tasn_dec.c@ 88461

Last change on this file since 88461 was 87984, checked in by vboxsync, 4 years ago
openssl-1.1.1j: Applied and adjusted our OpenSSL changes to 1.1.1j. bugref:9963
File size: 37.0 KB

Line
1	/*
2	* Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
3	*
4	* Licensed under the OpenSSL license (the "License"). You may not use
5	* this file except in compliance with the License. You can obtain a copy
6	* in the file LICENSE in the source distribution or at
7	* https://www.openssl.org/source/license.html
8	*/
9
10	#include <stddef.h>
11	#include <string.h>
12	#include <openssl/asn1.h>
13	#include <openssl/asn1t.h>
14	#include <openssl/objects.h>
15	#include <openssl/buffer.h>
16	#include <openssl/err.h>
17	#include "internal/numbers.h"
18	#include "asn1_local.h"
19
20
21	/*
22	* Constructed types with a recursive definition (such as can be found in PKCS7)
23	* could eventually exceed the stack given malicious input with excessive
24	* recursion. Therefore we limit the stack depth. This is the maximum number of
25	* recursive invocations of asn1_item_embed_d2i().
26	*/
27	#define ASN1_MAX_CONSTRUCTED_NEST 30
28
29	static int asn1_item_embed_d2i(ASN1_VALUE pval, const unsigned char in,
30	long len, const ASN1_ITEM *it,
31	int tag, int aclass, char opt, ASN1_TLC *ctx,
32	int depth);
33
34	static int asn1_check_eoc(const unsigned char **in, long len);
35	static int asn1_find_end(const unsigned char **in, long len, char inf);
36
37	static int asn1_collect(BUF_MEM buf, const unsigned char *in, long len,
38	char inf, int tag, int aclass, int depth);
39
40	static int collect_data(BUF_MEM buf, const unsigned char *p, long plen);
41
42	static int asn1_check_tlen(long olen, int otag, unsigned char *oclass,
43	char inf, char cst,
44	const unsigned char **in, long len,
45	int exptag, int expclass, char opt, ASN1_TLC *ctx);
46
47	static int asn1_template_ex_d2i(ASN1_VALUE **pval,
48	const unsigned char **in, long len,
49	const ASN1_TEMPLATE *tt, char opt,
50	ASN1_TLC *ctx, int depth);
51	static int asn1_template_noexp_d2i(ASN1_VALUE **val,
52	const unsigned char **in, long len,
53	const ASN1_TEMPLATE *tt, char opt,
54	ASN1_TLC *ctx, int depth);
55	static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
56	const unsigned char **in, long len,
57	const ASN1_ITEM *it,
58	int tag, int aclass, char opt,
59	ASN1_TLC *ctx);
60	static int asn1_ex_c2i(ASN1_VALUE *pval, const unsigned char cont, int len,
61	int utype, char free_cont, const ASN1_ITEM it);
62
63	/* Table to convert tags to bit values, used for MSTRING type */
64	static const unsigned long tag2bit[32] = {
65	/* tags 0 - 3 */
66	0, 0, 0, B_ASN1_BIT_STRING,
67	/* tags 4- 7 */
68	B_ASN1_OCTET_STRING, 0, 0, B_ASN1_UNKNOWN,
69	/* tags 8-11 */
70	B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN,
71	/* tags 12-15 */
72	B_ASN1_UTF8STRING, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN,
73	/* tags 16-19 */
74	B_ASN1_SEQUENCE, 0, B_ASN1_NUMERICSTRING, B_ASN1_PRINTABLESTRING,
75	/* tags 20-22 */
76	B_ASN1_T61STRING, B_ASN1_VIDEOTEXSTRING, B_ASN1_IA5STRING,
77	/* tags 23-24 */
78	B_ASN1_UTCTIME, B_ASN1_GENERALIZEDTIME,
79	/* tags 25-27 */
80	B_ASN1_GRAPHICSTRING, B_ASN1_ISO64STRING, B_ASN1_GENERALSTRING,
81	/* tags 28-31 */
82	B_ASN1_UNIVERSALSTRING, B_ASN1_UNKNOWN, B_ASN1_BMPSTRING, B_ASN1_UNKNOWN,
83	};
84
85	unsigned long ASN1_tag2bit(int tag)
86	{
87	if ((tag < 0) \|\| (tag > 30))
88	return 0;
89	return tag2bit[tag];
90	}
91
92	/* Macro to initialize and invalidate the cache */
93
94	#define asn1_tlc_clear(c) if (c) (c)->valid = 0
95	/* Version to avoid compiler warning about 'c' always non-NULL */
96	#define asn1_tlc_clear_nc(c) (c)->valid = 0
97
98	/*
99	* Decode an ASN1 item, this currently behaves just like a standard 'd2i'
100	* function. 'in' points to a buffer to read the data from, in future we
101	* will have more advanced versions that can input data a piece at a time and
102	* this will simply be a special case.
