crypto/asn1/tasn_dec.c

   1 /*
   2  * Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stddef.h>
  11 #include <string.h>
  12 #include <openssl/asn1.h>
  13 #include <openssl/asn1t.h>
  14 #include <openssl/objects.h>
  15 #include <openssl/buffer.h>
  16 #include <openssl/err.h>
  17 #include "internal/numbers.h"
  18 #include "asn1_local.h"
  19
  20 /*
  21  * Constructed types with a recursive definition (such as can be found in PKCS7)
  22  * could eventually exceed the stack given malicious input with excessive
  23  * recursion. Therefore we limit the stack depth. This is the maximum number of
  24  * recursive invocations of asn1_item_embed_d2i().
  25  */
  26 #define ASN1_MAX_CONSTRUCTED_NEST 30
  27
  28 static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
  29                                long len, const ASN1_ITEM *it,
  30                                int tag, int aclass, char opt, ASN1_TLC *ctx,
  31                                int depth, OSSL_LIB_CTX *libctx,
  32                                const char *propq);
  33
  34 static int asn1_check_eoc(const unsigned char **in, long len);
  35 static int asn1_find_end(const unsigned char **in, long len, char inf);
  36
  37 static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
  38                         char inf, int tag, int aclass, int depth);
  39
  40 static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen);
  41
  42 static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
  43                            char *inf, char *cst,
  44                            const unsigned char **in, long len,
  45                            int exptag, int expclass, char opt, ASN1_TLC *ctx);
  46
  47 static int asn1_template_ex_d2i(ASN1_VALUE **pval,
  48                                 const unsigned char **in, long len,
  49                                 const ASN1_TEMPLATE *tt, char opt,
  50                                 ASN1_TLC *ctx, int depth, OSSL_LIB_CTX *libctx,
  51                                 const char *propq);
  52 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
  53                                    const unsigned char **in, long len,
  54                                    const ASN1_TEMPLATE *tt, char opt,
  55                                    ASN1_TLC *ctx, int depth,
  56                                    OSSL_LIB_CTX *libctx, const char *propq);
  57 static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
  58                                  const unsigned char **in, long len,
  59                                  const ASN1_ITEM *it,
  60                                  int tag, int aclass, char opt,
  61                                  ASN1_TLC *ctx);
  62 static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
  63                        int utype, char *free_cont, const ASN1_ITEM *it);
  64
  65 /* Table to convert tags to bit values, used for MSTRING type */
  66 static const unsigned long tag2bit[32] = {
  67     /* tags  0 -  3 */
  68     0, 0, 0, B_ASN1_BIT_STRING,
  69     /* tags  4- 7 */
  70     B_ASN1_OCTET_STRING, 0, 0, B_ASN1_UNKNOWN,
  71     /* tags  8-11 */
  72     B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, 0, B_ASN1_UNKNOWN,
  73     /* tags 12-15 */
  74     B_ASN1_UTF8STRING, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN,
  75     /* tags 16-19 */
  76     B_ASN1_SEQUENCE, 0, B_ASN1_NUMERICSTRING, B_ASN1_PRINTABLESTRING,
  77     /* tags 20-22 */
  78     B_ASN1_T61STRING, B_ASN1_VIDEOTEXSTRING, B_ASN1_IA5STRING,
  79     /* tags 23-24 */
  80     B_ASN1_UTCTIME, B_ASN1_GENERALIZEDTIME,
  81     /* tags 25-27 */
  82     B_ASN1_GRAPHICSTRING, B_ASN1_ISO64STRING, B_ASN1_GENERALSTRING,
  83     /* tags 28-31 */
  84     B_ASN1_UNIVERSALSTRING, B_ASN1_UNKNOWN, B_ASN1_BMPSTRING, B_ASN1_UNKNOWN,
  85 };
  86
  87 unsigned long ASN1_tag2bit(int tag)
  88 {
  89     if ((tag < 0) || (tag > 30))
  90         return 0;
  91     return tag2bit[tag];
  92 }
  93
  94 /* Macro to initialize and invalidate the cache */
  95
  96 #define asn1_tlc_clear(c)       do { if ((c) != NULL) (c)->valid = 0; } while (0)
  97 /* Version to avoid compiler warning about 'c' always non-NULL */
  98 #define asn1_tlc_clear_nc(c)    do {(c)->valid = 0; } while (0)
  99
 100 /*
 101  * Decode an ASN1 item, this currently behaves just like a standard 'd2i'
 102  * function. 'in' points to a buffer to read the data from, in future we
 103  * will have more advanced versions that can input data a piece at a time and
 104  * this will simply be a special case.
