Added the error UNIX_TIME_LIMIT_EXCEEDED, and corrected bugs in X.509 certificate...

diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c
index c5a95f87531da3e556802bab0cc5fa11a7e06e42..823c6e1c57b83e53a906f486844d9faabb35b24d 100644 (file)
--- a/lib/gnutls_errors.c
+++ b/lib/gnutls_errors.c
@@ -102,6 +102,7 @@ static gnutls_error_entry error_algorithms[] = {
        GNUTLS_ERROR_ENTRY( GNUTLS_E_ILLEGAL_PARAMETER, 1),
        GNUTLS_ERROR_ENTRY( GNUTLS_E_FILE, 1),
        GNUTLS_ERROR_ENTRY( GNUTLS_E_ASCII_ARMOR, 1),
+       GNUTLS_ERROR_ENTRY( GNUTLS_E_UNIX_TIME_LIMIT_EXCEEDED, 1),
        {0}
 };
 

diff --git a/lib/gnutls_errors_int.h b/lib/gnutls_errors_int.h
index c1fd368719791c01f38917231f6e9c1bee17e5e1..f90f87ce843e18cddca6fe2a915c2b3e9b80b82d 100644 (file)
--- a/lib/gnutls_errors_int.h
+++ b/lib/gnutls_errors_int.h
@@ -65,6 +65,7 @@
 #define GNUTLS_E_DH_PRIME_UNACCEPTABLE -63
 #define GNUTLS_E_FILE -64
 #define GNUTLS_E_ASCII_ARMOR -65
+#define GNUTLS_E_UNIX_TIME_LIMIT_EXCEEDED -66
 
 #define GNUTLS_E_UNIMPLEMENTED_FEATURE -250
 

diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c
index 400d9b60976055d688a08321c8e7d39362bd1ea7..1b2b2f472d2abed906503ac42b49cb3b59c9a41e 100644 (file)
--- a/lib/gnutls_x509.c
+++ b/lib/gnutls_x509.c
@@ -284,6 +284,10 @@ time_t _gnutls_x509_get_time(node_asn * c2, char *root, char *when)
                        ctime = _gnutls_utcTime2gtime(ttime);
        }
 
+       /* We cannot handle dates after 2031 in 32 bit machines.
+        * a time_t of 64bits has to be used.
+        */
+               
        if (result != ASN_OK) {
                gnutls_assert();
                return (time_t) (-1);
@@ -303,7 +307,7 @@ int _gnutls_x509_get_version(node_asn * c2, char *root)
        len = sizeof(gversion) - 1;
        if ((result = asn1_read_value(c2, name, gversion, &len)) < 0) {
                gnutls_assert();
-               return (-1);
+               return GNUTLS_E_ASN1_PARSING_ERROR;
        }
        return (int) gversion[0] + 1;
 }
@@ -1747,7 +1751,20 @@ int _gnutls_x509_cert2gnutls_cert(gnutls_cert * gCert, gnutls_datum derCert)
            _gnutls_x509_get_time(c2, "certificate2", "notAfter");
        gCert->activation_time =
            _gnutls_x509_get_time(c2, "certificate2", "notBefore");
+
+       if (gCert->expiration_time == (time_t)(-1) ||
+               gCert->activation_time == (time_t)(-1)) {
+               gnutls_assert();
+               asn1_delete_structure(c2);
+               return GNUTLS_E_UNIX_TIME_LIMIT_EXCEEDED;
+       }
+
        gCert->version = _gnutls_x509_get_version(c2, "certificate2");
+       if (gCert->version < 0) {
+               gnutls_assert();
+               asn1_delete_structure(c2);
+               return GNUTLS_E_ASN1_PARSING_ERROR;  
+       }        
 
        if ((result =
             _gnutls_get_ext_type(c2,

diff --git a/lib/x509_ASN.c b/lib/x509_ASN.c
index 4dd4765a545986657f2de6974df10da8638d2574..f5fa45abdc899bc3c178b869faf22ff6aaf1619e 100644 (file)
--- a/lib/x509_ASN.c
+++ b/lib/x509_ASN.c
@@ -1864,10 +1864,13 @@ yylex()
   *
   * Returns:
   *
-  * ASN_OK: the file has a correct syntax and every identifier is known. 
-  * ASN_FILE_NOT_FOUND: an error occured while opening FILE_NAME.
-  * ASN_SYNTAX_ERROR: the syntax is not correct.
-  * ASN_IDENTIFIER_NOT_FOUND: in the file there is an identifier that is not defined.
+  * ASN_OK\: the file has a correct syntax and every identifier is known. 
+  *
+  * ASN_FILE_NOT_FOUND\: an error occured while opening FILE_NAME.
+  *
+  * ASN_SYNTAX_ERROR\: the syntax is not correct.
+  *
+  * ASN_IDENTIFIER_NOT_FOUND\: in the file there is an identifier that is not defined.
   **/
 int asn1_parser_asn1(char *file_name,node_asn **pointer){
   p_tree=NULL;
@@ -1916,10 +1919,13 @@ int asn1_parser_asn1(char *file_name,node_asn **pointer){
   *
   * Returns:
   *
-  *  ASN_OK: the file has a correct syntax and every identifier is known. 
-  *  ASN_FILE_NOT_FOUND: an error occured while opening FILE_NAME.
-  *  ASN_SYNTAX_ERROR: the syntax is not correct.
-  *  ASN_IDENTIFIER_NOT_FOUND: in the file there is an identifier that is not defined.
+  *  ASN_OK\: the file has a correct syntax and every identifier is known. 
+  *
+  *  ASN_FILE_NOT_FOUND\: an error occured while opening FILE_NAME.
+  *
+  *  ASN_SYNTAX_ERROR\: the syntax is not correct.
+  *
+  *  ASN_IDENTIFIER_NOT_FOUND\: in the file there is an identifier that is not defined.
   **/
 int asn1_parser_asn1_file_c(char *file_name){
   int result;