103	*/
104
105	ASN1_VALUE ASN1_item_d2i(ASN1_VALUE *pval,
106	const unsigned char **in, long len,
107	const ASN1_ITEM *it)
108	{
109	ASN1_TLC c;
110	ASN1_VALUE *ptmpval = NULL;
111	if (!pval)
112	pval = &ptmpval;
113	asn1_tlc_clear_nc(&c);
114	if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
115	return *pval;
116	return NULL;
117	}
118
119	int ASN1_item_ex_d2i(ASN1_VALUE pval, const unsigned char in, long len,
120	const ASN1_ITEM *it,
121	int tag, int aclass, char opt, ASN1_TLC *ctx)
122	{
123	int rv;
124	rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx, 0);
125	if (rv <= 0)
126	ASN1_item_ex_free(pval, it);
127	return rv;
128	}
129
130	/*
131	* Decode an item, taking care of IMPLICIT tagging, if any. If 'opt' set and
132	* tag mismatch return -1 to handle OPTIONAL
133	*/
134
135	static int asn1_item_embed_d2i(ASN1_VALUE pval, const unsigned char in,
136	long len, const ASN1_ITEM *it,
137	int tag, int aclass, char opt, ASN1_TLC *ctx,
138	int depth)
139	{
140	const ASN1_TEMPLATE tt, errtt = NULL;
141	const ASN1_EXTERN_FUNCS *ef;
142	const ASN1_AUX *aux = it->funcs;
143	ASN1_aux_cb *asn1_cb;
144	const unsigned char p = NULL, q;
145	unsigned char oclass;
146	char seq_eoc, seq_nolen, cst, isopt;
147	long tmplen;
148	int i;
149	int otag;
150	int ret = 0;
151	ASN1_VALUE **pchptr;
152	if (!pval)
153	return 0;
154	if (aux && aux->asn1_cb)
155	asn1_cb = aux->asn1_cb;
156	else
157	asn1_cb = 0;
158
159	if (++depth > ASN1_MAX_CONSTRUCTED_NEST) {
160	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_NESTED_TOO_DEEP);
161	goto err;
162	}
163
164	switch (it->itype) {
165	case ASN1_ITYPE_PRIMITIVE:
166	if (it->templates) {
167	/*
168	* tagging or OPTIONAL is currently illegal on an item template
169	* because the flags can't get passed down. In practice this
170	* isn't a problem: we include the relevant flags from the item
171	* template in the template itself.
172	*/
173	if ((tag != -1) \|\| opt) {
174	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I,
175	ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);
176	goto err;
177	}
178	return asn1_template_ex_d2i(pval, in, len,
179	it->templates, opt, ctx, depth);
180	}
181	return asn1_d2i_ex_primitive(pval, in, len, it,
182	tag, aclass, opt, ctx);
183
184	case ASN1_ITYPE_MSTRING:
185	/*
186	* It never makes sense for multi-strings to have implicit tagging, so
187	* if tag != -1, then this looks like an error in the template.
188	*/
189	if (tag != -1) {
190	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_BAD_TEMPLATE);
191	goto err;
192	}
193
194	p = *in;
195	/* Just read in tag and class */
196	ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
197	&p, len, -1, 0, 1, ctx);
198	if (!ret) {
199	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);
200	goto err;
201	}
202
203	/* Must be UNIVERSAL class */
204	if (oclass != V_ASN1_UNIVERSAL) {
205	/* If OPTIONAL, assume this is OK */
206	if (opt)
207	return -1;
208	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MSTRING_NOT_UNIVERSAL);
209	goto err;
210	}
211
212	/* Check tag matches bit map */
213	if (!(ASN1_tag2bit(otag) & it->utype)) {
214	/* If OPTIONAL, assume this is OK */
215	if (opt)
216	return -1;
217	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MSTRING_WRONG_TAG);
218	goto err;
219	}
220	return asn1_d2i_ex_primitive(pval, in, len, it, otag, 0, 0, ctx);
221
222	case ASN1_ITYPE_EXTERN:
223	/* Use new style d2i */
224	ef = it->funcs;
225	return ef->asn1_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx);
226
227	case ASN1_ITYPE_CHOICE:
228	/*
229	* It never makes sense for CHOICE types to have implicit tagging, so
230	* if tag != -1, then this looks like an error in the template.
231	*/
232	if (tag != -1) {
233	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_BAD_TEMPLATE);
234	goto err;
235	}
236
237	if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))
238	goto auxerr;
239	if (*pval) {
240	/* Free up and zero CHOICE value if initialised */
241	i = asn1_get_choice_selector(pval, it);
242	if ((i >= 0) && (i < it->tcount)) {
243	tt = it->templates + i;
244	pchptr = asn1_get_field_ptr(pval, tt);
245	asn1_template_free(pchptr, tt);
246	asn1_set_choice_selector(pval, -1, it);
247	}
248	} else if (!ASN1_item_ex_new(pval, it)) {
249	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);
250	goto err;
251	}
252	/* CHOICE type, try each possibility in turn */
253	p = *in;
254	for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
255	pchptr = asn1_get_field_ptr(pval, tt);
256	/*
257	* We mark field as OPTIONAL so its absence can be recognised.
