Return error when a bit string indicates an invalid amount of bits left

[openssl.git] / crypto / asn1 / f_int.c

diff --git a/crypto/asn1/f_int.c b/crypto/asn1/f_int.c
index 4817c45cb7971981821db08d1de3ab41d160e285..9494e597abc36d6b8c0fd65bd277fb762604a635 100644 (file)
--- a/crypto/asn1/f_int.c
+++ b/crypto/asn1/f_int.c
@@ -58,23 +58,27 @@
 
 #include <stdio.h>
 #include "cryptlib.h"
-#include "buffer.h"
-#include "x509.h"
+#include <openssl/buffer.h>
+#include <openssl/asn1.h>
 
-int i2a_ASN1_INTEGER(bp, a)
-BIO *bp;
-ASN1_INTEGER *a;
+int i2a_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *a)
        {
        int i,n=0;
-       static char *h="0123456789ABCDEF";
+       static const char *h="0123456789ABCDEF";
        char buf[2];
 
        if (a == NULL) return(0);
 
+       if (a->type & V_ASN1_NEG)
+               {
+               if (BIO_write(bp, "-", 1) != 1) goto err;
+               n = 1;
+               }
+
        if (a->length == 0)
                {
                if (BIO_write(bp,"00",2) != 2) goto err;
-               n=2;
+               n += 2;
                }
        else
                {
@@ -96,11 +100,7 @@ err:
        return(-1);
        }
 
-int a2i_ASN1_INTEGER(bp,bs,buf,size)
-BIO *bp;
-ASN1_INTEGER *bs;
-char *buf;
-int size;
+int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size)
        {
        int ret=0;
        int i,j,k,m,n,again,bufsize;
@@ -123,9 +123,18 @@ int size;
 
                for (j=0; j<i; j++)
                        {
+#ifndef CHARSET_EBCDIC
                        if (!(  ((buf[j] >= '0') && (buf[j] <= '9')) ||
                                ((buf[j] >= 'a') && (buf[j] <= 'f')) ||
                                ((buf[j] >= 'A') && (buf[j] <= 'F'))))
+#else
+                       /* This #ifdef is not strictly necessary, since
+                        * the characters A...F a...f 0...9 are contiguous
+                        * (yes, even in EBCDIC - but not the whole alphabet).
+                        * Nevertheless, isxdigit() is faster.
+                        */
+                       if (!isxdigit(buf[j]))
+#endif
                                {
                                i=j;
                                break;
@@ -157,15 +166,14 @@ int size;
                if (num+i > slen)
                        {
                        if (s == NULL)
-                               sp=(unsigned char *)Malloc(
+                               sp=(unsigned char *)OPENSSL_malloc(
                                        (unsigned int)num+i*2);
                        else
-                               sp=(unsigned char *)Realloc(s,
-                                       (unsigned int)num+i*2);
+                               sp=OPENSSL_realloc_clean(s,slen,num+i*2);
                        if (sp == NULL)
                                {
                                ASN1err(ASN1_F_A2I_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);
-                               if (s != NULL) Free((char *)s);
+                               if (s != NULL) OPENSSL_free(s);
                                goto err;
                                }
                        s=sp;