Fix bug where freed OIDs could be accessed in EVP_cleanup() by
[openssl.git] / crypto / objects / obj_dat.c
index cfc082add33ef0f1f422376aef3a4467ddb400a5..aca492d1df87f430ef8e4d91a641d99bdd149c67 100644 (file)
 
 #include <stdio.h>
 #include <ctype.h>
+#include <limits.h>
 #include "cryptlib.h"
 #include <openssl/lhash.h>
 #include <openssl/asn1.h>
 #include <openssl/objects.h>
 
 /* obj_dat.h is generated from objects.h by obj_dat.pl */
-#ifndef NO_OBJECT
+#ifndef OPENSSL_NO_OBJECT
 #include "obj_dat.h"
 #else
 /* You will have to load all the objects needed manually in the application */
@@ -79,9 +80,9 @@ static ASN1_OBJECT *ln_objs[1];
 static ASN1_OBJECT *obj_objs[1];
 #endif
 
-static int sn_cmp(ASN1_OBJECT **a, ASN1_OBJECT **b);
-static int ln_cmp(ASN1_OBJECT **a, ASN1_OBJECT **b);
-static int obj_cmp(ASN1_OBJECT **a, ASN1_OBJECT **b);
+static int sn_cmp(const void *a, const void *b);
+static int ln_cmp(const void *a, const void *b);
+static int obj_cmp(const void *a, const void *b);
 #define ADDED_DATA     0
 #define ADDED_SNAME    1
 #define ADDED_LNAME    2
@@ -96,18 +97,26 @@ typedef struct added_obj_st
 static int new_nid=NUM_NID;
 static LHASH *added=NULL;
 
-static int sn_cmp(ASN1_OBJECT **ap, ASN1_OBJECT **bp)
-       { return(strcmp((*ap)->sn,(*bp)->sn)); }
+static int sn_cmp(const void *a, const void *b)
+       {
+       const ASN1_OBJECT * const *ap = a, * const *bp = b;
+       return(strcmp((*ap)->sn,(*bp)->sn));
+       }
 
-static int ln_cmp(ASN1_OBJECT **ap, ASN1_OBJECT **bp)
-       { return(strcmp((*ap)->ln,(*bp)->ln)); }
+static int ln_cmp(const void *a, const void *b)
+       { 
+       const ASN1_OBJECT * const *ap = a, * const *bp = b;
+       return(strcmp((*ap)->ln,(*bp)->ln));
+       }
 
-static unsigned long add_hash(ADDED_OBJ *ca)
+/* static unsigned long add_hash(ADDED_OBJ *ca) */
+static unsigned long add_hash(const void *ca_void)
        {
-       ASN1_OBJECT *a;
+       const ASN1_OBJECT *a;
        int i;
        unsigned long ret=0;
        unsigned char *p;
+       const ADDED_OBJ *ca = (const ADDED_OBJ *)ca_void;
 
        a=ca->obj;
        switch (ca->type)
@@ -128,17 +137,21 @@ static unsigned long add_hash(ADDED_OBJ *ca)
                ret=a->nid;
                break;
        default:
-               abort();
+               /* abort(); */
+               return 0;
                }
        ret&=0x3fffffffL;
        ret|=ca->type<<30L;
        return(ret);
        }
 
-static int add_cmp(ADDED_OBJ *ca, ADDED_OBJ *cb)
+/* static int add_cmp(ADDED_OBJ *ca, ADDED_OBJ *cb) */
+static int add_cmp(const void *ca_void, const void *cb_void)
        {
        ASN1_OBJECT *a,*b;
        int i;
+       const ADDED_OBJ *ca = (const ADDED_OBJ *)ca_void;
+       const ADDED_OBJ *cb = (const ADDED_OBJ *)cb_void;
 