258	*/
259	ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx, depth);
260	/* If field not present, try the next one */
261	if (ret == -1)
262	continue;
263	/* If positive return, read OK, break loop */
264	if (ret > 0)
265	break;
266	/*
267	* Must be an ASN1 parsing error.
268	* Free up any partial choice value
269	*/
270	asn1_template_free(pchptr, tt);
271	errtt = tt;
272	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);
273	goto err;
274	}
275
276	/* Did we fall off the end without reading anything? */
277	if (i == it->tcount) {
278	/* If OPTIONAL, this is OK */
279	if (opt) {
280	/* Free and zero it */
281	ASN1_item_ex_free(pval, it);
282	return -1;
283	}
284	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_NO_MATCHING_CHOICE_TYPE);
285	goto err;
286	}
287
288	asn1_set_choice_selector(pval, i, it);
289
290	if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))
291	goto auxerr;
292	*in = p;
293	return 1;
294
295	case ASN1_ITYPE_NDEF_SEQUENCE:
296	case ASN1_ITYPE_SEQUENCE:
297	p = *in;
298	tmplen = len;
299
300	/* If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL */
301	if (tag == -1) {
302	tag = V_ASN1_SEQUENCE;
303	aclass = V_ASN1_UNIVERSAL;
304	}
305	/* Get SEQUENCE length and update len, p */
306	ret = asn1_check_tlen(&len, NULL, NULL, &seq_eoc, &cst,
307	&p, len, tag, aclass, opt, ctx);
308	if (!ret) {
309	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);
310	goto err;
311	} else if (ret == -1)
312	return -1;
313	if (aux && (aux->flags & ASN1_AFLG_BROKEN)) {
314	len = tmplen - (p - *in);
315	seq_nolen = 1;
316	}
317	/* If indefinite we don't do a length check */
318	else
319	seq_nolen = seq_eoc;
320	if (!cst) {
321	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_SEQUENCE_NOT_CONSTRUCTED);
322	goto err;
323	}
324
325	if (!*pval && !ASN1_item_ex_new(pval, it)) {
326	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ERR_R_NESTED_ASN1_ERROR);
327	goto err;
328	}
329
330	if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))
331	goto auxerr;
332
333	/* Free up and zero any ADB found */
334	for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
335	if (tt->flags & ASN1_TFLG_ADB_MASK) {
336	const ASN1_TEMPLATE *seqtt;
337	ASN1_VALUE **pseqval;
338	seqtt = asn1_do_adb(pval, tt, 0);
339	if (seqtt == NULL)
340	continue;
341	pseqval = asn1_get_field_ptr(pval, seqtt);
342	asn1_template_free(pseqval, seqtt);
343	}
344	}
345
346	/* Get each field entry */
347	for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
348	const ASN1_TEMPLATE *seqtt;
349	ASN1_VALUE **pseqval;
350	seqtt = asn1_do_adb(pval, tt, 1);
351	if (seqtt == NULL)
352	goto err;
353	pseqval = asn1_get_field_ptr(pval, seqtt);
354	/* Have we ran out of data? */
355	if (!len)
356	break;
357	q = p;
358	if (asn1_check_eoc(&p, len)) {
359	if (!seq_eoc) {
360	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_UNEXPECTED_EOC);
361	goto err;
362	}
363	len -= p - q;
364	seq_eoc = 0;
365	q = p;
366	break;
367	}
368	/*
369	* This determines the OPTIONAL flag value. The field cannot be
370	* omitted if it is the last of a SEQUENCE and there is still
371	* data to be read. This isn't strictly necessary but it
372	* increases efficiency in some cases.
373	*/
374	if (i == (it->tcount - 1))
375	isopt = 0;
376	else
377	isopt = (char)(seqtt->flags & ASN1_TFLG_OPTIONAL);
378	/*
379	* attempt to read in field, allowing each to be OPTIONAL
380	*/
381
382	ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx,
383	depth);
384	if (!ret) {
385	errtt = seqtt;
386	goto err;
387	} else if (ret == -1) {
388	/*
389	* OPTIONAL component absent. Free and zero the field.
390	*/
391	asn1_template_free(pseqval, seqtt);
392	continue;
393	}
394	/* Update length */
395	len -= p - q;
396	}
397
398	/* Check for EOC if expecting one */
399	if (seq_eoc && !asn1_check_eoc(&p, len)) {
400	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_MISSING_EOC);
401	goto err;
402	}
403	/* Check all data read */
404	if (!seq_nolen && len) {
405	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_SEQUENCE_LENGTH_MISMATCH);
406	goto err;
407	}
408
409	/*
410	* If we get here we've got no more data in the SEQUENCE, however we
411	* may not have read all fields so check all remaining are OPTIONAL
412	* and clear any that are.
