-#define CONFBUFSIZE 512
- int bufnum=0,i,ii;
- BUF_MEM *buff=NULL;
- char *s,*p,*end;
- int again,n;
- long eline=0;
- char btmp[DECIMAL_SIZE(eline)+1];
- CONF_VALUE *v=NULL,*tv;
- CONF_VALUE *sv=NULL;
- char *section=NULL,*buf;
- STACK_OF(CONF_VALUE) *section_sk=NULL,*ts;
- char *start,*psection,*pname;
- void *h = (void *)(conf->data);
-
- if ((buff=BUF_MEM_new()) == NULL)
- {
- CONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_BUF_LIB);
- goto err;
- }
-
- section=(char *)OPENSSL_malloc(10);
- if (section == NULL)
- {
- CONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_MALLOC_FAILURE);
- goto err;
- }
- strcpy(section,"default");
-
- if (_CONF_new_data(conf) == 0)
- {
- CONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_MALLOC_FAILURE);
- goto err;
- }
-
- sv=_CONF_new_section(conf,section);
- if (sv == NULL)
- {
- CONFerr(CONF_F_CONF_LOAD_BIO,
- CONF_R_UNABLE_TO_CREATE_NEW_SECTION);
- goto err;
- }
- section_sk=(STACK_OF(CONF_VALUE) *)sv->value;
-
- bufnum=0;
- again=0;
- for (;;)
- {
- if (!BUF_MEM_grow(buff,bufnum+CONFBUFSIZE))
- {
- CONFerr(CONF_F_CONF_LOAD_BIO,ERR_R_BUF_LIB);
- goto err;
- }
- p= &(buff->data[bufnum]);
- *p='\0';
- BIO_gets(in, p, CONFBUFSIZE-1);
- p[CONFBUFSIZE-1]='\0';
- ii=i=strlen(p);
- if (i == 0 && !again) break;
- again=0;
- while (i > 0)
- {
- if ((p[i-1] != '\r') && (p[i-1] != '\n'))
- break;
- else
- i--;
- }
- /* we removed some trailing stuff so there is a new
- * line on the end. */
- if (ii && i == ii)
- again=1; /* long line */
- else
- {
- p[i]='\0';
- eline++; /* another input line */
- }
-
- /* we now have a line with trailing \r\n removed */
-
- /* i is the number of bytes */
- bufnum+=i;
-
- v=NULL;
- /* check for line continuation */
- if (bufnum >= 1)
- {
- /* If we have bytes and the last char '\\' and
- * second last char is not '\\' */
- p= &(buff->data[bufnum-1]);
- if (IS_ESC(conf,p[0]) &&
- ((bufnum <= 1) || !IS_ESC(conf,p[-1])))
- {
- bufnum--;
- again=1;
- }
- }
- if (again) continue;
- bufnum=0;
- buf=buff->data;
-
- clear_comments(conf, buf);
- n=strlen(buf);
- s=eat_ws(conf, buf);
- if (IS_EOF(conf,*s)) continue; /* blank line */
- if (*s == '[')
- {
- char *ss;
-
- s++;
- start=eat_ws(conf, s);
- ss=start;
-again:
- end=eat_alpha_numeric(conf, ss);
- p=eat_ws(conf, end);
- if (*p != ']')
- {
- if (*p != '\0')
- {
- ss=p;
- goto again;
- }
- CONFerr(CONF_F_CONF_LOAD_BIO,
- CONF_R_MISSING_CLOSE_SQUARE_BRACKET);
- goto err;
- }
- *end='\0';
- if (!str_copy(conf,NULL,§ion,start)) goto err;
- if ((sv=_CONF_get_section(conf,section)) == NULL)
- sv=_CONF_new_section(conf,section);
- if (sv == NULL)
- {
- CONFerr(CONF_F_CONF_LOAD_BIO,
- CONF_R_UNABLE_TO_CREATE_NEW_SECTION);
- goto err;
- }
- section_sk=(STACK_OF(CONF_VALUE) *)sv->value;
- continue;
- }
- else
- {
- pname=s;
- psection=NULL;
- end=eat_alpha_numeric(conf, s);
- if ((end[0] == ':') && (end[1] == ':'))
- {
- *end='\0';
- end+=2;
- psection=pname;
- pname=end;
- end=eat_alpha_numeric(conf, end);
- }
- p=eat_ws(conf, end);
- if (*p != '=')
- {
- CONFerr(CONF_F_CONF_LOAD_BIO,
- CONF_R_MISSING_EQUAL_SIGN);
- goto err;
- }
- *end='\0';
- p++;
- start=eat_ws(conf, p);
- while (!IS_EOF(conf,*p))
- p++;
- p--;
- while ((p != start) && (IS_WS(conf,*p)))
- p--;
- p++;
- *p='\0';
-
- if (!(v=(CONF_VALUE *)OPENSSL_malloc(sizeof(CONF_VALUE))))