        i=ca->type-cb->type;
        if (i) return(i);
@@ -149,7 +162,7 @@ static int add_cmp(ADDED_OBJ *ca, ADDED_OBJ *cb)
        case ADDED_DATA:
                i=(a->length - b->length);
                if (i) return(i);
-               return(memcmp(a->data,b->data,a->length));
+               return(memcmp(a->data,b->data,(size_t)a->length));
        case ADDED_SNAME:
                if (a->sn == NULL) return(-1);
                else if (b->sn == NULL) return(1);
@@ -161,9 +174,9 @@ static int add_cmp(ADDED_OBJ *ca, ADDED_OBJ *cb)
        case ADDED_NID:
                return(a->nid-b->nid);
        default:
-               abort();
+               /* abort(); */
+               return 0;
                }
-       return(1); /* should not get here */
        }
 
 static int init_added(void)
@@ -188,16 +201,38 @@ static void cleanup3(ADDED_OBJ *a)
        {
        if (--a->obj->nid == 0)
                ASN1_OBJECT_free(a->obj);
-       Free(a);
+       OPENSSL_free(a);
+       }
+
+static IMPLEMENT_LHASH_DOALL_FN(cleanup1, ADDED_OBJ *)
+static IMPLEMENT_LHASH_DOALL_FN(cleanup2, ADDED_OBJ *)
+static IMPLEMENT_LHASH_DOALL_FN(cleanup3, ADDED_OBJ *)
+
+/* The purpose of obj_cleanup_defer is to avoid EVP_cleanup() attempting
+ * to use freed up OIDs. If neccessary the actual freeing up of OIDs is
+ * delayed.
+ */
+
+int obj_cleanup_defer = 0;
+
+void check_defer(int nid)
+       {
+       if (obj_cleanup_defer && nid >= NUM_NID)
+                       obj_cleanup_defer = 1;
        }
 
 void OBJ_cleanup(void)
        {
+       if (obj_cleanup_defer)
+               {
+               obj_cleanup_defer = 2;
+               return ;
+               }
        if (added == NULL) return;
        added->down_load=0;
-       lh_doall(added,cleanup1); /* zero counters */
-       lh_doall(added,cleanup2); /* set counters */
-       lh_doall(added,cleanup3); /* free objects */
+       lh_doall(added,LHASH_DOALL_FN(cleanup1)); /* zero counters */
+       lh_doall(added,LHASH_DOALL_FN(cleanup2)); /* set counters */
+       lh_doall(added,LHASH_DOALL_FN(cleanup3)); /* free objects */
        lh_free(added);
        added=NULL;
        }
@@ -211,26 +246,22 @@ int OBJ_new_nid(int num)
        return(i);
        }
 
-int OBJ_add_object(ASN1_OBJECT *obj)
+int OBJ_add_object(const ASN1_OBJECT *obj)
        {
        ASN1_OBJECT *o;
-       ADDED_OBJ *ao[4],*aop;
+       ADDED_OBJ *ao[4]={NULL,NULL,NULL,NULL},*aop;
        int i;
 
        if (added == NULL)
                if (!init_added()) return(0);
        if ((o=OBJ_dup(obj)) == NULL) goto err;
-       ao[ADDED_DATA]=NULL;
-       ao[ADDED_SNAME]=NULL;
-       ao[ADDED_LNAME]=NULL;
-       ao[ADDED_NID]=NULL;
-       ao[ADDED_NID]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));
+       if (!(ao[ADDED_NID]=(ADDED_OBJ *)OPENSSL_malloc(sizeof(ADDED_OBJ)))) goto err2;
        if ((o->length != 0) && (obj->data != NULL))
-               ao[ADDED_DATA]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));
+               if (!(ao[ADDED_DATA]=(ADDED_OBJ *)OPENSSL_malloc(sizeof(ADDED_OBJ)))) goto err2;
        if (o->sn != NULL)
-               ao[ADDED_SNAME]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));
+               if (!(ao[ADDED_SNAME]=(ADDED_OBJ *)OPENSSL_malloc(sizeof(ADDED_OBJ)))) goto err2;
        if (o->ln != NULL)
-               ao[ADDED_LNAME]=(ADDED_OBJ *)Malloc(sizeof(ADDED_OBJ));
+               if (!(ao[ADDED_LNAME]=(ADDED_OBJ *)OPENSSL_malloc(sizeof(ADDED_OBJ)))) goto err2;
 