413	*/
414	for (; i < it->tcount; tt++, i++) {
415	const ASN1_TEMPLATE *seqtt;
416	seqtt = asn1_do_adb(pval, tt, 1);
417	if (seqtt == NULL)
418	goto err;
419	if (seqtt->flags & ASN1_TFLG_OPTIONAL) {
420	ASN1_VALUE **pseqval;
421	pseqval = asn1_get_field_ptr(pval, seqtt);
422	asn1_template_free(pseqval, seqtt);
423	} else {
424	errtt = seqtt;
425	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_FIELD_MISSING);
426	goto err;
427	}
428	}
429	/* Save encoding */
430	if (!asn1_enc_save(pval, in, p - in, it))
431	goto auxerr;
432	if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))
433	goto auxerr;
434	*in = p;
435	return 1;
436
437	default:
438	return 0;
439	}
440	auxerr:
441	ASN1err(ASN1_F_ASN1_ITEM_EMBED_D2I, ASN1_R_AUX_ERROR);
442	err:
443	if (errtt)
444	ERR_add_error_data(4, "Field=", errtt->field_name,
445	", Type=", it->sname);
446	else
447	ERR_add_error_data(2, "Type=", it->sname);
448	return 0;
449	}
450
451	/*
452	* Templates are handled with two separate functions. One handles any
453	* EXPLICIT tag and the other handles the rest.
454	*/
455
456	static int asn1_template_ex_d2i(ASN1_VALUE **val,
457	const unsigned char **in, long inlen,
458	const ASN1_TEMPLATE *tt, char opt,
459	ASN1_TLC *ctx, int depth)
460	{
461	int flags, aclass;
462	int ret;
463	long len;
464	const unsigned char p, q;
465	char exp_eoc;
466	if (!val)
467	return 0;
468	flags = tt->flags;
469	aclass = flags & ASN1_TFLG_TAG_CLASS;
470
471	p = *in;
472
473	/* Check if EXPLICIT tag expected */
474	if (flags & ASN1_TFLG_EXPTAG) {
475	char cst;
476	/*
477	* Need to work out amount of data available to the inner content and
478	* where it starts: so read in EXPLICIT header to get the info.
479	*/
480	ret = asn1_check_tlen(&len, NULL, NULL, &exp_eoc, &cst,
481	&p, inlen, tt->tag, aclass, opt, ctx);
482	q = p;
483	if (!ret) {
484	ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
485	return 0;
486	} else if (ret == -1)
487	return -1;
488	if (!cst) {
489	ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
490	ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED);
491	return 0;
492	}
493	/* We've found the field so it can't be OPTIONAL now */
494	ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx, depth);
495	if (!ret) {
496	ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
497	return 0;
498	}
499	/* We read the field in OK so update length */
500	len -= p - q;
501	if (exp_eoc) {
502	/* If NDEF we must have an EOC here */
503	if (!asn1_check_eoc(&p, len)) {
504	ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I, ASN1_R_MISSING_EOC);
505	goto err;
506	}
507	} else {
508	/*
509	* Otherwise we must hit the EXPLICIT tag end or its an error
510	*/
511	if (len) {
512	ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
513	ASN1_R_EXPLICIT_LENGTH_MISMATCH);
514	goto err;
515	}
516	}
517	} else
518	return asn1_template_noexp_d2i(val, in, inlen, tt, opt, ctx, depth);
519
520	*in = p;
521	return 1;
522
523	err:
524	return 0;
525	}
526
527	static int asn1_template_noexp_d2i(ASN1_VALUE **val,
528	const unsigned char **in, long len,
529	const ASN1_TEMPLATE *tt, char opt,
530	ASN1_TLC *ctx, int depth)
531	{
532	int flags, aclass;
533	int ret;
534	ASN1_VALUE *tval;
535	const unsigned char p, q;
536	if (!val)
537	return 0;
538	flags = tt->flags;
539	aclass = flags & ASN1_TFLG_TAG_CLASS;
540
541	p = *in;
542	q = p;
543
544	/*
545	* If field is embedded then val needs fixing so it is a pointer to
546	* a pointer to a field.