 105  */
 106
 107 static int asn1_item_ex_d2i_intern(ASN1_VALUE **pval, const unsigned char **in,
 108                                    long len, const ASN1_ITEM *it, int tag,
 109                                    int aclass, char opt, ASN1_TLC *ctx,
 110                                    OSSL_LIB_CTX *libctx, const char *propq)
 111 {
 112     int rv;
 113
 114     if (pval == NULL || it == NULL) {
 115         ERR_raise(ERR_LIB_ASN1, ERR_R_PASSED_NULL_PARAMETER);
 116         return 0;
 117     }
 118     rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx, 0,
 119                              libctx, propq);
 120     if (rv <= 0)
 121         ASN1_item_ex_free(pval, it);
 122     return rv;
 123 }
 124
 125 int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
 126                      const ASN1_ITEM *it,
 127                      int tag, int aclass, char opt, ASN1_TLC *ctx)
 128 {
 129     return asn1_item_ex_d2i_intern(pval, in, len, it, tag, aclass, opt, ctx,
 130                                    NULL, NULL);
 131 }
 132
 133 ASN1_VALUE *ASN1_item_d2i_ex(ASN1_VALUE **pval,
 134                              const unsigned char **in, long len,
 135                              const ASN1_ITEM *it, OSSL_LIB_CTX *libctx,
 136                              const char *propq)
 137 {
 138     ASN1_TLC c;
 139     ASN1_VALUE *ptmpval = NULL;
 140
 141     if (pval == NULL)
 142         pval = &ptmpval;
 143     asn1_tlc_clear_nc(&c);
 144     if (asn1_item_ex_d2i_intern(pval, in, len, it, -1, 0, 0, &c, libctx,
 145                                 propq) > 0)
 146         return *pval;
 147     return NULL;
 148 }
 149
 150 ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
 151                           const unsigned char **in, long len,
 152                           const ASN1_ITEM *it)
 153 {
 154     return ASN1_item_d2i_ex(pval, in, len, it, NULL, NULL);
 155 }
 156
 157 /*
 158  * Decode an item, taking care of IMPLICIT tagging, if any. If 'opt' set and
 159  * tag mismatch return -1 to handle OPTIONAL
 160  */
 161
 162 static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
 163                                long len, const ASN1_ITEM *it,
 164                                int tag, int aclass, char opt, ASN1_TLC *ctx,
 165                                int depth, OSSL_LIB_CTX *libctx,
 166                                const char *propq)
 167 {
 168     const ASN1_TEMPLATE *tt, *errtt = NULL;
 169     const ASN1_EXTERN_FUNCS *ef;
 170     const ASN1_AUX *aux;
 171     ASN1_aux_cb *asn1_cb;
 172     const unsigned char *p = NULL, *q;
 173     unsigned char oclass;
 174     char seq_eoc, seq_nolen, cst, isopt;
 175     long tmplen;
 176     int i;
 177     int otag;
 178     int ret = 0;
 179     ASN1_VALUE **pchptr;
 180
 181     if (pval == NULL || it == NULL) {
 182         ERR_raise(ERR_LIB_ASN1, ERR_R_PASSED_NULL_PARAMETER);
 183         return 0;
 184     }
 185     if (len <= 0) {
 186         ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_SMALL);
 187         return 0;
 188     }
 189     aux = it->funcs;
 190     if (aux && aux->asn1_cb)
 191         asn1_cb = aux->asn1_cb;
 192     else
 193         asn1_cb = 0;
 194
 195     if (++depth > ASN1_MAX_CONSTRUCTED_NEST) {
 196         ERR_raise(ERR_LIB_ASN1, ASN1_R_NESTED_TOO_DEEP);
 197         goto err;
 198     }
 199
 200     switch (it->itype) {
 201     case ASN1_ITYPE_PRIMITIVE:
 202         if (it->templates) {
 203             /*
 204              * tagging or OPTIONAL is currently illegal on an item template
 205              * because the flags can't get passed down. In practice this
 206              * isn't a problem: we include the relevant flags from the item
 207              * template in the template itself.
 208              */
 209             if ((tag != -1) || opt) {
 210                 ERR_raise(ERR_LIB_ASN1,
 211                           ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);
 212                 goto err;
 213             }
 214             return asn1_template_ex_d2i(pval, in, len, it->templates, opt, ctx,
 215                                         depth, libctx, propq);
 216         }
 217         return asn1_d2i_ex_primitive(pval, in, len, it,
 218                                      tag, aclass, opt, ctx);
 219
 220     case ASN1_ITYPE_MSTRING:
 221         /*
 222          * It never makes sense for multi-strings to have implicit tagging, so
 223          * if tag != -1, then this looks like an error in the template.
 224          */
 225         if (tag != -1) {
 226             ERR_raise(ERR_LIB_ASN1, ASN1_R_BAD_TEMPLATE);
 227             goto err;
 228         }
 229
 230         p = *in;
 231         /* Just read in tag and class */
 232         ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
 233                               &p, len, -1, 0, 1, ctx);
 234         if (!ret) {
 235             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 236             goto err;
 237         }
 238
 239         /* Must be UNIVERSAL class */
 240         if (oclass != V_ASN1_UNIVERSAL) {
 241             /* If OPTIONAL, assume this is OK */
 242             if (opt)
 243                 return -1;
 244             ERR_raise(ERR_LIB_ASN1, ASN1_R_MSTRING_NOT_UNIVERSAL);
 245             goto err;
 246         }
 247
 248         /* Check tag matches bit map */
 249         if (!(ASN1_tag2bit(otag) & it->utype)) {
 250             /* If OPTIONAL, assume this is OK */
 251             if (opt)
 252                 return -1;
 253             ERR_raise(ERR_LIB_ASN1, ASN1_R_MSTRING_WRONG_TAG);
 254             goto err;
 255         }
 256         return asn1_d2i_ex_primitive(pval, in, len, it, otag, 0, 0, ctx);
 257
 258     case ASN1_ITYPE_EXTERN:
 259         /* Use new style d2i */
 260         ef = it->funcs;
 261         if (ef->asn1_ex_d2i_ex != NULL)
 262             return ef->asn1_ex_d2i_ex(pval, in, len, it, tag, aclass, opt, ctx,
 263                                       libctx, propq);
 264         return ef->asn1_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx);
 265
 266     case ASN1_ITYPE_CHOICE:
 267         /*
 268          * It never makes sense for CHOICE types to have implicit tagging, so
 269          * if tag != -1, then this looks like an error in the template.