        for (i=ADDED_DATA; i<=ADDED_NID; i++)
                {
@@ -238,20 +269,22 @@ int OBJ_add_object(ASN1_OBJECT *obj)
                        {
                        ao[i]->type=i;
                        ao[i]->obj=o;
-                       aop=(ADDED_OBJ *)lh_insert(added,(char *)ao[i]);
+                       aop=(ADDED_OBJ *)lh_insert(added,ao[i]);
                        /* memory leak, buit should not normally matter */
                        if (aop != NULL)
-                               Free(aop);
+                               OPENSSL_free(aop);
                        }
                }
        o->flags&= ~(ASN1_OBJECT_FLAG_DYNAMIC|ASN1_OBJECT_FLAG_DYNAMIC_STRINGS|
                        ASN1_OBJECT_FLAG_DYNAMIC_DATA);
 
        return(o->nid);
+err2:
+       OBJerr(OBJ_F_OBJ_ADD_OBJECT,ERR_R_MALLOC_FAILURE);
 err:
        for (i=ADDED_DATA; i<=ADDED_NID; i++)
-               if (ao[i] != NULL) Free(ao[i]);
-       if (o != NULL) Free(o);
+               if (ao[i] != NULL) OPENSSL_free(ao[i]);
+       if (o != NULL) OPENSSL_free(o);
        return(NID_undef);
        }
 
@@ -276,7 +309,7 @@ ASN1_OBJECT *OBJ_nid2obj(int n)
                ad.type=ADDED_NID;
                ad.obj= &ob;
                ob.nid=n;
-               adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+               adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                if (adp != NULL)
                        return(adp->obj);
                else
@@ -308,7 +341,7 @@ const char *OBJ_nid2sn(int n)
                ad.type=ADDED_NID;
                ad.obj= &ob;
                ob.nid=n;
-               adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+               adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                if (adp != NULL)
                        return(adp->obj->sn);
                else
@@ -340,7 +373,7 @@ const char *OBJ_nid2ln(int n)
                ad.type=ADDED_NID;
                ad.obj= &ob;
                ob.nid=n;
-               adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+               adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                if (adp != NULL)
                        return(adp->obj->ln);
                else
@@ -351,7 +384,7 @@ const char *OBJ_nid2ln(int n)
                }
        }
 
-int OBJ_obj2nid(ASN1_OBJECT *a)
+int OBJ_obj2nid(const ASN1_OBJECT *a)
        {
        ASN1_OBJECT **op;
        ADDED_OBJ ad,*adp;
@@ -364,12 +397,12 @@ int OBJ_obj2nid(ASN1_OBJECT *a)
        if (added != NULL)
                {
                ad.type=ADDED_DATA;
-               ad.obj=a;
-               adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+               ad.obj=(ASN1_OBJECT *)a; /* XXX: ugly but harmless */
+               adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                if (adp != NULL) return (adp->obj->nid);
                }
-       op=(ASN1_OBJECT **)OBJ_bsearch((char *)&a,(char *)obj_objs,NUM_OBJ,
-               sizeof(ASN1_OBJECT *),(int (*)())obj_cmp);
+       op=(ASN1_OBJECT **)OBJ_bsearch((const char *)&a,(const char *)obj_objs,
+               NUM_OBJ, sizeof(ASN1_OBJECT *),obj_cmp);
        if (op == NULL)
                return(NID_undef);
        return((*op)->nid);
@@ -385,7 +418,9 @@ ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)
        {
        int nid = NID_undef;
        ASN1_OBJECT *op=NULL;
-       unsigned char *buf,*p;
+       unsigned char *buf;
+       unsigned char *p;
+       const unsigned char *cp;
        int i, j;
 
        if(!no_name) {
@@ -397,28 +432,187 @@ ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)
        /* Work out size of content octets */
        i=a2d_ASN1_OBJECT(NULL,0,s,-1);
        if (i <= 0) {
-               /* Clear the error */
-               ERR_get_error();
+               /* Don't clear the error */
+               /*ERR_clear_error();*/
                return NULL;
        }
        /* Work out total size */
        j = ASN1_object_size(0,i,V_ASN1_OBJECT);
 