547	*/
548	if (tt->flags & ASN1_TFLG_EMBED) {
549	tval = (ASN1_VALUE *)val;
550	val = &tval;
551	}
552
553	if (flags & ASN1_TFLG_SK_MASK) {
554	/* SET OF, SEQUENCE OF */
555	int sktag, skaclass;
556	char sk_eoc;
557	/* First work out expected inner tag value */
558	if (flags & ASN1_TFLG_IMPTAG) {
559	sktag = tt->tag;
560	skaclass = aclass;
561	} else {
562	skaclass = V_ASN1_UNIVERSAL;
563	if (flags & ASN1_TFLG_SET_OF)
564	sktag = V_ASN1_SET;
565	else
566	sktag = V_ASN1_SEQUENCE;
567	}
568	/* Get the tag */
569	ret = asn1_check_tlen(&len, NULL, NULL, &sk_eoc, NULL,
570	&p, len, sktag, skaclass, opt, ctx);
571	if (!ret) {
572	ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_NESTED_ASN1_ERROR);
573	return 0;
574	} else if (ret == -1)
575	return -1;
576	if (!*val)
577	val = (ASN1_VALUE )sk_ASN1_VALUE_new_null();
578	else {
579	/*
580	* We've got a valid STACK: free up any items present
581	*/
582	STACK_OF(ASN1_VALUE) sktmp = (STACK_OF(ASN1_VALUE) )*val;
583	ASN1_VALUE *vtmp;
584	while (sk_ASN1_VALUE_num(sktmp) > 0) {
585	vtmp = sk_ASN1_VALUE_pop(sktmp);
586	ASN1_item_ex_free(&vtmp, ASN1_ITEM_ptr(tt->item));
587	}
588	}
589
590	if (!*val) {
591	ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_MALLOC_FAILURE);
592	goto err;
593	}
594
595	/* Read as many items as we can */
596	while (len > 0) {
597	ASN1_VALUE *skfield;
598	q = p;
599	/* See if EOC found */
600	if (asn1_check_eoc(&p, len)) {
601	if (!sk_eoc) {
602	ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
603	ASN1_R_UNEXPECTED_EOC);
604	goto err;
605	}
606	len -= p - q;
607	sk_eoc = 0;
608	break;
609	}
610	skfield = NULL;
611	if (!asn1_item_embed_d2i(&skfield, &p, len,
612	ASN1_ITEM_ptr(tt->item), -1, 0, 0, ctx,
613	depth)) {
614	ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
615	ERR_R_NESTED_ASN1_ERROR);
616	/* \|skfield\| may be partially allocated despite failure. */
617	ASN1_item_free(skfield, ASN1_ITEM_ptr(tt->item));
618	goto err;
619	}
620	len -= p - q;
621	if (!sk_ASN1_VALUE_push((STACK_OF(ASN1_VALUE) )val, skfield)) {
622	ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_MALLOC_FAILURE);
623	ASN1_item_free(skfield, ASN1_ITEM_ptr(tt->item));
624	goto err;
625	}
626	}
627	if (sk_eoc) {
628	ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ASN1_R_MISSING_EOC);
629	goto err;
630	}
631	} else if (flags & ASN1_TFLG_IMPTAG) {
632	/* IMPLICIT tagging */
633	ret = asn1_item_embed_d2i(val, &p, len,
634	ASN1_ITEM_ptr(tt->item), tt->tag, aclass, opt,
635	ctx, depth);
636	if (!ret) {
637	ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_NESTED_ASN1_ERROR);
638	goto err;
639	} else if (ret == -1)
640	return -1;
641	} else {
642	/* Nothing special */
643	ret = asn1_item_embed_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
644	-1, 0, opt, ctx, depth);
645	if (!ret) {
646	ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_NESTED_ASN1_ERROR);
647	goto err;
648	} else if (ret == -1)
649	return -1;
650	}
651
652	*in = p;
653	return 1;
654
655	err:
656	return 0;
657	}
658
659	static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
660	const unsigned char **in, long inlen,
661	const ASN1_ITEM *it,
662	int tag, int aclass, char opt, ASN1_TLC *ctx)
663	{
664	int ret = 0, utype;
665	long plen;
666	char cst, inf, free_cont = 0;
667	const unsigned char *p;
668	BUF_MEM buf = { 0, NULL, 0, 0 };
669	const unsigned char *cont = NULL;
670	long len;
671	if (!pval) {
672	ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_ILLEGAL_NULL);
673	return 0; /* Should never happen */
674	}
675
676	if (it->itype == ASN1_ITYPE_MSTRING) {
677	utype = tag;
678	tag = -1;
679	} else
680	utype = it->utype;
681
682	if (utype == V_ASN1_ANY) {
683	/* If type is ANY need to figure out type from tag */
684	unsigned char oclass;
685	if (tag >= 0) {
686	ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_ILLEGAL_TAGGED_ANY);
687	return 0;
688	}
689	if (opt) {
690	ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
691	ASN1_R_ILLEGAL_OPTIONAL_ANY);
692	return 0;
693	}
694	p = *in;
695	ret = asn1_check_tlen(NULL, &utype, &oclass, NULL, NULL,
696	&p, inlen, -1, 0, 0, ctx);
697	if (!ret) {
698	ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);
699	return 0;
700	}
701	if (oclass != V_ASN1_UNIVERSAL)
702	utype = V_ASN1_OTHER;
703	}
704	if (tag == -1) {
705	tag = utype;
706	aclass = V_ASN1_UNIVERSAL;
707	}
708	p = *in;
709	/* Check header */
710	ret = asn1_check_tlen(&plen, NULL, NULL, &inf, &cst,
711	&p, inlen, tag, aclass, opt, ctx);
712	if (!ret) {
713	ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);
714	return 0;
715	} else if (ret == -1)
716	return -1;
717	ret = 0;
718	/* SEQUENCE, SET and "OTHER" are left in encoded form */
719	if ((utype == V_ASN1_SEQUENCE)
720	\|\| (utype == V_ASN1_SET) \|\| (utype == V_ASN1_OTHER)) {
721	/*
722	* Clear context cache for type OTHER because the auto clear when we
723	* have a exact match won't work
724	*/
725	if (utype == V_ASN1_OTHER) {
726	asn1_tlc_clear(ctx);
727	}
728	/* SEQUENCE and SET must be constructed */
729	else if (!cst) {
730	ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
731	ASN1_R_TYPE_NOT_CONSTRUCTED);
732	return 0;
733	}
734
735	cont = *in;
736	/* If indefinite length constructed find the real end */
737	if (inf) {
738	if (!asn1_find_end(&p, plen, inf))
739	goto err;
740	len = p - cont;
741	} else {
742	len = p - cont + plen;
743	p += plen;
744	}
745	} else if (cst) {
746	if (utype == V_ASN1_NULL \|\| utype == V_ASN1_BOOLEAN
747	\|\| utype == V_ASN1_OBJECT \|\| utype == V_ASN1_INTEGER
748	\|\| utype == V_ASN1_ENUMERATED) {
749	ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_TYPE_NOT_PRIMITIVE);
750	return 0;
751	}
752
753	/* Free any returned 'buf' content */
754	free_cont = 1;
755	/*
756	* Should really check the internal tags are correct but some things
757	* may get this wrong. The relevant specs say that constructed string
758	* types should be OCTET STRINGs internally irrespective of the type.
