Fix for crashing INTEGERs, ENUMERATEDs and OBJECT IDENTIFIERs.

[openssl.git] / crypto / asn1 / a_int.c

diff --git a/crypto/asn1/a_int.c b/crypto/asn1/a_int.c
index 768476a0cc2d4b74da5a1eef7b448e30c3d3b18b..bcbdc7d4e128cbd995bb1a93c3ca9480b92e221c 100644 (file)
--- a/crypto/asn1/a_int.c
+++ b/crypto/asn1/a_int.c
@@ -60,6 +60,18 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 
+ASN1_INTEGER *ASN1_INTEGER_new(void)
+{ return M_ASN1_INTEGER_new();}
+
+void ASN1_INTEGER_free(ASN1_INTEGER *x)
+{ M_ASN1_INTEGER_free(x);}
+
+ASN1_INTEGER *ASN1_INTEGER_dup(ASN1_INTEGER *x)
+{ return M_ASN1_INTEGER_dup(x);}
+
+int ASN1_INTEGER_cmp(ASN1_INTEGER *x, ASN1_INTEGER *y)
+{ return M_ASN1_INTEGER_cmp(x,y);}
+
 /* 
  * This converts an ASN1 INTEGER into its DER encoding.
  * The internal representation is an ASN1_STRING whose data is a big endian
@@ -125,13 +137,8 @@ int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
 
        ASN1_put_object(&p,0,ret,V_ASN1_INTEGER,V_ASN1_UNIVERSAL);
        if (pad) *(p++)=pb;
-       if (a->length == 0)
-               *(p++)=0;
-       else if (t == V_ASN1_INTEGER)
-               {
-               memcpy(p,a->data,(unsigned int)a->length);
-               p+=a->length;
-               }
+       if (a->length == 0) *(p++)=0;
+       else if (t == V_ASN1_INTEGER) memcpy(p,a->data,(unsigned int)a->length);
        else {
                /* Begin at the end of the encoding */
                n=a->data + a->length - 1;
@@ -148,10 +155,9 @@ int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
                i--;
                /* Complement any octets left */
                for(;i > 0; i--) *(p--) = *(n--) ^ 0xff;
-               p += a->length;
        }
 
-       *pp=p;
+       *pp+=r;
        return(r);
        }
 
@@ -159,14 +165,14 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
             long length)
        {
        ASN1_INTEGER *ret=NULL;
-       unsigned char *p,*to,*s;
+       unsigned char *p,*to,*s, *pend;
        long len;
        int inf,tag,xclass;
        int i;
 
        if ((a == NULL) || ((*a) == NULL))
                {
-               if ((ret=ASN1_INTEGER_new()) == NULL) return(NULL);
+               if ((ret=M_ASN1_INTEGER_new()) == NULL) return(NULL);
                ret->type=V_ASN1_INTEGER;
                }
        else
@@ -174,6 +180,7 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
 
        p= *pp;
        inf=ASN1_get_object(&p,&len,&tag,&xclass,length);
+       pend = p + len;
        if (inf & 0x80)
                {
                i=ASN1_R_BAD_OBJECT_HEADER;
@@ -195,7 +202,12 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
                goto err;
                }
        to=s;
-       if (*p & 0x80) /* a negative number */
+       if(!len) {
+               /* Strictly speaking this is an illegal INTEGER but we
+                * tolerate it.
+                */
+               ret->type=V_ASN1_INTEGER;
+       } else if (*p & 0x80) /* a negative number */
                {
                ret->type=V_ASN1_NEG_INTEGER;
                if ((*p == 0xff) && (len != 1)) {
@@ -220,13 +232,11 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
                if(!i) {
                        *s = 1;
                        s[len] = 0;
-                       p += len;
                        len++;
                } else {
                        *(to--) = (*(p--) ^ 0xff) + 1;
                        i--;
                        for(;i > 0; i--) *(to--) = *(p--) ^ 0xff;
-                       p += len;
                }
        } else {
                ret->type=V_ASN1_INTEGER;
@@ -236,19 +246,18 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
                        len--;
                        }
                memcpy(s,p,(int)len);
-               p+=len;
        }
 
        if (ret->data != NULL) Free((char *)ret->data);
        ret->data=s;
        ret->length=(int)len;
        if (a != NULL) (*a)=ret;
-       *pp=p;
+       *pp=pend;
        return(ret);
 err:
        ASN1err(ASN1_F_D2I_ASN1_INTEGER,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-               ASN1_INTEGER_free(ret);
+               M_ASN1_INTEGER_free(ret);
        return(NULL);
        }
 
@@ -268,7 +277,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
 
        if ((a == NULL) || ((*a) == NULL))
                {
-               if ((ret=ASN1_INTEGER_new()) == NULL) return(NULL);
+               if ((ret=M_ASN1_INTEGER_new()) == NULL) return(NULL);
                ret->type=V_ASN1_INTEGER;
                }
        else
@@ -297,7 +306,8 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
                goto err;
                }
        to=s;
-               ret->type=V_ASN1_INTEGER;
+       ret->type=V_ASN1_INTEGER;
+       if(len) {
                if ((*p == 0) && (len != 1))
                        {
                        p++;
@@ -305,6 +315,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
                        }
                memcpy(s,p,(int)len);
                p+=len;
+       }
 
        if (ret->data != NULL) Free((char *)ret->data);
        ret->data=s;
@@ -315,7 +326,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
 err:
        ASN1err(ASN1_F_D2I_ASN1_UINTEGER,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-               ASN1_INTEGER_free(ret);
+               M_ASN1_INTEGER_free(ret);
        return(NULL);
        }
 
@@ -393,7 +404,7 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
        int len,j;
 
        if (ai == NULL)
-               ret=ASN1_INTEGER_new();
+               ret=M_ASN1_INTEGER_new();
        else
                ret=ai;
        if (ret == NULL)
@@ -409,7 +420,7 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
        ret->length=BN_bn2bin(bn,ret->data);
        return(ret);
 err:
-       if (ret != ai) ASN1_INTEGER_free(ret);
+       if (ret != ai) M_ASN1_INTEGER_free(ret);
        return(NULL);
        }