Fix possible memory leak.

[openssl.git] / crypto / pkcs7 / pk7_smime.c

diff --git a/crypto/pkcs7/pk7_smime.c b/crypto/pkcs7/pk7_smime.c
index 5de5b591a9e38307278436f31637a44db92028be..4607e5fd6990f8d2a01b3c49f21c766d8a2e6fd1 100644 (file)
--- a/crypto/pkcs7/pk7_smime.c
+++ b/crypto/pkcs7/pk7_smime.c
@@ -1,9 +1,9 @@
 /* pk7_smime.c */
 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
- * project 1999.
+ * project.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -97,14 +97,6 @@ PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
                        PKCS7_add_certificate(p7, sk_X509_value(certs, i));
        }
 
-       if(!(p7bio = PKCS7_dataInit(p7, NULL))) {
-               PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
-               return NULL;
-       }
-
-
-       SMIME_crlf_copy(data, p7bio, flags);
-
        if(!(flags & PKCS7_NOATTR)) {
                PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
                                V_ASN1_OBJECT, OBJ_nid2obj(NID_pkcs7_data));
@@ -133,6 +125,16 @@ PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
                }
        }
 
+       if (flags & PKCS7_STREAM)
+               return p7;
+
+       if (!(p7bio = PKCS7_dataInit(p7, NULL))) {
+               PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
+               return NULL;
+       }
+
+       SMIME_crlf_copy(data, p7bio, flags);
+
        if(flags & PKCS7_DETACHED)PKCS7_set_detached(p7, 1);
 
         if (!PKCS7_dataFinal(p7,p7bio)) {
@@ -155,7 +157,7 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
        char buf[4096];
        int i, j=0, k, ret = 0;
        BIO *p7bio;
-       BIO *tmpout;
+       BIO *tmpin, *tmpout;
 
        if(!p7) {
                PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_INVALID_NULL_POINTER);
@@ -201,11 +203,22 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
        if (!(flags & PKCS7_NOVERIFY)) for (k = 0; k < sk_X509_num(signers); k++) {
                signer = sk_X509_value (signers, k);
                if (!(flags & PKCS7_NOCHAIN)) {
-                       X509_STORE_CTX_init(&cert_ctx, store, signer,
-                                                       p7->d.sign->cert);
+                       if(!X509_STORE_CTX_init(&cert_ctx, store, signer,
+                                                       p7->d.sign->cert))
+                               {
+                               PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_X509_LIB);
+                               sk_X509_free(signers);
+                               return 0;
+                               }
                        X509_STORE_CTX_set_purpose(&cert_ctx,
                                                X509_PURPOSE_SMIME_SIGN);
-               } else X509_STORE_CTX_init (&cert_ctx, store, signer, NULL);
+               } else if(!X509_STORE_CTX_init (&cert_ctx, store, signer, NULL)) {
+                       PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_X509_LIB);
+                       sk_X509_free(signers);
+                       return 0;
+               }
+               if (!(flags & PKCS7_NOCRL))
+                       X509_STORE_CTX_set0_crls(&cert_ctx, p7->d.sign->crl);
                i = X509_verify_cert(&cert_ctx);
                if (i <= 0) j = X509_STORE_CTX_get_error(&cert_ctx);
                X509_STORE_CTX_cleanup(&cert_ctx);
@@ -219,7 +232,30 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
                /* Check for revocation status here */
        }
 
-       p7bio=PKCS7_dataInit(p7,indata);
+       /* Performance optimization: if the content is a memory BIO then
+        * store its contents in a temporary read only memory BIO. This
+        * avoids potentially large numbers of slow copies of data which will
+        * occur when reading from a read write memory BIO when signatures
+        * are calculated.
+        */
+
+       if (indata && (BIO_method_type(indata) == BIO_TYPE_MEM))
+               {
+               char *ptr;
+               long len;
+               len = BIO_get_mem_data(indata, &ptr);
+               tmpin = BIO_new_mem_buf(ptr, len);
+               if (tmpin == NULL)
+                       {
+                       PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_MALLOC_FAILURE);
+                       return 0;
+                       }
+               }
+       else
+               tmpin = indata;
+               
+
+       p7bio=PKCS7_dataInit(p7,tmpin);
 
        if(flags & PKCS7_TEXT) {
                if(!(tmpout = BIO_new(BIO_s_mem()))) {
@@ -261,9 +297,15 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
        ret = 1;
 
        err:
+       
+       if (tmpin == indata)
+               {
+               if(indata) BIO_pop(p7bio);
+               BIO_free_all(p7bio);
+               }
+       else
+               BIO_free_all(tmpin);
 
-       if(indata) BIO_pop(p7bio);
-       BIO_free_all(p7bio);
        sk_X509_free(signers);
 
        return ret;
@@ -287,10 +329,6 @@ STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
                PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_WRONG_CONTENT_TYPE);
                return NULL;
        }
-       if(!(signers = sk_X509_new_null())) {
-               PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,ERR_R_MALLOC_FAILURE);
-               return NULL;
-       }
 
        /* Collect all the signers together */
 
@@ -301,6 +339,11 @@ STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
                return 0;
        }
 
+       if(!(signers = sk_X509_new_null())) {
+               PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,ERR_R_MALLOC_FAILURE);
+               return NULL;
+       }
+
        for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++)
        {
            si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
@@ -327,7 +370,7 @@ STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
 
 /* Build a complete PKCS#7 enveloped data */
 
-PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, EVP_CIPHER *cipher,
+PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, const EVP_CIPHER *cipher,
                                                                int flags)
 {
        PKCS7 *p7;