759	* So instead just check for UNIVERSAL class and ignore the tag.
760	*/
761	if (!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL, 0)) {
762	goto err;
763	}
764	len = buf.length;
765	/* Append a final null to string */
766	if (!BUF_MEM_grow_clean(&buf, len + 1)) {
767	ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_MALLOC_FAILURE);
768	goto err;
769	}
770	buf.data[len] = 0;
771	cont = (const unsigned char *)buf.data;
772	} else {
773	cont = p;
774	len = plen;
775	p += plen;
776	}
777
778	/* We now have content length and type: translate into a structure */
779	/* asn1_ex_c2i may reuse allocated buffer, and so sets free_cont to 0 */
780	if (!asn1_ex_c2i(pval, cont, len, utype, &free_cont, it))
781	goto err;
782
783	*in = p;
784	ret = 1;
785	err:
786	if (free_cont)
787	OPENSSL_free(buf.data);
788	return ret;
789	}
790
791	/* Translate ASN1 content octets into a structure */
792
793	static int asn1_ex_c2i(ASN1_VALUE *pval, const unsigned char cont, int len,
794	int utype, char free_cont, const ASN1_ITEM it)
795	{
796	ASN1_VALUE **opval = NULL;
797	ASN1_STRING *stmp;
798	ASN1_TYPE *typ = NULL;
799	int ret = 0;
800	const ASN1_PRIMITIVE_FUNCS *pf;
801	ASN1_INTEGER **tint;
802	pf = it->funcs;
803
804	if (pf && pf->prim_c2i)
805	return pf->prim_c2i(pval, cont, len, utype, free_cont, it);
806	/* If ANY type clear type and set pointer to internal value */
807	if (it->utype == V_ASN1_ANY) {
808	if (!*pval) {
809	typ = ASN1_TYPE_new();
810	if (typ == NULL)
811	goto err;
812	pval = (ASN1_VALUE )typ;
813	} else
814	typ = (ASN1_TYPE )pval;
815
816	if (utype != typ->type)
817	ASN1_TYPE_set(typ, utype, NULL);
818	opval = pval;
819	pval = &typ->value.asn1_value;
820	}
821	switch (utype) {
822	case V_ASN1_OBJECT:
823	if (!c2i_ASN1_OBJECT((ASN1_OBJECT **)pval, &cont, len))
824	goto err;
825	break;
826
827	case V_ASN1_NULL:
828	if (len) {
829	ASN1err(ASN1_F_ASN1_EX_C2I, ASN1_R_NULL_IS_WRONG_LENGTH);
830	goto err;
831	}
832	pval = (ASN1_VALUE )1;
833	break;
834
835	case V_ASN1_BOOLEAN:
836	if (len != 1) {
837	ASN1err(ASN1_F_ASN1_EX_C2I, ASN1_R_BOOLEAN_IS_WRONG_LENGTH);
838	goto err;
839	} else {
840	ASN1_BOOLEAN *tbool;
841	tbool = (ASN1_BOOLEAN *)pval;
842	tbool = cont;
843	}
844	break;
845
846	case V_ASN1_BIT_STRING:
847	if (!c2i_ASN1_BIT_STRING((ASN1_BIT_STRING **)pval, &cont, len))
848	goto err;
849	break;
850
851	case V_ASN1_INTEGER:
852	case V_ASN1_ENUMERATED:
853	tint = (ASN1_INTEGER **)pval;
854	if (!c2i_ASN1_INTEGER(tint, &cont, len))
855	goto err;
856	/* Fixup type to match the expected form */
857	(tint)->type = utype \| ((tint)->type & V_ASN1_NEG);
858	break;
859
860	case V_ASN1_OCTET_STRING:
861	case V_ASN1_NUMERICSTRING:
862	case V_ASN1_PRINTABLESTRING:
863	case V_ASN1_T61STRING:
864	case V_ASN1_VIDEOTEXSTRING:
865	case V_ASN1_IA5STRING:
866	case V_ASN1_UTCTIME:
867	case V_ASN1_GENERALIZEDTIME:
868	case V_ASN1_GRAPHICSTRING:
869	case V_ASN1_VISIBLESTRING:
870	case V_ASN1_GENERALSTRING:
871	case V_ASN1_UNIVERSALSTRING:
872	case V_ASN1_BMPSTRING:
873	case V_ASN1_UTF8STRING:
874	case V_ASN1_OTHER:
875	case V_ASN1_SET:
876	case V_ASN1_SEQUENCE:
877	default:
878	if (utype == V_ASN1_BMPSTRING && (len & 1)) {
879	ASN1err(ASN1_F_ASN1_EX_C2I, ASN1_R_BMPSTRING_IS_WRONG_LENGTH);
880	goto err;
881	}
882	if (utype == V_ASN1_UNIVERSALSTRING && (len & 3)) {