- {
- CONFerr(CONF_F_CONF_LOAD_BIO,
- ERR_R_MALLOC_FAILURE);
- goto err;
- }
- if (psection == NULL) psection=section;
- v->name=(char *)OPENSSL_malloc(strlen(pname)+1);
- v->value=NULL;
- if (v->name == NULL)
- {
- CONFerr(CONF_F_CONF_LOAD_BIO,
- ERR_R_MALLOC_FAILURE);
- goto err;
- }
- strcpy(v->name,pname);
- if (!str_copy(conf,psection,&(v->value),start)) goto err;
-
- if (strcmp(psection,section) != 0)
- {
- if ((tv=_CONF_get_section(conf,psection))
- == NULL)
- tv=_CONF_new_section(conf,psection);
- if (tv == NULL)
- {
- CONFerr(CONF_F_CONF_LOAD_BIO,
- CONF_R_UNABLE_TO_CREATE_NEW_SECTION);
- goto err;
- }
- ts=(STACK_OF(CONF_VALUE) *)tv->value;
- }
- else
- {
- tv=sv;
- ts=section_sk;
- }
-#if 1
- if (_CONF_add_string(conf, tv, v) == 0)
- {
- CONFerr(CONF_F_CONF_LOAD_BIO,
- ERR_R_MALLOC_FAILURE);
- goto err;
- }
+#define CONFBUFSIZE 512
+ int bufnum = 0, i, ii;
+ BUF_MEM *buff = NULL;
+ char *s, *p, *end;
+ int again;
+ int first_call = 1;
+ long eline = 0;
+ char btmp[DECIMAL_SIZE(eline) + 1];
+ CONF_VALUE *v = NULL, *tv;
+ CONF_VALUE *sv = NULL;
+ char *section = NULL, *buf;
+ char *start, *psection, *pname;
+ void *h = (void *)(conf->data);
+ STACK_OF(BIO) *biosk = NULL;
+#ifndef OPENSSL_NO_POSIX_IO
+ char *dirpath = NULL;
+ OPENSSL_DIR_CTX *dirctx = NULL;
+#endif
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+ int numincludes = 0;
+#endif
+
+ if ((buff = BUF_MEM_new()) == NULL) {
+ ERR_raise(ERR_LIB_CONF, ERR_R_BUF_LIB);
+ goto err;
+ }
+
+ section = OPENSSL_strdup("default");
+ if (section == NULL)
+ goto err;
+
+ if (_CONF_new_data(conf) == 0) {
+ ERR_raise(ERR_LIB_CONF, ERR_R_CONF_LIB);
+ goto err;
+ }
+
+ sv = _CONF_new_section(conf, section);
+ if (sv == NULL) {
+ ERR_raise(ERR_LIB_CONF, CONF_R_UNABLE_TO_CREATE_NEW_SECTION);
+ goto err;
+ }
+
+ bufnum = 0;
+ again = 0;
+ for (;;) {
+ if (!BUF_MEM_grow(buff, bufnum + CONFBUFSIZE)) {
+ ERR_raise(ERR_LIB_CONF, ERR_R_BUF_LIB);
+ goto err;
+ }
+ p = &(buff->data[bufnum]);
+ *p = '\0';
+ read_retry:
+ if (in != NULL && BIO_gets(in, p, CONFBUFSIZE - 1) < 0)
+ goto err;
+ p[CONFBUFSIZE - 1] = '\0';
+ ii = i = strlen(p);
+ if (first_call) {
+ /* Other BOMs imply unsupported multibyte encoding,
+ * so don't strip them and let the error raise */
+ const unsigned char utf8_bom[3] = {0xEF, 0xBB, 0xBF};
+
+ if (i >= 3 && memcmp(p, utf8_bom, 3) == 0) {
+ memmove(p, p + 3, i - 3);
+ p[i - 3] = 0;
+ i -= 3;
+ ii -= 3;
+ }
+ first_call = 0;
+ }
+ if (i == 0 && !again) {
+ /* the currently processed BIO is NULL or at EOF */
+ BIO *parent;
+
+#ifndef OPENSSL_NO_POSIX_IO
+ /* continue processing with the next file from directory */
+ if (dirctx != NULL) {
+ BIO *next;
+
+ if ((next = get_next_file(dirpath, &dirctx)) != NULL) {
+ BIO_vfree(in);
+ in = next;
+ goto read_retry;
+ } else {
+ OPENSSL_free(dirpath);
+ dirpath = NULL;
+ }
+ }
+#endif
+ /* no more files in directory, continue with processing parent */
+ if ((parent = sk_BIO_pop(biosk)) == NULL) {
+ /* everything processed get out of the loop */
+ break;
+ } else {
+ BIO_vfree(in);
+ in = parent;
+ goto read_retry;
+ }
+ }
+ again = 0;
+ while (i > 0) {
+ if ((p[i - 1] != '\r') && (p[i - 1] != '\n'))
+ break;
+ else
+ i--;
+ }
+ /*
+ * we removed some trailing stuff so there is a new line on the end.
