better use of asn1_der_coding() to avoid using static buffers.

diff --git a/lib/gnutls_dh_primes.c b/lib/gnutls_dh_primes.c
index cb64cc6d7b6af5e42ea2be082ebdc33dda2bef50..f8635509d93f4c78268bf636efbde2523b546704 100644 (file)
--- a/lib/gnutls_dh_primes.c
+++ b/lib/gnutls_dh_primes.c
@@ -397,6 +397,8 @@ int gnutls_dh_params_export_pkcs3( gnutls_dh_params params,
        }
 
        if (format == GNUTLS_X509_FMT_DER) {
+               if (params_data == NULL) *params_data_size = 0;
+
                if ((result=asn1_der_coding( c2, "", params_data, params_data_size, NULL)) != ASN1_SUCCESS) {
                        gnutls_assert();
                        asn1_delete_structure(&c2);
@@ -410,12 +412,22 @@ int gnutls_dh_params_export_pkcs3( gnutls_dh_params params,
                asn1_delete_structure(&c2);
 
        } else { /* PEM */
-               opaque tmp[5*1024];
+               opaque *tmp;
                opaque *out;
-               int len = sizeof(tmp) - 1;
+               int len;
+
+               len = 0;
+               asn1_der_coding( c2, "", NULL, &len, NULL);
 
+               tmp = gnutls_alloca( len);
+               if (tmp == NULL) {
+                       gnutls_assert();
+                       return GNUTLS_E_MEMORY_ERROR;
+               }
+               
                if ((result=asn1_der_coding( c2, "", tmp, &len, NULL)) != ASN1_SUCCESS) {
                        gnutls_assert();
+                       gnutls_afree( tmp);
                        asn1_delete_structure(&c2);
                        return _gnutls_asn2err(result);
                }
@@ -425,6 +437,8 @@ int gnutls_dh_params_export_pkcs3( gnutls_dh_params params,
                result = _gnutls_fbase64_encode("DH PARAMETERS",
                                                tmp, len, &out);
 
+               gnutls_afree( tmp);
+
                if (result < 0) {
                        gnutls_assert();
                        return result;

diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c
index e3cc2196c7acddcd6f4fc54a5e69fe4b378ba8ce..68cb2c85cd33280bdb21c801178728d5ed709076 100644 (file)
--- a/lib/gnutls_errors.c
+++ b/lib/gnutls_errors.c
@@ -239,7 +239,7 @@ int _gnutls_asn2err( int asn_err) {
                case ASN1_SYNTAX_ERROR:
                        return GNUTLS_E_ASN1_SYNTAX_ERROR;
                case ASN1_MEM_ERROR:
-                       return GNUTLS_E_MEMORY_ERROR;
+                       return GNUTLS_E_SHORT_MEMORY_BUFFER;
                case ASN1_DER_OVERFLOW:
                        return GNUTLS_E_ASN1_DER_OVERFLOW;
                default:

diff --git a/lib/gnutls_pk.c b/lib/gnutls_pk.c
index 7aa969f2d7d1fce9d3d7fa5dca0b6fdce376312f..48205210ea811ede78467fc378d8469e6713d0f9 100644 (file)
--- a/lib/gnutls_pk.c
+++ b/lib/gnutls_pk.c
@@ -362,6 +362,8 @@ size_t tot_len = 0;
                asn1_delete_structure(&sig);
        }
 
+       if (sig_value->data == NULL) sig_value->size = 0;
+
        result = asn1_der_coding( sig, "", sig_value->data, &sig_value->size, NULL);
        if (result != ASN1_SUCCESS) {
                gnutls_assert();

diff --git a/lib/x509/crq.c b/lib/x509/crq.c
index d9efd04090b2a2f885eac6c529a7e5c25a560ed3..528d3e733add17392b9eb13db452f3dff92fcbae 100644 (file)
--- a/lib/x509/crq.c
+++ b/lib/x509/crq.c
@@ -219,7 +219,6 @@ static int parse_attribute(ASN1_TYPE asn1_struct,
        char tmpbuffer3[64];
        char counter[MAX_INT_DIGITS];
        char value[200];
-       char escaped[256];
        char oid[128];
        int len, printable;
 
@@ -456,7 +455,8 @@ int der_size, result;
                return _gnutls_asn2err(result);
        }
 
-       der_size = MAX_PARAMETER_SIZE*2 + 128;
+       _gnutls_x509_write_rsa_params( key->params, key->params_size, NULL, &der_size);
+
        der = gnutls_alloca( der_size);
        if (der == NULL) {
                gnutls_assert();

diff --git a/lib/x509/dn.c b/lib/x509/dn.c
index 0d15df1c4bfdd9d3ed4c1a4d8799d6692728e569..5803e582fa7976ee1a65ba82f0a57ff4290886be 100644 (file)
--- a/lib/x509/dn.c
+++ b/lib/x509/dn.c
@@ -482,7 +482,8 @@ int _gnutls_x509_parse_dn_oid(ASN1_TYPE asn1_struct,
 }
 
 /* This will encode and write the AttributeTypeAndValue field.
- * multi must be zero if writing an AttributeTypeAndValue, and 1 if Attribute.
+ * 'multi' must be zero if writing an AttributeTypeAndValue, and 1 if Attribute.
+ * In all cases only one value is written.
  */
 int _gnutls_x509_encode_and_write_attribute( const char* given_oid, ASN1_TYPE asn1_struct, 
        const char* where, const unsigned char* data, int sizeof_data, int multi) 
@@ -548,9 +549,10 @@ int der_len, result;
                return _gnutls_asn2err(result);
        }
 