883	ASN1err(ASN1_F_ASN1_EX_C2I,
884	ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH);
885	goto err;
886	}
887	/* All based on ASN1_STRING and handled the same */
888	if (!*pval) {
889	stmp = ASN1_STRING_type_new(utype);
890	if (stmp == NULL) {
891	ASN1err(ASN1_F_ASN1_EX_C2I, ERR_R_MALLOC_FAILURE);
892	goto err;
893	}
894	pval = (ASN1_VALUE )stmp;
895	} else {
896	stmp = (ASN1_STRING )pval;
897	stmp->type = utype;
898	}
899	/* If we've already allocated a buffer use it */
900	if (*free_cont) {
901	OPENSSL_free(stmp->data);
902	stmp->data = (unsigned char )cont; / UGLY CAST! RL */
903	stmp->length = len;
904	*free_cont = 0;
905	} else {
906	if (!ASN1_STRING_set(stmp, cont, len)) {
907	ASN1err(ASN1_F_ASN1_EX_C2I, ERR_R_MALLOC_FAILURE);
908	ASN1_STRING_free(stmp);
909	*pval = NULL;
910	goto err;
911	}
912	}
913	break;
914	}
915	/* If ASN1_ANY and NULL type fix up value */
916	if (typ && (utype == V_ASN1_NULL))
917	typ->value.ptr = NULL;
918
919	ret = 1;
920	err:
921	if (!ret) {
922	ASN1_TYPE_free(typ);
923	if (opval)
924	*opval = NULL;
925	}
926	return ret;
927	}
928
929	/*
930	* This function finds the end of an ASN1 structure when passed its maximum
931	* length, whether it is indefinite length and a pointer to the content. This
932	* is more efficient than calling asn1_collect because it does not recurse on
933	* each indefinite length header.
934	*/
935
936	static int asn1_find_end(const unsigned char **in, long len, char inf)
937	{
938	uint32_t expected_eoc;
939	long plen;
940	const unsigned char p = in, *q;
941	/* If not indefinite length constructed just add length */
942	if (inf == 0) {
943	*in += len;
944	return 1;
945	}
946	expected_eoc = 1;
947	/*
948	* Indefinite length constructed form. Find the end when enough EOCs are
949	* found. If more indefinite length constructed headers are encountered
950	* increment the expected eoc count otherwise just skip to the end of the
951	* data.
952	*/
953	while (len > 0) {
954	if (asn1_check_eoc(&p, len)) {
955	expected_eoc--;
956	if (expected_eoc == 0)
957	break;
958	len -= 2;
959	continue;
960	}
961	q = p;
962	/* Just read in a header: only care about the length */
963	if (!asn1_check_tlen(&plen, NULL, NULL, &inf, NULL, &p, len,
964	-1, 0, 0, NULL)) {
965	ASN1err(ASN1_F_ASN1_FIND_END, ERR_R_NESTED_ASN1_ERROR);
966	return 0;
967	}
968	if (inf) {
969	if (expected_eoc == UINT32_MAX) {
970	ASN1err(ASN1_F_ASN1_FIND_END, ERR_R_NESTED_ASN1_ERROR);
971	return 0;
972	}
973	expected_eoc++;
974	} else {
975	p += plen;
976	}
977	len -= p - q;
978	}
979	if (expected_eoc) {
980	ASN1err(ASN1_F_ASN1_FIND_END, ASN1_R_MISSING_EOC);
981	return 0;
982	}
983	*in = p;
984	return 1;
985	}
986
987	/*
988	* This function collects the asn1 data from a constructed string type into
989	* a buffer. The values of 'in' and 'len' should refer to the contents of the
990	* constructed type and 'inf' should be set if it is indefinite length.
991	*/
992
993	#ifndef ASN1_MAX_STRING_NEST
994	/*
995	* This determines how many levels of recursion are permitted in ASN1 string
996	* types. If it is not limited stack overflows can occur. If set to zero no
997	* recursion is allowed at all. Although zero should be adequate examples
998	* exist that require a value of 1. So 5 should be more than enough.