 270          */
 271         if (tag != -1) {
 272             ERR_raise(ERR_LIB_ASN1, ASN1_R_BAD_TEMPLATE);
 273             goto err;
 274         }
 275
 276         if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))
 277             goto auxerr;
 278         if (*pval) {
 279             /* Free up and zero CHOICE value if initialised */
 280             i = ossl_asn1_get_choice_selector(pval, it);
 281             if ((i >= 0) && (i < it->tcount)) {
 282                 tt = it->templates + i;
 283                 pchptr = ossl_asn1_get_field_ptr(pval, tt);
 284                 ossl_asn1_template_free(pchptr, tt);
 285                 ossl_asn1_set_choice_selector(pval, -1, it);
 286             }
 287         } else if (!ossl_asn1_item_ex_new_intern(pval, it, libctx, propq)) {
 288             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 289             goto err;
 290         }
 291         /* CHOICE type, try each possibility in turn */
 292         p = *in;
 293         for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
 294             pchptr = ossl_asn1_get_field_ptr(pval, tt);
 295             /*
 296              * We mark field as OPTIONAL so its absence can be recognised.
 297              */
 298             ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx, depth,
 299                                        libctx, propq);
 300             /* If field not present, try the next one */
 301             if (ret == -1)
 302                 continue;
 303             /* If positive return, read OK, break loop */
 304             if (ret > 0)
 305                 break;
 306             /*
 307              * Must be an ASN1 parsing error.
 308              * Free up any partial choice value
 309              */
 310             ossl_asn1_template_free(pchptr, tt);
 311             errtt = tt;
 312             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 313             goto err;
 314         }
 315
 316         /* Did we fall off the end without reading anything? */
 317         if (i == it->tcount) {
 318             /* If OPTIONAL, this is OK */
 319             if (opt) {
 320                 /* Free and zero it */
 321                 ASN1_item_ex_free(pval, it);
 322                 return -1;
 323             }
 324             ERR_raise(ERR_LIB_ASN1, ASN1_R_NO_MATCHING_CHOICE_TYPE);
 325             goto err;
 326         }
 327
 328         ossl_asn1_set_choice_selector(pval, i, it);
 329
 330         if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))
 331             goto auxerr;
 332         *in = p;
 333         return 1;
 334
 335     case ASN1_ITYPE_NDEF_SEQUENCE:
 336     case ASN1_ITYPE_SEQUENCE:
 337         p = *in;
 338         tmplen = len;
 339
 340         /* If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL */
 341         if (tag == -1) {
 342             tag = V_ASN1_SEQUENCE;
 343             aclass = V_ASN1_UNIVERSAL;
 344         }
 345         /* Get SEQUENCE length and update len, p */
 346         ret = asn1_check_tlen(&len, NULL, NULL, &seq_eoc, &cst,
 347                               &p, len, tag, aclass, opt, ctx);
 348         if (!ret) {
 349             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 350             goto err;
 351         } else if (ret == -1)
 352             return -1;
 353         if (aux && (aux->flags & ASN1_AFLG_BROKEN)) {
 354             len = tmplen - (p - *in);
 355             seq_nolen = 1;
 356         }
 357         /* If indefinite we don't do a length check */
 358         else
 359             seq_nolen = seq_eoc;
 360         if (!cst) {
 361             ERR_raise(ERR_LIB_ASN1, ASN1_R_SEQUENCE_NOT_CONSTRUCTED);
 362             goto err;
 363         }
 364
 365         if (*pval == NULL
 366                 && !ossl_asn1_item_ex_new_intern(pval, it, libctx, propq)) {
 367             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 368             goto err;
 369         }
 370
 371         if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))
 372             goto auxerr;
 373
 374         /* Free up and zero any ADB found */
 375         for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
 376             if (tt->flags & ASN1_TFLG_ADB_MASK) {
 377                 const ASN1_TEMPLATE *seqtt;
 378                 ASN1_VALUE **pseqval;
 379                 seqtt = ossl_asn1_do_adb(*pval, tt, 0);
 380                 if (seqtt == NULL)
 381                     continue;
 382                 pseqval = ossl_asn1_get_field_ptr(pval, seqtt);
 383                 ossl_asn1_template_free(pseqval, seqtt);
 384             }
 385         }
 386
 387         /* Get each field entry */
 388         for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
 389             const ASN1_TEMPLATE *seqtt;
 390             ASN1_VALUE **pseqval;
 391             seqtt = ossl_asn1_do_adb(*pval, tt, 1);
 392             if (seqtt == NULL)
 393                 goto err;
 394             pseqval = ossl_asn1_get_field_ptr(pval, seqtt);
 395             /* Have we ran out of data? */
 396             if (!len)
 397                 break;
 398             q = p;
 399             if (asn1_check_eoc(&p, len)) {
 400                 if (!seq_eoc) {
 401                     ERR_raise(ERR_LIB_ASN1, ASN1_R_UNEXPECTED_EOC);
 402                     goto err;
 403                 }
 404                 len -= p - q;
 405                 seq_eoc = 0;
 406                 break;
 407             }
 408             /*
 409              * This determines the OPTIONAL flag value. The field cannot be
 410              * omitted if it is the last of a SEQUENCE and there is still
 411              * data to be read. This isn't strictly necessary but it
 412              * increases efficiency in some cases.
 413              */
 414             if (i == (it->tcount - 1))
 415                 isopt = 0;
 416             else
 417                 isopt = (char)(seqtt->flags & ASN1_TFLG_OPTIONAL);
 418             /*
 419              * attempt to read in field, allowing each to be OPTIONAL
 420              */
 421
 422             ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx,
 423                                        depth, libctx, propq);
 424             if (!ret) {
 425                 errtt = seqtt;
 426                 goto err;
 427             } else if (ret == -1) {
 428                 /*
 429                  * OPTIONAL component absent. Free and zero the field.
 430                  */
 431                 ossl_asn1_template_free(pseqval, seqtt);
 432                 continue;
 433             }
 434             /* Update length */
 435             len -= p - q;
 436         }
 437
 438         /* Check for EOC if expecting one */
 439         if (seq_eoc && !asn1_check_eoc(&p, len)) {
 440             ERR_raise(ERR_LIB_ASN1, ASN1_R_MISSING_EOC);
 441             goto err;
 442         }
 443         /* Check all data read */
 444         if (!seq_nolen && len) {
 445             ERR_raise(ERR_LIB_ASN1, ASN1_R_SEQUENCE_LENGTH_MISMATCH);
 446             goto err;
 447         }
 448
 449         /*
 450          * If we get here we've got no more data in the SEQUENCE, however we
 451          * may not have read all fields so check all remaining are OPTIONAL
 452          * and clear any that are.
 453          */
 454         for (; i < it->tcount; tt++, i++) {
 455             const ASN1_TEMPLATE *seqtt;
 456             seqtt = ossl_asn1_do_adb(*pval, tt, 1);
 457             if (seqtt == NULL)
 458                 goto err;
 459             if (seqtt->flags & ASN1_TFLG_OPTIONAL) {
 460                 ASN1_VALUE **pseqval;
 461                 pseqval = ossl_asn1_get_field_ptr(pval, seqtt);
 462                 ossl_asn1_template_free(pseqval, seqtt);
 463             } else {
 464                 errtt = seqtt;
 465                 ERR_raise(ERR_LIB_ASN1, ASN1_R_FIELD_MISSING);
 466                 goto err;
 467             }
 468         }
 469         /* Save encoding */
 470         if (!ossl_asn1_enc_save(pval, *in, p - *in, it))
 471             goto auxerr;
 472         if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))
 473             goto auxerr;
 474         *in = p;
 475         return 1;
 476
 477     default:
 478         return 0;
 479     }
 480  auxerr:
 481     ERR_raise(ERR_LIB_ASN1, ASN1_R_AUX_ERROR);
 482  err:
 483     if (errtt)
 484         ERR_add_error_data(4, "Field=", errtt->field_name,
 485                            ", Type=", it->sname);
 486     else
 487         ERR_add_error_data(2, "Type=", it->sname);
 488     return 0;
 489 }
 490
 491 /*
 492  * Templates are handled with two separate functions. One handles any
 493  * EXPLICIT tag and the other handles the rest.
 494  */
 495
 496 static int asn1_template_ex_d2i(ASN1_VALUE **val,
 497                                 const unsigned char **in, long inlen,
 498                                 const ASN1_TEMPLATE *tt, char opt,
 499                                 ASN1_TLC *ctx, int depth,
 500                                 OSSL_LIB_CTX *libctx, const char *propq)
 501 {
 502     int flags, aclass;
 503     int ret;
 504     long len;
 505     const unsigned char *p, *q;
 506     char exp_eoc;
 507     if (!val)
 508         return 0;
 509     flags = tt->flags;
 510     aclass = flags & ASN1_TFLG_TAG_CLASS;
 511
 512     p = *in;
 513
 514     /* Check if EXPLICIT tag expected */
 515     if (flags & ASN1_TFLG_EXPTAG) {
 516         char cst;
 517         /*
 518          * Need to work out amount of data available to the inner content and
 519          * where it starts: so read in EXPLICIT header to get the info.
 520          */
 521         ret = asn1_check_tlen(&len, NULL, NULL, &exp_eoc, &cst,
 522                               &p, inlen, tt->tag, aclass, opt, ctx);
 523         q = p;
 524         if (!ret) {
 525             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 526             return 0;
 527         } else if (ret == -1)
 528             return -1;
 529         if (!cst) {
 530             ERR_raise(ERR_LIB_ASN1, ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED);
 531             return 0;
 532         }
 533         /* We've found the field so it can't be OPTIONAL now */
 534         ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx, depth, libctx,
 535                                       propq);
 536         if (!ret) {
 537             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 538             return 0;
 539         }
 540         /* We read the field in OK so update length */
 541         len -= p - q;
 542         if (exp_eoc) {
 543             /* If NDEF we must have an EOC here */
 544             if (!asn1_check_eoc(&p, len)) {
 545                 ERR_raise(ERR_LIB_ASN1, ASN1_R_MISSING_EOC);
 546                 goto err;
 547             }
 548         } else {
 549             /*
 550              * Otherwise we must hit the EXPLICIT tag end or its an error
 551              */
 552             if (len) {
 553                 ERR_raise(ERR_LIB_ASN1, ASN1_R_EXPLICIT_LENGTH_MISMATCH);
 554                 goto err;
 555             }
 556         }
 557     } else
 558         return asn1_template_noexp_d2i(val, in, inlen, tt, opt, ctx, depth,
 559                                        libctx, propq);
 560
 561     *in = p;
 562     return 1;
 563
 564  err:
 565     return 0;
 566 }
 567
 568 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
 569                                    const unsigned char **in, long len,
 570                                    const ASN1_TEMPLATE *tt, char opt,
 571                                    ASN1_TLC *ctx, int depth,
 572                                    OSSL_LIB_CTX *libctx, const char *propq)
 573 {
 574     int flags, aclass;
 575     int ret;
 576     ASN1_VALUE *tval;
 577     const unsigned char *p, *q;
 578     if (!val)
 579         return 0;
 580     flags = tt->flags;
 581     aclass = flags & ASN1_TFLG_TAG_CLASS;
 582
 583     p = *in;
 584
 585     /*
 586      * If field is embedded then val needs fixing so it is a pointer to
 587      * a pointer to a field.
 588      */
 589     if (tt->flags & ASN1_TFLG_EMBED) {
 590         tval = (ASN1_VALUE *)val;
 591         val = &tval;
 592     }
 593
 594     if (flags & ASN1_TFLG_SK_MASK) {
 595         /* SET OF, SEQUENCE OF */
 596         int sktag, skaclass;
 597         char sk_eoc;
 598         /* First work out expected inner tag value */
 599         if (flags & ASN1_TFLG_IMPTAG) {
 600             sktag = tt->tag;
 601             skaclass = aclass;
 602         } else {
 603             skaclass = V_ASN1_UNIVERSAL;
 604             if (flags & ASN1_TFLG_SET_OF)
 605                 sktag = V_ASN1_SET;
 606             else
 607                 sktag = V_ASN1_SEQUENCE;
 608         }
 609         /* Get the tag */
 610         ret = asn1_check_tlen(&len, NULL, NULL, &sk_eoc, NULL,
 611                               &p, len, sktag, skaclass, opt, ctx);
 612         if (!ret) {
 613             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 614             return 0;
 615         } else if (ret == -1)
 616             return -1;
 617         if (*val == NULL)
 618             *val = (ASN1_VALUE *)sk_ASN1_VALUE_new_null();
 619         else {
 620             /*
 621              * We've got a valid STACK: free up any items present
 622              */
 623             STACK_OF(ASN1_VALUE) *sktmp = (STACK_OF(ASN1_VALUE) *)*val;
 624             ASN1_VALUE *vtmp;
 625             while (sk_ASN1_VALUE_num(sktmp) > 0) {
 626                 vtmp = sk_ASN1_VALUE_pop(sktmp);
 627                 ASN1_item_ex_free(&vtmp, ASN1_ITEM_ptr(tt->item));
 628             }
 629         }
 630
 631         if (*val == NULL) {
 632             ERR_raise(ERR_LIB_ASN1, ERR_R_CRYPTO_LIB);
 633             goto err;
 634         }
 635
 636         /* Read as many items as we can */
 637         while (len > 0) {
 638             ASN1_VALUE *skfield;
 639             q = p;
 640             /* See if EOC found */
 641             if (asn1_check_eoc(&p, len)) {
 642                 if (!sk_eoc) {
 643                     ERR_raise(ERR_LIB_ASN1, ASN1_R_UNEXPECTED_EOC);
 644                     goto err;
 645                 }
 646                 len -= p - q;
 647                 sk_eoc = 0;
 648                 break;
 649             }
 650             skfield = NULL;
 651             if (asn1_item_embed_d2i(&skfield, &p, len,
 652                                      ASN1_ITEM_ptr(tt->item), -1, 0, 0, ctx,
 653                                      depth, libctx, propq) <= 0) {
 654                 ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 655                 /* |skfield| may be partially allocated despite failure. */
 656                 ASN1_item_free(skfield, ASN1_ITEM_ptr(tt->item));
 657                 goto err;
 658             }
 659             len -= p - q;
 660             if (!sk_ASN1_VALUE_push((STACK_OF(ASN1_VALUE) *)*val, skfield)) {
 661                 ERR_raise(ERR_LIB_ASN1, ERR_R_CRYPTO_LIB);
 662                 ASN1_item_free(skfield, ASN1_ITEM_ptr(tt->item));
 663                 goto err;
 664             }
 665         }
 666         if (sk_eoc) {
 667             ERR_raise(ERR_LIB_ASN1, ASN1_R_MISSING_EOC);
 668             goto err;
 669         }
 670     } else if (flags & ASN1_TFLG_IMPTAG) {
 671         /* IMPLICIT tagging */
 672         ret = asn1_item_embed_d2i(val, &p, len,
 673                                   ASN1_ITEM_ptr(tt->item), tt->tag, aclass, opt,
 674                                   ctx, depth, libctx, propq);
 675         if (!ret) {
 676             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 677             goto err;
 678         } else if (ret == -1)
 679             return -1;
 680     } else {
 681         /* Nothing special */
 682         ret = asn1_item_embed_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
 683                                   -1, 0, opt, ctx, depth, libctx, propq);
 684         if (!ret) {
 685             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 686             goto err;
 687         } else if (ret == -1)
 688             return -1;
 689     }
 690
 691     *in = p;
 692     return 1;
 693
 694  err:
 695     return 0;
 696 }
 697
 698 static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
 699                                  const unsigned char **in, long inlen,
 700                                  const ASN1_ITEM *it,
 701                                  int tag, int aclass, char opt, ASN1_TLC *ctx)
 702 {
 703     int ret = 0, utype;
 704     long plen;
 705     char cst, inf, free_cont = 0;
 706     const unsigned char *p;
 707     BUF_MEM buf = { 0, NULL, 0, 0 };
 708     const unsigned char *cont = NULL;
 709     long len;
 710
 711     if (pval == NULL) {
 712         ERR_raise(ERR_LIB_ASN1, ASN1_R_ILLEGAL_NULL);
 713         return 0;               /* Should never happen */
 714     }
 715
 716     if (it->itype == ASN1_ITYPE_MSTRING) {
 717         utype = tag;
 718         tag = -1;
 719     } else
 720         utype = it->utype;
 721
 722     if (utype == V_ASN1_ANY) {
 723         /* If type is ANY need to figure out type from tag */
 724         unsigned char oclass;
 725         if (tag >= 0) {
 726             ERR_raise(ERR_LIB_ASN1, ASN1_R_ILLEGAL_TAGGED_ANY);
 727             return 0;
 728         }
 729         if (opt) {
 730             ERR_raise(ERR_LIB_ASN1, ASN1_R_ILLEGAL_OPTIONAL_ANY);
 731             return 0;
 732         }
 733         p = *in;
 734         ret = asn1_check_tlen(NULL, &utype, &oclass, NULL, NULL,