-       der_len = sizeof_data + 64;
-       der = gnutls_alloca( der_len);
+       der_len = 0;
+       asn1_der_coding( c2, "", NULL, &der_len, NULL);
 
+       der = gnutls_alloca( der_len);
        result = asn1_der_coding( c2, "", der, &der_len, NULL);
        
        asn1_delete_structure( &c2);

diff --git a/lib/x509/mpi.c b/lib/x509/mpi.c
index 8f78ad66a33fa1a61a1f3a8dfdde74698f447030..8e8cb69c5e0c89ac576d5458d1b8d0789d97d4ab 100644 (file)
--- a/lib/x509/mpi.c
+++ b/lib/x509/mpi.c
@@ -309,6 +309,7 @@ int _gnutls_x509_write_rsa_params( GNUTLS_MPI * params, int params_size,
                return result;
        }
 
+       if (der == NULL) *dersize = 0;
        result = asn1_der_coding( spk, "", der, dersize, NULL);
 
        asn1_delete_structure(&spk);

diff --git a/lib/x509/sign.c b/lib/x509/sign.c
index c6ff7ee6090ab8b9a1965c6de6d0bae266b2a351..2c878b88b1672bb6367e41ac4828d59dc5f6d97d 100644 (file)
--- a/lib/x509/sign.c
+++ b/lib/x509/sign.c
@@ -85,7 +85,9 @@ const char* algo;
                return _gnutls_asn2err(result);
        }
 
-       info->size = 128;
+       info->size = 0;
+       asn1_der_coding( dinfo, "", NULL, &info->size, NULL);
+
        info->data = gnutls_malloc( info->size);
        if (info->data == NULL) {
                gnutls_assert();
@@ -200,21 +202,33 @@ int _gnutls_x509_sign_tbs( ASN1_TYPE cert, const char* tbs_name,
        gnutls_mac_algorithm hash, gnutls_x509_privkey signer, gnutls_datum* signature) 
 {
 int result;
-opaque buf[MAX_X509_CERT_SIZE];
-int buf_size = sizeof(buf);
+opaque *buf;
+int buf_size;
 gnutls_datum tbs;
 
+       buf_size = 0;
+       asn1_der_coding( cert, tbs_name, NULL, &buf_size, NULL);
+
+       buf = gnutls_alloca( buf_size);
+       if (buf == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_MEMORY_ERROR;
+       }
+
        result = asn1_der_coding( cert, tbs_name, buf, &buf_size, NULL);
        
        if (result != ASN1_SUCCESS) {
                gnutls_assert();
+               gnutls_afree(buf);
                return _gnutls_asn2err(result);
        }
 
        tbs.data = buf;
        tbs.size = buf_size;
        
-       return _gnutls_x509_sign( &tbs, hash, signer, signature);
-
+       result = _gnutls_x509_sign( &tbs, hash, signer, signature);
+       gnutls_afree(buf);
+       
+       return result;
 }
 

diff --git a/lib/x509/verify.c b/lib/x509/verify.c
index 6e3097858b952dffb87750f8816acc427ec7001b..ec44ab63f14456eb8ab5c75b1f7ffc654d2fadfd 100644 (file)
--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
@@ -35,6 +35,7 @@
 #include <dn.h>
 #include <x509.h>
 #include <mpi.h>
+#include <common.h>
 #include <verify.h>
 
 static int _gnutls_verify_certificate2(gnutls_x509_crt cert,

diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index c72c3f322994f6eb77c2608c334a421c451e6790..00f4f2757b8a00cb56fb76d59b8e74c6fda1120a 100644 (file)
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -978,8 +978,8 @@ int gnutls_x509_crt_get_fingerprint(gnutls_x509_crt cert,
        gnutls_digest_algorithm algo, char *buf,
         int *sizeof_buf)
 {
-opaque cert_buf[MAX_X509_CERT_SIZE];
-int cert_buf_size = sizeof( cert_buf);
+opaque *cert_buf;
+int cert_buf_size;
 int result;
 gnutls_datum tmp;
 
@@ -987,18 +987,31 @@ gnutls_datum tmp;
                return GNUTLS_E_INVALID_REQUEST;
        }
 
+       cert_buf_size = 0;
+       asn1_der_coding( cert->cert, "", NULL, &cert_buf_size, NULL);
+
+       cert_buf = gnutls_alloca( cert_buf_size);
+       if (cert_buf == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_MEMORY_ERROR;
+       }
+
        result = asn1_der_coding( cert->cert, "",
                cert_buf, &cert_buf_size, NULL);
        
        if (result != ASN1_SUCCESS) {
                gnutls_assert();
+               gnutls_afree( cert_buf);
                return _gnutls_asn2err(result);
        }
        
        tmp.data = cert_buf;
        tmp.size = cert_buf_size;
 
-       return gnutls_fingerprint( algo, &tmp, buf, sizeof_buf);
+       result = gnutls_fingerprint( algo, &tmp, buf, sizeof_buf);
+       gnutls_afree( cert_buf);
+
+       return result;
 }
 
 
@@ -1012,6 +1025,8 @@ int _gnutls_x509_export_int( ASN1_TYPE asn1_data,
        int result;
        
        if (format == GNUTLS_X509_FMT_DER) {
+               if (output_data == NULL) *output_data_size = 0;
+       
                if ((result=asn1_der_coding( asn1_data, "", output_data, output_data_size, NULL)) != ASN1_SUCCESS) {
                        gnutls_assert();