diff --git a/lib/x509_asn1.c b/lib/x509_asn1.c
index 999cbddf1535fe08db025b374f5f8201751ad897..a70510b705d1db927312e3265cd3134df20fad89 100755 (executable)
--- a/lib/x509_asn1.c
+++ b/lib/x509_asn1.c
@@ -30,7 +30,7 @@
 #include "x509_asn1.h" 
 #include "x509_der.h"
 #include <gnutls_str.h>
-
+#include <gnutls_errors.h>
 
 /* define used for visiting trees */
 #define UP     1
@@ -436,7 +436,10 @@ _asn1_convert_integer(char *value,unsigned char *value_out,int value_out_size, i
      (!negative && (val[k]&0x80))) k--; 
 
   for(k2=k;k2<4;k2++) {
-    if (k2-k > value_out_size-1) return ASN_MEM_ERROR;
+    if (k2-k > value_out_size-1) {
+        gnutls_assert();
+       return ASN_MEM_ERROR;
+    }
     /* VALUE_OUT is too short to contain the value convertion */
     value_out[k2-k]=val[k2];
   }
@@ -1299,6 +1302,7 @@ asn1_write_value(node_asn *node_root,char *name,unsigned char *value,int len)
 #define PUT_VALUE( ptr, ptr_size, data, data_size) \
        *len = data_size; \
        if (ptr_size < data_size) { \
+               gnutls_assert(); \
                return ASN_MEM_ERROR; \
        } else { \
                memcpy( ptr, data, data_size); \
@@ -1307,6 +1311,7 @@ asn1_write_value(node_asn *node_root,char *name,unsigned char *value,int len)
 #define PUT_STR_VALUE( ptr, ptr_size, data) \
        *len = strlen(data) + 1; \
        if (ptr_size < *len) { \
+               gnutls_assert(); \
                return ASN_MEM_ERROR; \
        } else { \
                /* this strcpy is checked */ \
@@ -1316,6 +1321,7 @@ asn1_write_value(node_asn *node_root,char *name,unsigned char *value,int len)
 #define ADD_STR_VALUE( ptr, ptr_size, data) \
        *len = strlen(data) + 1; \
        if (ptr_size < strlen(ptr)+(*len)) { \
+               gnutls_assert(); \
                return ASN_MEM_ERROR; \
        } else { \
                /* this strcat is checked */ \

diff --git a/lib/x509_der.c b/lib/x509_der.c
index e966c96626719c91171b4bf10a5d6f65b4a5c59f..8c41ae5fcb8862e38ba120565d44fc2429b1b5ca 100644 (file)
--- a/lib/x509_der.c
+++ b/lib/x509_der.c
@@ -29,7 +29,7 @@
 #include "x509_der.h"
 #include "x509_asn1.h"
 #include <gnutls_str.h>
-
+#include <gnutls_errors.h>
 
 #define TAG_BOOLEAN          0x01
 #define TAG_INTEGER          0x02
@@ -192,9 +192,12 @@ _asn1_get_octet_der(unsigned char *der,int *der_len,unsigned char *str,int str_s
 
   if(str==NULL) return ASN_OK;
   *str_len=_asn1_get_length_der(der,&len_len);
-  if ( str_size > *str_len)
+  if ( str_size >= *str_len)
          memcpy(str,der+len_len,*str_len);
-  else return ASN_MEM_ERROR;
+  else {
+       gnutls_assert();
+       return ASN_MEM_ERROR;
+  }
   *der_len=*str_len+len_len;
   
   return ASN_OK;
@@ -369,10 +372,12 @@ _asn1_get_bit_der(unsigned char *der,int *der_len,unsigned char *str, int str_si
   if(str==NULL) return ASN_OK;
   len_byte=_asn1_get_length_der(der,&len_len)-1;
   
-  if (str_size > len_byte)
+  if (str_size >= len_byte)
        memcpy(str,der+len_len+1,len_byte);
-  else return ASN_MEM_ERROR;
-  
+  else {
+       gnutls_assert();
+       return ASN_MEM_ERROR;
+  }
   *bit_len=len_byte*8-der[len_len];
   *der_len=len_byte+len_len+1;
 

diff --git a/lib/x509_verify.c b/lib/x509_verify.c
index ec62abedaac164a76d457d7000fd175d8557cf75..f0d99070eb90f2a1e3b414a2cdc9f69bac973f41 100644 (file)
--- a/lib/x509_verify.c
+++ b/lib/x509_verify.c
@@ -149,7 +149,6 @@ static int check_if_expired(gnutls_cert * cert)
 
        /* get the issuer of 'cert'
         */
-
        if (time(NULL) < cert->expiration_time)
                ret = 0;
 
@@ -330,7 +329,7 @@ int gnutls_verify_certificate2(gnutls_cert * cert, gnutls_cert * trusted_cas, in
        ret = check_if_expired( issuer);
        if (ret != 0) {
                gnutls_assert();
-               return ret_else|GNUTLS_CERT_EXPIRED;
+               return ret_else | GNUTLS_CERT_EXPIRED;
        }
        
         ret = gnutls_x509_verify_signature(cert, issuer);