999	*/
1000	# define ASN1_MAX_STRING_NEST 5
1001	#endif
1002
1003	static int asn1_collect(BUF_MEM buf, const unsigned char *in, long len,
1004	char inf, int tag, int aclass, int depth)
1005	{
1006	const unsigned char p, q;
1007	long plen;
1008	char cst, ininf;
1009	p = *in;
1010	inf &= 1;
1011	/*
1012	* If no buffer and not indefinite length constructed just pass over the
1013	* encoded data
1014	*/
1015	if (!buf && !inf) {
1016	*in += len;
1017	return 1;
1018	}
1019	while (len > 0) {
1020	q = p;
1021	/* Check for EOC */
1022	if (asn1_check_eoc(&p, len)) {
1023	/*
1024	* EOC is illegal outside indefinite length constructed form
1025	*/
1026	if (!inf) {
1027	ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_UNEXPECTED_EOC);
1028	return 0;
1029	}
1030	inf = 0;
1031	break;
1032	}
1033
1034	if (!asn1_check_tlen(&plen, NULL, NULL, &ininf, &cst, &p,
1035	len, tag, aclass, 0, NULL)) {
1036	ASN1err(ASN1_F_ASN1_COLLECT, ERR_R_NESTED_ASN1_ERROR);
1037	return 0;
1038	}
1039
1040	/* If indefinite length constructed update max length */
1041	if (cst) {
1042	if (depth >= ASN1_MAX_STRING_NEST) {
1043	ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_NESTED_ASN1_STRING);
1044	return 0;
1045	}
1046	if (!asn1_collect(buf, &p, plen, ininf, tag, aclass, depth + 1))
1047	return 0;
1048	} else if (plen && !collect_data(buf, &p, plen))
1049	return 0;
1050	len -= p - q;
1051	}
1052	if (inf) {
1053	ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_MISSING_EOC);
1054	return 0;
1055	}
1056	*in = p;
1057	return 1;
1058	}
1059
1060	static int collect_data(BUF_MEM buf, const unsigned char *p, long plen)
1061	{
1062	int len;
1063	if (buf) {
1064	len = buf->length;
1065	if (!BUF_MEM_grow_clean(buf, len + plen)) {
1066	ASN1err(ASN1_F_COLLECT_DATA, ERR_R_MALLOC_FAILURE);
1067	return 0;
1068	}
1069	memcpy(buf->data + len, *p, plen);
1070	}
1071	*p += plen;
1072	return 1;
1073	}
1074
1075	/* Check for ASN1 EOC and swallow it if found */
1076
1077	static int asn1_check_eoc(const unsigned char **in, long len)
1078	{
1079	const unsigned char *p;
1080	if (len < 2)
1081	return 0;
1082	p = *in;
1083	if (!p[0] && !p[1]) {
1084	*in += 2;
1085	return 1;
1086	}
1087	return 0;
1088	}
1089
1090	/*
1091	* Check an ASN1 tag and length: a bit like ASN1_get_object but it sets the
1092	* length for indefinite length constructed form, we don't know the exact
1093	* length but we can set an upper bound to the amount of data available minus
1094	* the header length just read.
1095	*/
1096
1097	static int asn1_check_tlen(long olen, int otag, unsigned char *oclass,
1098	char inf, char cst,
1099	const unsigned char **in, long len,
1100	int exptag, int expclass, char opt, ASN1_TLC *ctx)
1101	{
1102	int i;
1103	int ptag, pclass;
1104	long plen;
1105	const unsigned char p, q;
1106	p = *in;
1107	q = p;
1108
1109	if (ctx && ctx->valid) {
1110	i = ctx->ret;
1111	plen = ctx->plen;
1112	pclass = ctx->pclass;
1113	ptag = ctx->ptag;
1114	p += ctx->hdrlen;
1115	} else {
1116	i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
1117	if (ctx) {
1118	ctx->ret = i;
1119	ctx->plen = plen;
1120	ctx->pclass = pclass;
1121	ctx->ptag = ptag;
1122	ctx->hdrlen = p - q;
1123	ctx->valid = 1;
1124	/*
1125	* If definite length, and no error, length + header can't exceed
1126	* total amount of data available.
1127	*/
1128	if (!(i & 0x81) && ((plen + ctx->hdrlen) > len)) {
1129	ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_TOO_LONG);
1130	asn1_tlc_clear(ctx);
1131	return 0;
1132	}
1133	}
1134	}
1135
1136	if (i & 0x80) {
1137	ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_BAD_OBJECT_HEADER);
1138	asn1_tlc_clear(ctx);
1139	return 0;
1140	}
1141	if (exptag >= 0) {
1142	if ((exptag != ptag) \|\| (expclass != pclass)) {
1143	/*
1144	* If type is OPTIONAL, not an error: indicate missing type.
1145	*/
1146	if (opt)
1147	return -1;
1148	asn1_tlc_clear(ctx);
1149	ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_WRONG_TAG);
1150	return 0;
1151	}
1152	/*
1153	* We have a tag and class match: assume we are going to do something
1154	* with it
1155	*/
1156	asn1_tlc_clear(ctx);
1157	}
1158
1159	if (i & 1)
1160	plen = len - (p - q);
1161
1162	if (inf)
1163	*inf = i & 1;
1164
1165	if (cst)
1166	*cst = i & V_ASN1_CONSTRUCTED;
1167
1168	if (olen)
1169	*olen = plen;
1170
1171	if (oclass)
1172	*oclass = pclass;
1173
1174	if (otag)
1175	*otag = ptag;
1176
1177	*in = p;
1178	return 1;
1179	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/libs/openssl-1.1.1j/crypto/asn1/tasn_dec.c@ 88461

Download in other formats: