the OID is valid.
267 */
268 tobj.nid = NID_undef;
269 tobj.data = p;
270 tobj.length = length;
271 tobj.flags = 0;
272 i = OBJ_obj2nid(&tobj);
273 if (i != NID_undef) {
274 /*
275 * Return shared registered OID object: this improves efficiency
276 * because we don't have to return a dynamically allocated OID
277 * and NID lookups can use the cached value.
278 */
279 ret = OBJ_nid2obj(i);
280 if (a) {
281 ASN1_OBJECT_free(*a);
282 *a = ret;
283 }
284 *pp += len;
285 return ret;
286 }
287 for (i = 0; i < length; i++, p++) {
288 if (*p == 0x80 && (!i || !(p[-1] & 0x80))) {
289 ERR_raise(ERR_LIB_ASN1, ASN1_R_INVALID_OBJECT_ENCODING);
290 return NULL;
291 }
292 }
293
294 if ((a == NULL) || ((*a) == NULL) ||
295 !((*a)->flags & ASN1_OBJECT_FLAG_DYNAMIC)) {
296 if ((ret = ASN1_OBJECT_new()) == NULL)
297 return NULL;
298 } else {
299 ret = (*a);
300 }
301
302 p = *pp;
303 /* detach data from object */
304 data = (unsigned char *)ret->data;
305 ret->data = NULL;
306 /* once detached we can change it */
307 if ((data == NULL) || (ret->length < length)) {
308 ret->length = 0;
309 OPENSSL_free(data);
310 data = OPENSSL_malloc(length);
311 if (data == NULL) {
312 i = ERR_R_MALLOC_FAILURE;
313 goto err;
314 }
315 ret->flags |= ASN1_OBJECT_FLAG_DYNAMIC_DATA;
316 }
317 memcpy(data, p, length);
318 /* If there are dynamic strings, free them here, and clear the flag */
319 if ((ret->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS) != 0) {
320 OPENSSL_free((char *)ret->sn);
321 OPENSSL_free((char *)ret->ln);
322 ret->flags &= ~ASN1_OBJECT_FLAG_DYNAMIC_STRINGS;
323 }
324 /* reattach data to object, after which it remains const */
325 ret->data = data;
326 ret->length = length;
327 ret->sn = NULL;
328 ret->ln = NULL;
329 /* ret->flags=ASN1_OBJECT_FLAG_DYNAMIC; we know it is dynamic */
330 p += length;
331
332 if (a != NULL)
333 (*a) = ret;
334 *pp = p;
335 return ret;
336 err:
337 ERR_raise(ERR_LIB_ASN1, i);
338 if ((a == NULL) || (*a != ret))
339 ASN1_OBJECT_free(ret);
340 return NULL;
341 }
342
ASN1_OBJECT_new(void)343 ASN1_OBJECT *ASN1_OBJECT_new(void)
344 {
345 ASN1_OBJECT *ret;
346
347 ret = OPENSSL_zalloc(sizeof(*ret));
348 if (ret == NULL) {
349 ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
350 return NULL;
351 }
352 ret->flags = ASN1_OBJECT_FLAG_DYNAMIC;
353 return ret;
354 }
355
ASN1_OBJECT_free(ASN1_OBJECT * a)356 void ASN1_OBJECT_free(ASN1_OBJECT *a)
357 {
358 if (a == NULL)
359 return;
360 if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS) {
361 #ifndef CONST_STRICT
362 /*
363 * Disable purely for compile-time strict const checking. Doing this
364 * on a "real" compile will cause memory leaks
365 */
366 OPENSSL_free((void*)a->sn);
367 OPENSSL_free((void*)a->ln);
368 #endif
369 a->sn = a->ln = NULL;
370 }
371 if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_DATA) {
372 OPENSSL_free((void*)a->data);
373 a->data = NULL;
374 a->length = 0;
375 }
376 if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC)
377 OPENSSL_free(a);
378 }
379
ASN1_OBJECT_create(int nid,unsigned char * data,int len,const char * sn,const char * ln)380 ASN1_OBJECT *ASN1_OBJECT_create(int nid, unsigned char *data, int len,
381 const char *sn, const char *ln)
382 {
383 ASN1_OBJECT o;
384
385 o.sn = sn;
386 o.ln = ln;
387 o.data = data;
388 o.nid = nid;
389 o.length = len;
390 o.flags = ASN1_OBJECT_FLAG_DYNAMIC | ASN1_OBJECT_FLAG_DYNAMIC_STRINGS |
391 ASN1_OBJECT_FLAG_DYNAMIC_DATA;
392 return OBJ_dup(&o);
393 }
394