-       if((buf=(unsigned char *)Malloc(j)) == NULL) return NULL;
+       if((buf=(unsigned char *)OPENSSL_malloc(j)) == NULL) return NULL;
 
        p = buf;
        /* Write out tag+length */
        ASN1_put_object(&p,0,i,V_ASN1_OBJECT,V_ASN1_UNIVERSAL);
        /* Write out contents */
        a2d_ASN1_OBJECT(p,i,s,-1);
-       
-       p=buf;
-       op=d2i_ASN1_OBJECT(NULL,&p,i);
-       Free(buf);
+
+       cp=buf;
+       op=d2i_ASN1_OBJECT(NULL,&cp,j);
+       OPENSSL_free(buf);
        return op;
        }
 
-int OBJ_txt2nid(char *s)
+int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
+{
+       int i,n=0,len,nid, first, use_bn;
+       BIGNUM *bl;
+       unsigned long l;
+       unsigned char *p;
+       char tbuf[DECIMAL_SIZE(i)+DECIMAL_SIZE(l)+2];
+
+       if ((a == NULL) || (a->data == NULL)) {
+               buf[0]='\0';
+               return(0);
+       }
+
+
+       if (!no_name && (nid=OBJ_obj2nid(a)) != NID_undef)
+               {
+               const char *s;
+               s=OBJ_nid2ln(nid);
+               if (s == NULL)
+                       s=OBJ_nid2sn(nid);
+               if (buf)
+                       BUF_strlcpy(buf,s,buf_len);
+               n=strlen(s);
+               return n;
+               }
+
+
+       len=a->length;
+       p=a->data;
+
+       first = 1;
+       bl = NULL;
+
+       while (len > 0)
+               {
+               l=0;
+               use_bn = 0;
+               for (;;)
+                       {
+                       unsigned char c = *p++;
+                       len--;
+                       if ((len == 0) && (c & 0x80))
+                               goto err;
+                       if (use_bn)
+                               {
+                               if (!BN_add_word(bl, c & 0x7f))
+                                       goto err;
+                               }
+                       else
+                               l |= c  & 0x7f;
+                       if (!(c & 0x80))
+                               break;
+                       if (!use_bn && (l > (ULONG_MAX >> 7L)))
+                               {
+                               if (!bl && !(bl = BN_new()))
+                                       goto err;
+                               if (!BN_set_word(bl, l))
+                                       goto err;
+                               use_bn = 1;
+                               }
+                       if (use_bn)
+                               {
+                               if (!BN_lshift(bl, bl, 7))
+                                       goto err;
+                               }
+                       else
+                               l<<=7L;
+                       }
+
+               if (first)
+                       {
+                       first = 0;
+                       if (l >= 80)
+                               {
+                               i = 2;
+                               if (use_bn)
+                                       {
+                                       if (!BN_sub_word(bl, 80))
+                                               goto err;
+                                       }
+                               else
+                                       l -= 80;
+                               }
+                       else
+                               {
+                               i=(int)(l/40);
+                               l-=(long)(i*40);
+                               }
+                       if (buf && (buf_len > 0))
+                               {
+                               *buf++ = i + '0';
+                               buf_len--;
+                               }