 735                               &p, inlen, -1, 0, 0, ctx);
 736         if (!ret) {
 737             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 738             return 0;
 739         }
 740         if (oclass != V_ASN1_UNIVERSAL)
 741             utype = V_ASN1_OTHER;
 742     }
 743     if (tag == -1) {
 744         tag = utype;
 745         aclass = V_ASN1_UNIVERSAL;
 746     }
 747     p = *in;
 748     /* Check header */
 749     ret = asn1_check_tlen(&plen, NULL, NULL, &inf, &cst,
 750                           &p, inlen, tag, aclass, opt, ctx);
 751     if (!ret) {
 752         ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
 753         return 0;
 754     } else if (ret == -1)
 755         return -1;
 756     ret = 0;
 757     /* SEQUENCE, SET and "OTHER" are left in encoded form */
 758     if ((utype == V_ASN1_SEQUENCE)
 759         || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER)) {
 760         /*
 761          * Clear context cache for type OTHER because the auto clear when we
 762          * have a exact match won't work
 763          */
 764         if (utype == V_ASN1_OTHER) {
 765             asn1_tlc_clear(ctx);
 766         }
 767         /* SEQUENCE and SET must be constructed */
 768         else if (!cst) {
 769             ERR_raise(ERR_LIB_ASN1, ASN1_R_TYPE_NOT_CONSTRUCTED);
 770             return 0;
 771         }
 772
 773         cont = *in;
 774         /* If indefinite length constructed find the real end */
 775         if (inf) {
 776             if (!asn1_find_end(&p, plen, inf))
 777                 goto err;
 778             len = p - cont;
 779         } else {
 780             len = p - cont + plen;
 781             p += plen;
 782         }
 783     } else if (cst) {
 784         if (utype == V_ASN1_NULL || utype == V_ASN1_BOOLEAN
 785             || utype == V_ASN1_OBJECT || utype == V_ASN1_INTEGER
 786             || utype == V_ASN1_ENUMERATED) {
 787             ERR_raise(ERR_LIB_ASN1, ASN1_R_TYPE_NOT_PRIMITIVE);
 788             return 0;
 789         }
 790
 791         /* Free any returned 'buf' content */
 792         free_cont = 1;
 793         /*
 794          * Should really check the internal tags are correct but some things
 795          * may get this wrong. The relevant specs say that constructed string
 796          * types should be OCTET STRINGs internally irrespective of the type.
 797          * So instead just check for UNIVERSAL class and ignore the tag.
 798          */
 799         if (!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL, 0)) {
 800             goto err;
 801         }
 802         len = buf.length;
 803         /* Append a final null to string */
 804         if (!BUF_MEM_grow_clean(&buf, len + 1)) {
 805             ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
 806             goto err;
 807         }
 808         buf.data[len] = 0;
 809         cont = (const unsigned char *)buf.data;
 810     } else {
 811         cont = p;
 812         len = plen;
 813         p += plen;
 814     }
 815
 816     /* We now have content length and type: translate into a structure */
 817     /* asn1_ex_c2i may reuse allocated buffer, and so sets free_cont to 0 */
 818     if (!asn1_ex_c2i(pval, cont, len, utype, &free_cont, it))
 819         goto err;
 820
 821     *in = p;
 822     ret = 1;
 823  err:
 824     if (free_cont)
 825         OPENSSL_free(buf.data);
 826     return ret;
 827 }
 828
 829 /* Translate ASN1 content octets into a structure */
 830
 831 static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
 832                        int utype, char *free_cont, const ASN1_ITEM *it)
 833 {
 834     ASN1_VALUE **opval = NULL;
 835     ASN1_STRING *stmp;
 836     ASN1_TYPE *typ = NULL;
 837     int ret = 0;
 838     const ASN1_PRIMITIVE_FUNCS *pf;
 839     ASN1_INTEGER **tint;
 840     pf = it->funcs;
 841
 842     if (pf && pf->prim_c2i)
 843         return pf->prim_c2i(pval, cont, len, utype, free_cont, it);
 844     /* If ANY type clear type and set pointer to internal value */
 845     if (it->utype == V_ASN1_ANY) {
 846         if (*pval == NULL) {
 847             typ = ASN1_TYPE_new();
 848             if (typ == NULL)
 849                 goto err;
 850             *pval = (ASN1_VALUE *)typ;
 851         } else
 852             typ = (ASN1_TYPE *)*pval;
 853
 854         if (utype != typ->type)
 855             ASN1_TYPE_set(typ, utype, NULL);
 856         opval = pval;
 857         pval = &typ->value.asn1_value;
 858     }
 859     switch (utype) {
 860     case V_ASN1_OBJECT:
 861         if (!ossl_c2i_ASN1_OBJECT((ASN1_OBJECT **)pval, &cont, len))
 862             goto err;
 863         break;
 864
 865     case V_ASN1_NULL:
 866         if (len) {
 867             ERR_raise(ERR_LIB_ASN1, ASN1_R_NULL_IS_WRONG_LENGTH);
 868             goto err;
 869         }
 870         *pval = (ASN1_VALUE *)1;
 871         break;
 872
 873     case V_ASN1_BOOLEAN:
 874         if (len != 1) {
 875             ERR_raise(ERR_LIB_ASN1, ASN1_R_BOOLEAN_IS_WRONG_LENGTH);
 876             goto err;
 877         } else {
 878             ASN1_BOOLEAN *tbool;
 879             tbool = (ASN1_BOOLEAN *)pval;
 880             *tbool = *cont;
 881         }
 882         break;
 883
 884     case V_ASN1_BIT_STRING:
 885         if (!ossl_c2i_ASN1_BIT_STRING((ASN1_BIT_STRING **)pval, &cont, len))
 886             goto err;
 887         break;
 888
 889     case V_ASN1_INTEGER:
 890     case V_ASN1_ENUMERATED:
 891         tint = (ASN1_INTEGER **)pval;
 892         if (!ossl_c2i_ASN1_INTEGER(tint, &cont, len))
 893             goto err;
 894         /* Fixup type to match the expected form */
 895         (*tint)->type = utype | ((*tint)->type & V_ASN1_NEG);
 896         break;
 897
 898     case V_ASN1_OCTET_STRING:
 899     case V_ASN1_NUMERICSTRING:
 900     case V_ASN1_PRINTABLESTRING:
 901     case V_ASN1_T61STRING:
 902     case V_ASN1_VIDEOTEXSTRING:
 903     case V_ASN1_IA5STRING:
 904     case V_ASN1_UTCTIME:
 905     case V_ASN1_GENERALIZEDTIME:
 906     case V_ASN1_GRAPHICSTRING:
 907     case V_ASN1_VISIBLESTRING:
 908     case V_ASN1_GENERALSTRING:
 909     case V_ASN1_UNIVERSALSTRING:
 910     case V_ASN1_BMPSTRING:
 911     case V_ASN1_UTF8STRING:
 912     case V_ASN1_OTHER:
 913     case V_ASN1_SET:
 914     case V_ASN1_SEQUENCE:
 915     default:
 916         if (utype == V_ASN1_BMPSTRING && (len & 1)) {
 917             ERR_raise(ERR_LIB_ASN1, ASN1_R_BMPSTRING_IS_WRONG_LENGTH);
 918             goto err;
 919         }
 920         if (utype == V_ASN1_UNIVERSALSTRING && (len & 3)) {
 921             ERR_raise(ERR_LIB_ASN1, ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH);
 922             goto err;
 923         }
 924         if (utype == V_ASN1_GENERALIZEDTIME && (len < 15)) {
 925             ERR_raise(ERR_LIB_ASN1, ASN1_R_GENERALIZEDTIME_IS_TOO_SHORT);
 926             goto err;
 927         }
 928         if (utype == V_ASN1_UTCTIME && (len < 13)) {
 929             ERR_raise(ERR_LIB_ASN1, ASN1_R_UTCTIME_IS_TOO_SHORT);
 930             goto err;
 931         }
 932         /* All based on ASN1_STRING and handled the same */
 933         if (*pval == NULL) {
 934             stmp = ASN1_STRING_type_new(utype);
 935             if (stmp == NULL) {
 936                 ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB);
 937                 goto err;
 938             }
 939             *pval = (ASN1_VALUE *)stmp;
 940         } else {
 941             stmp = (ASN1_STRING *)*pval;
 942             stmp->type = utype;
 943         }
 944         /* If we've already allocated a buffer use it */
 945         if (*free_cont) {
 946             ASN1_STRING_set0(stmp, (unsigned char *)cont /* UGLY CAST! */, len);
 947             *free_cont = 0;
 948         } else {
 949             if (!ASN1_STRING_set(stmp, cont, len)) {
 950                 ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB);
 951                 ASN1_STRING_free(stmp);
 952                 *pval = NULL;
 953                 goto err;
 954             }
 955         }
 956         break;
 957     }
 958     /* If ASN1_ANY and NULL type fix up value */
 959     if (typ && (utype == V_ASN1_NULL))
 960         typ->value.ptr = NULL;
 961
 962     ret = 1;
 963  err:
 964     if (!ret) {
 965         ASN1_TYPE_free(typ);
 966         if (opval)
 967             *opval = NULL;
 968     }
 969     return ret;
 970 }
 971
 972 /*
 973  * This function finds the end of an ASN1 structure when passed its maximum
 974  * length, whether it is indefinite length and a pointer to the content. This
 975  * is more efficient than calling asn1_collect because it does not recurse on
 976  * each indefinite length header.
 977  */
 978
 979 static int asn1_find_end(const unsigned char **in, long len, char inf)
 980 {
 981     uint32_t expected_eoc;
 982     long plen;
 983     const unsigned char *p = *in, *q;
 984     /* If not indefinite length constructed just add length */
 985     if (inf == 0) {
 986         *in += len;
 987         return 1;
 988     }
 989     expected_eoc = 1;
 990     /*
 991      * Indefinite length constructed form. Find the end when enough EOCs are
 992      * found. If more indefinite length constructed headers are encountered
 993      * increment the expected eoc count otherwise just skip to the end of the
 994      * data.
 995      */
 996     while (len > 0) {
 997         if (asn1_check_eoc(&p, len)) {
 998             expected_eoc--;
 999             if (expected_eoc == 0)
1000                 break;
1001             len -= 2;
1002             continue;
1003         }
1004         q = p;
1005         /* Just read in a header: only care about the length */
1006         if (!asn1_check_tlen(&plen, NULL, NULL, &inf, NULL, &p, len,
1007                              -1, 0, 0, NULL)) {
1008             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
1009             return 0;
1010         }
1011         if (inf) {
1012             if (expected_eoc == UINT32_MAX) {
1013                 ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
1014                 return 0;
1015             }
1016             expected_eoc++;
1017         } else {
1018             p += plen;
1019         }
1020         len -= p - q;
1021     }
1022     if (expected_eoc) {
1023         ERR_raise(ERR_LIB_ASN1, ASN1_R_MISSING_EOC);
1024         return 0;
1025     }
1026     *in = p;
1027     return 1;
1028 }
1029
1030 /*
1031  * This function collects the asn1 data from a constructed string type into
1032  * a buffer. The values of 'in' and 'len' should refer to the contents of the
1033  * constructed type and 'inf' should be set if it is indefinite length.
1034  */
1035
1036 #ifndef ASN1_MAX_STRING_NEST
1037 /*
1038  * This determines how many levels of recursion are permitted in ASN1 string
1039  * types. If it is not limited stack overflows can occur. If set to zero no
1040  * recursion is allowed at all. Although zero should be adequate examples
1041  * exist that require a value of 1. So 5 should be more than enough.
1042  */
1043 # define ASN1_MAX_STRING_NEST 5
1044 #endif
1045
1046 static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
1047                         char inf, int tag, int aclass, int depth)
1048 {
1049     const unsigned char *p, *q;
1050     long plen;
1051     char cst, ininf;
1052     p = *in;
1053     inf &= 1;
1054     /*
1055      * If no buffer and not indefinite length constructed just pass over the
1056      * encoded data
1057      */
1058     if (!buf && !inf) {
1059         *in += len;
1060         return 1;
1061     }
1062     while (len > 0) {
1063         q = p;
1064         /* Check for EOC */
1065         if (asn1_check_eoc(&p, len)) {
1066             /*
1067              * EOC is illegal outside indefinite length constructed form
1068              */
1069             if (!inf) {
1070                 ERR_raise(ERR_LIB_ASN1, ASN1_R_UNEXPECTED_EOC);
1071                 return 0;
1072             }
1073             inf = 0;
1074             break;
1075         }
1076
1077         if (!asn1_check_tlen(&plen, NULL, NULL, &ininf, &cst, &p,
1078                              len, tag, aclass, 0, NULL)) {
1079             ERR_raise(ERR_LIB_ASN1, ERR_R_NESTED_ASN1_ERROR);
1080             return 0;
1081         }
1082
1083         /* If indefinite length constructed update max length */
1084         if (cst) {
1085             if (depth >= ASN1_MAX_STRING_NEST) {
1086                 ERR_raise(ERR_LIB_ASN1, ASN1_R_NESTED_ASN1_STRING);
1087                 return 0;
1088             }
1089             if (!asn1_collect(buf, &p, plen, ininf, tag, aclass, depth + 1))
1090                 return 0;
1091         } else if (plen && !collect_data(buf, &p, plen))
1092             return 0;
1093         len -= p - q;
1094     }
1095     if (inf) {
1096         ERR_raise(ERR_LIB_ASN1, ASN1_R_MISSING_EOC);
1097         return 0;
1098     }
1099     *in = p;
1100     return 1;
1101 }
1102
1103 static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen)
1104 {
1105     int len;
1106     if (buf) {
1107         len = buf->length;
1108         if (!BUF_MEM_grow_clean(buf, len + plen)) {
1109             ERR_raise(ERR_LIB_ASN1, ERR_R_BUF_LIB);
1110             return 0;
1111         }
1112         memcpy(buf->data + len, *p, plen);
1113     }
1114     *p += plen;
1115     return 1;
1116 }
1117
1118 /* Check for ASN1 EOC and swallow it if found */
1119
1120 static int asn1_check_eoc(const unsigned char **in, long len)
1121 {
1122     const unsigned char *p;
1123
1124     if (len < 2)
1125         return 0;
1126     p = *in;
1127     if (p[0] == '\0' && p[1] == '\0') {
1128         *in += 2;
1129         return 1;
1130     }
1131     return 0;
1132 }
1133
1134 /*
1135  * Check an ASN1 tag and length: a bit like ASN1_get_object but it sets the
1136  * length for indefinite length constructed form, we don't know the exact
1137  * length but we can set an upper bound to the amount of data available minus
1138  * the header length just read.
1139  */
1140
1141 static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
1142                            char *inf, char *cst,
1143                            const unsigned char **in, long len,
1144                            int exptag, int expclass, char opt, ASN1_TLC *ctx)
1145 {
1146     int i;
1147     int ptag, pclass;
1148     long plen;
1149     const unsigned char *p, *q;
1150     p = *in;
1151     q = p;
1152
1153     if (len <= 0) {
1154         ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_SMALL);
1155         goto err;
1156     }
1157     if (ctx != NULL && ctx->valid) {
1158         i = ctx->ret;
1159         plen = ctx->plen;
1160         pclass = ctx->pclass;
1161         ptag = ctx->ptag;
1162         p += ctx->hdrlen;
1163     } else {
1164         i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
1165         if (ctx != NULL) {
1166             ctx->ret = i;
1167             ctx->plen = plen;
1168             ctx->pclass = pclass;
1169             ctx->ptag = ptag;
1170             ctx->hdrlen = p - q;
1171             ctx->valid = 1;
1172             /*
1173              * If definite length, and no error, length + header can't exceed
1174              * total amount of data available.
1175              */
1176             if ((i & 0x81) == 0 && (plen + ctx->hdrlen) > len) {
1177                 ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
1178                 goto err;
1179             }
1180         }
1181     }
1182
1183     if ((i & 0x80) != 0) {
1184         ERR_raise(ERR_LIB_ASN1, ASN1_R_BAD_OBJECT_HEADER);
1185         goto err;
1186     }
1187     if (exptag >= 0) {
1188         if (exptag != ptag || expclass != pclass) {
1189             /*
1190              * If type is OPTIONAL, not an error: indicate missing type.
1191              */
1192             if (opt != 0)
1193                 return -1;
1194             ERR_raise(ERR_LIB_ASN1, ASN1_R_WRONG_TAG);
1195             goto err;
1196         }
1197         /*
1198          * We have a tag and class match: assume we are going to do something
1199          * with it
1200          */
1201         asn1_tlc_clear(ctx);
1202     }
1203
1204     if ((i & 1) != 0)
1205         plen = len - (p - q);
1206
1207     if (inf != NULL)
1208         *inf = i & 1;
1209
1210     if (cst != NULL)
1211         *cst = i & V_ASN1_CONSTRUCTED;
1212
1213     if (olen != NULL)
1214         *olen = plen;
1215
1216     if (oclass != NULL)
1217         *oclass = pclass;
1218
1219     if (otag != NULL)
1220         *otag = ptag;
1221
1222     *in = p;
1223     return 1;
1224
1225  err:
1226     asn1_tlc_clear(ctx);
1227     return 0;
1228 }