crypto/asn1/a_d2i_fp.c

   1 /*
   2  * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdio.h>
  11 #include <limits.h>
  12 #include "internal/cryptlib.h"
  13 #include "internal/numbers.h"
  14 #include <openssl/buffer.h>
  15 #include <openssl/asn1.h>
  16 #include "internal/asn1.h"
  17 #include "crypto/asn1.h"
  18
  19 #ifndef NO_OLD_ASN1
  20 # ifndef OPENSSL_NO_STDIO
  21
  22 void *ASN1_d2i_fp(void *(*xnew) (void), d2i_of_void *d2i, FILE *in, void **x)
  23 {
  24     BIO *b;
  25     void *ret;
  26
  27     if ((b = BIO_new(BIO_s_file())) == NULL) {
  28         ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
  29         return NULL;
  30     }
  31     BIO_set_fp(b, in, BIO_NOCLOSE);
  32     ret = ASN1_d2i_bio(xnew, d2i, b, x);
  33     BIO_free(b);
  34     return ret;
  35 }
  36 # endif
  37
  38 void *ASN1_d2i_bio(void *(*xnew) (void), d2i_of_void *d2i, BIO *in, void **x)
  39 {
  40     BUF_MEM *b = NULL;
  41     const unsigned char *p;
  42     void *ret = NULL;
  43     int len;
  44
  45     len = asn1_d2i_read_bio(in, &b);
  46     if (len < 0)
  47         goto err;
  48
  49     p = (unsigned char *)b->data;
  50     ret = d2i(x, &p, len);
  51  err:
  52     BUF_MEM_free(b);
  53     return ret;
  54 }
  55
  56 #endif
  57
  58 void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x)
  59 {
  60     BUF_MEM *b = NULL;
  61     const unsigned char *p;
  62     void *ret = NULL;
  63     int len;
  64
  65     len = asn1_d2i_read_bio(in, &b);
  66     if (len < 0)
  67         goto err;
  68
  69     p = (const unsigned char *)b->data;
  70     ret = ASN1_item_d2i(x, &p, len, it);
  71  err:
  72     BUF_MEM_free(b);
  73     return ret;
  74 }
  75
  76 #ifndef OPENSSL_NO_STDIO
  77 void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x)
  78 {
  79     BIO *b;
  80     char *ret;
  81
  82     if ((b = BIO_new(BIO_s_file())) == NULL) {
  83         ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
  84         return NULL;
  85     }
  86     BIO_set_fp(b, in, BIO_NOCLOSE);
  87     ret = ASN1_item_d2i_bio(it, b, x);
  88     BIO_free(b);
  89     return ret;
  90 }
  91 #endif
  92
  93 #define HEADER_SIZE   8
  94 #define ASN1_CHUNK_INITIAL_SIZE (16 * 1024)
  95 int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
  96 {
  97     BUF_MEM *b;
  98     unsigned char *p;
  99     int i;
 100     size_t want = HEADER_SIZE;
 101     uint32_t eos = 0;
 102     size_t off = 0;
 103     size_t len = 0;
 104     size_t diff;
 105
 106     const unsigned char *q;
 107     long slen;
 108     int inf, tag, xclass;
 109
 110     b = BUF_MEM_new();
 111     if (b == NULL) {
 112         ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
 113         return -1;
 114     }
 115
 116     ERR_clear_error();
 117     for (;;) {
 118         diff = len - off;
 119         if (want >= diff) {
 120             want -= diff;
 121
 122             if (len + want < len || !BUF_MEM_grow_clean(b, len + want)) {
 123                 ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
 124                 goto err;
 125             }
 126             i = BIO_read(in, &(b->data[len]), want);
 127             if (i < 0 && diff == 0) {
 128                 ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
 129                 goto err;
 130             }
 131             if (i > 0) {
 132                 if (len + i < len) {
 133                     ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
 134                     goto err;
 135                 }
 136                 len += i;
 137             }
 138         }
 139         /* else data already loaded */
 140
 141         p = (unsigned char *)&(b->data[off]);
 142         q = p;
 143         diff = len - off;
 144         if (diff == 0)
 145             goto err;
 146         inf = ASN1_get_object(&q, &slen, &tag, &xclass, diff);
 147         if (inf & 0x80) {
 148             unsigned long e;
 149
 150             e = ERR_GET_REASON(ERR_peek_error());
 151             if (e != ASN1_R_TOO_LONG)
 152                 goto err;
 153             ERR_clear_error();
 154         }
 155         i = q - p;            /* header length */
 156         off += i;               /* end of data */
 157
 158         if (inf & 1) {
 159             /* no data body so go round again */
 160             if (eos == UINT32_MAX) {
 161                 ERR_raise(ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG);
 162                 goto err;
 163             }
 164             eos++;
 165             want = HEADER_SIZE;
 166         } else if (eos && (slen == 0) && (tag == V_ASN1_EOC)) {
 167             /* eos value, so go back and read another header */
 168             eos--;
 169             if (eos == 0)
 170                 break;
 171             else
 172                 want = HEADER_SIZE;
 173         } else {
 174             /* suck in slen bytes of data */
 175             want = slen;
 176             if (want > (len - off)) {
 177                 size_t chunk_max = ASN1_CHUNK_INITIAL_SIZE;
 178
 179                 want -= (len - off);
 180                 if (want > INT_MAX /* BIO_read takes an int length */  ||
 181                     len + want < len) {
 182                     ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
 183                     goto err;
 184                 }
 185                 while (want > 0) {
 186                     /*
 187                      * Read content in chunks of increasing size
 188                      * so we can return an error for EOF without
 189                      * having to allocate the entire content length
 190                      * in one go.
 191                      */
 192                     size_t chunk = want > chunk_max ? chunk_max : want;
 193
 194                     if (!BUF_MEM_grow_clean(b, len + chunk)) {
 195                         ERR_raise(ERR_LIB_ASN1, ERR_R_MALLOC_FAILURE);
 196                         goto err;
 197                     }
 198                     want -= chunk;
 199                     while (chunk > 0) {
 200                         i = BIO_read(in, &(b->data[len]), chunk);
 201                         if (i <= 0) {
 202                             ERR_raise(ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA);
 203                             goto err;
 204                         }
 205                     /*
 206                      * This can't overflow because |len+want| didn't
 207                      * overflow.
 208                      */
 209                         len += i;
 210                         chunk -= i;
 211                     }
 212                     if (chunk_max < INT_MAX/2)
 213                         chunk_max *= 2;
 214                 }
 215             }
 216             if (off + slen < off) {
 217                 ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
 218                 goto err;
 219             }
 220             off += slen;
 221             if (eos == 0) {
 222                 break;
 223             } else
 224                 want = HEADER_SIZE;
 225         }
 226     }
 227
 228     if (off > INT_MAX) {
 229         ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
 230         goto err;
 231     }
 232
 233     *pb = b;
 234     return off;
 235  err:
 236     BUF_MEM_free(b);
 237     return -1;
 238 }