+                       n++;
+                       }
+
+               if (use_bn)
+                       {
+                       char *bndec;
+                       bndec = BN_bn2dec(bl);
+                       if (!bndec)
+                               goto err;
+                       i = strlen(bndec);
+                       if (buf)
+                               {
+                               if (buf_len > 0)
+                                       {
+                                       *buf++ = '.';
+                                       buf_len--;
+                                       }
+                               BUF_strlcpy(buf,bndec,buf_len);
+                               if (i > buf_len)
+                                       {
+                                       buf += buf_len;
+                                       buf_len = 0;
+                                       }
+                               else
+                                       {
+                                       buf+=i;
+                                       buf_len-=i;
+                                       }
+                               }
+                       n++;
+                       n += i;
+                       OPENSSL_free(bndec);
+                       }
+               else
+                       {
+                       BIO_snprintf(tbuf,sizeof tbuf,".%lu",l);
+                       i=strlen(tbuf);
+                       if (buf && (buf_len > 0))
+                               {
+                               BUF_strlcpy(buf,tbuf,buf_len);
+                               if (i > buf_len)
+                                       {
+                                       buf += buf_len;
+                                       buf_len = 0;
+                                       }
+                               else
+                                       {
+                                       buf+=i;
+                                       buf_len-=i;
+                                       }
+                               }
+                       n+=i;
+                       l=0;
+                       }
+               }
+
+       if (bl)
+               BN_free(bl);
+       return n;
+
+       err:
+       if (bl)
+               BN_free(bl);
+       return -1;
+}
+
+int OBJ_txt2nid(const char *s)
 {
        ASN1_OBJECT *obj;
        int nid;
@@ -438,11 +632,11 @@ int OBJ_ln2nid(const char *s)
                {
                ad.type=ADDED_LNAME;
                ad.obj= &o;
-               adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+               adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                if (adp != NULL) return (adp->obj->nid);
                }
-       op=(ASN1_OBJECT **)OBJ_bsearch((char *)&oo,(char *)ln_objs,NUM_LN,
-               sizeof(ASN1_OBJECT *),(int (*)())ln_cmp);
+       op=(ASN1_OBJECT **)OBJ_bsearch((char *)&oo,(char *)ln_objs, NUM_LN,
+               sizeof(ASN1_OBJECT *),ln_cmp);
        if (op == NULL) return(NID_undef);
        return((*op)->nid);
        }
@@ -457,30 +651,37 @@ int OBJ_sn2nid(const char *s)
                {
                ad.type=ADDED_SNAME;
                ad.obj= &o;
-               adp=(ADDED_OBJ *)lh_retrieve(added,(char *)&ad);
+               adp=(ADDED_OBJ *)lh_retrieve(added,&ad);
                if (adp != NULL) return (adp->obj->nid);
                }
        op=(ASN1_OBJECT **)OBJ_bsearch((char *)&oo,(char *)sn_objs,NUM_SN,
-               sizeof(ASN1_OBJECT *),(int (*)())sn_cmp);
+               sizeof(ASN1_OBJECT *),sn_cmp);
        if (op == NULL) return(NID_undef);
        return((*op)->nid);
        }
 
-static int obj_cmp(ASN1_OBJECT **ap, ASN1_OBJECT **bp)
+static int obj_cmp(const void *ap, const void *bp)
        {
        int j;
-       ASN1_OBJECT *a= *ap;
-       ASN1_OBJECT *b= *bp;
+       const ASN1_OBJECT *a= *(ASN1_OBJECT * const *)ap;
+       const ASN1_OBJECT *b= *(ASN1_OBJECT * const *)bp;
 
        j=(a->length - b->length);
         if (j) return(j);
        return(memcmp(a->data,b->data,a->length));
         }
 
-char *OBJ_bsearch(char *key, char *base, int num, int size, int (*cmp)())
+const char *OBJ_bsearch(const char *key, const char *base, int num, int size,
+       int (*cmp)(const void *, const void *))
+       {
+       return OBJ_bsearch_ex(key, base, num, size, cmp, 0);
+       }
+
+const char *OBJ_bsearch_ex(const char *key, const char *base, int num,
+       int size, int (*cmp)(const void *, const void *), int flags)
        {
-       int l,h,i,c;
-       char *p;
+       int l,h,i=0,c=0;
+       const char *p = NULL;
 
        if (num == 0) return(NULL);
        l=0;
@@ -495,9 +696,33 @@ char *OBJ_bsearch(char *key, char *base, int num, int size, int (*cmp)())
                else if (c > 0)
                        l=i+1;
                else
-                       return(p);
+                       break;
                }
-       return(NULL);
+#ifdef CHARSET_EBCDIC
+/* THIS IS A KLUDGE - Because the *_obj is sorted in ASCII order, and
+ * I don't have perl (yet), we revert to a *LINEAR* search
+ * when the object wasn't found in the binary search.
+ */
+       if (c != 0)
+               {
+               for (i=0; i<num; ++i)
+                       {
+                       p= &(base[i*size]);
+                       c = (*cmp)(key,p);
+                       if (c == 0 || (c < 0 && (flags & OBJ_BSEARCH_VALUE_ON_NOMATCH)))
+                               return p;
+                       }
+               }
+#endif
+       if (c != 0 && !(flags & OBJ_BSEARCH_VALUE_ON_NOMATCH))
+               p = NULL;
+       else if (c == 0 && (flags & OBJ_BSEARCH_FIRST_VALUE_ON_MATCH))
+               {
+               while(i > 0 && (*cmp)(key,&(base[(i-1)*size])) == 0)
+                       i--;
+               p = &(base[i*size]);
+               }
+       return(p);
        }
 
 int OBJ_create_objects(BIO *in)
@@ -512,26 +737,26 @@ int OBJ_create_objects(BIO *in)
                i=BIO_gets(in,buf,512);
                if (i <= 0) return(num);
                buf[i-1]='\0';
-               if (!isalnum(buf[0])) return(num);
+               if (!isalnum((unsigned char)buf[0])) return(num);
                o=s=buf;
-               while (isdigit(*s) || (*s == '.'))
+               while (isdigit((unsigned char)*s) || (*s == '.'))
                        s++;
                if (*s != '\0')
                        {
                        *(s++)='\0';
-                       while (isspace(*s))
+                       while (isspace((unsigned char)*s))
                                s++;
                        if (*s == '\0')
                                s=NULL;
                        else
                                {
                                l=s;
-                               while ((*l != '\0') && !isspace(*l))
+                               while ((*l != '\0') && !isspace((unsigned char)*l))
                                        l++;
                                if (*l != '\0')
                                        {
                                        *(l++)='\0';
-                                       while (isspace(*l))
+                                       while (isspace((unsigned char)*l))
                                                l++;
                                        if (*l == '\0') l=NULL;
                                        }
@@ -548,7 +773,7 @@ int OBJ_create_objects(BIO *in)
        /* return(num); */
        }
 
-int OBJ_create(char *oid, char *sn, char *ln)
+int OBJ_create(const char *oid, const char *sn, const char *ln)
        {
        int ok=0;
        ASN1_OBJECT *op=NULL;
@@ -558,19 +783,21 @@ int OBJ_create(char *oid, char *sn, char *ln)
        i=a2d_ASN1_OBJECT(NULL,0,oid,-1);
        if (i <= 0) return(0);
 
-       if ((buf=(unsigned char *)Malloc(i)) == NULL)
+       if ((buf=(unsigned char *)OPENSSL_malloc(i)) == NULL)
                {
-               OBJerr(OBJ_F_OBJ_CREATE,OBJ_R_MALLOC_FAILURE);
+               OBJerr(OBJ_F_OBJ_CREATE,ERR_R_MALLOC_FAILURE);
                return(0);
                }
        i=a2d_ASN1_OBJECT(buf,i,oid,-1);
+       if (i == 0)
+               goto err;
        op=(ASN1_OBJECT *)ASN1_OBJECT_create(OBJ_new_nid(1),buf,i,sn,ln);
        if (op == NULL) 
                goto err;
        ok=OBJ_add_object(op);
 err:
        ASN1_OBJECT_free(op);
-       Free((char *)buf);
+       OPENSSL_free(buf);
        return(ok);
        }