+ */
+ if (ii && i == ii)
+ again = 1; /* long line */
+ else {
+ p[i] = '\0';
+ eline++; /* another input line */
+ }
+
+ /* we now have a line with trailing \r\n removed */
+
+ /* i is the number of bytes */
+ bufnum += i;
+
+ v = NULL;
+ /* check for line continuation */
+ if (bufnum >= 1) {
+ /*
+ * If we have bytes and the last char '\\' and second last char
+ * is not '\\'
+ */
+ p = &(buff->data[bufnum - 1]);
+ if (IS_ESC(conf, p[0]) && ((bufnum <= 1) || !IS_ESC(conf, p[-1]))) {
+ bufnum--;
+ again = 1;
+ }
+ }
+ if (again)
+ continue;
+ bufnum = 0;
+ buf = buff->data;
+
+ clear_comments(conf, buf);
+ s = eat_ws(conf, buf);
+ if (IS_EOF(conf, *s))
+ continue; /* blank line */
+ if (*s == '[') {
+ char *ss;
+
+ s++;
+ start = eat_ws(conf, s);
+ ss = start;
+ again:
+ end = eat_alpha_numeric(conf, ss);
+ p = eat_ws(conf, end);
+ if (*p != ']') {
+ if (*p != '\0' && ss != p) {
+ ss = p;
+ goto again;
+ }
+ ERR_raise(ERR_LIB_CONF, CONF_R_MISSING_CLOSE_SQUARE_BRACKET);
+ goto err;
+ }
+ *end = '\0';
+ if (!str_copy(conf, NULL, §ion, start))
+ goto err;
+ if ((sv = _CONF_get_section(conf, section)) == NULL)
+ sv = _CONF_new_section(conf, section);
+ if (sv == NULL) {
+ ERR_raise(ERR_LIB_CONF, CONF_R_UNABLE_TO_CREATE_NEW_SECTION);
+ goto err;
+ }
+ continue;
+ } else {
+ pname = s;
+ end = eat_alpha_numeric(conf, s);
+ if ((end[0] == ':') && (end[1] == ':')) {
+ *end = '\0';
+ end += 2;
+ psection = pname;
+ pname = end;
+ end = eat_alpha_numeric(conf, end);
+ } else {
+ psection = section;
+ }
+ p = eat_ws(conf, end);
+ if (CHECK_AND_SKIP_PREFIX(pname, ".pragma")
+ && (p != pname || *p == '=')) {
+ char *pval;
+
+ if (*p == '=') {
+ p++;
+ p = eat_ws(conf, p);
+ }
+ trim_ws(conf, p);
+
+ /* Pragma values take the form keyword:value */
+ pval = strchr(p, ':');
+ if (pval == NULL || pval == p || pval[1] == '\0') {
+ ERR_raise(ERR_LIB_CONF, CONF_R_INVALID_PRAGMA);
+ goto err;
+ }
+
+ *pval++ = '\0';
+ trim_ws(conf, p);
+ pval = eat_ws(conf, pval);
+
+ /*
+ * Known pragmas:
+ *
+ * dollarid takes "on", "true or "off", "false"
+ * abspath takes "on", "true or "off", "false"
+ * includedir directory prefix
+ */
+ if (strcmp(p, "dollarid") == 0) {
+ if (!parsebool(pval, &conf->flag_dollarid))
+ goto err;
+ } else if (strcmp(p, "abspath") == 0) {
+ if (!parsebool(pval, &conf->flag_abspath))
+ goto err;
+ } else if (strcmp(p, "includedir") == 0) {
+ OPENSSL_free(conf->includedir);
+ if ((conf->includedir = OPENSSL_strdup(pval)) == NULL)
+ goto err;
+ }
+
+ /*
+ * We *ignore* any unknown pragma.
+ */
+ continue;
+ } else if (CHECK_AND_SKIP_PREFIX(pname, ".include")
+ && (p != pname || *p == '=')) {
+ char *include = NULL;
+ BIO *next;
+ const char *include_dir = ossl_safe_getenv("OPENSSL_CONF_INCLUDE");
+ char *include_path = NULL;
+
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+ /*
+ * The include processing below can cause the "conf" fuzzer to
+ * timeout due to the fuzzer inserting large and complicated
+ * includes - with a large amount of time spent in
+ * OPENSSL_strlcat/OPENSSL_strcpy. This is not a security
+ * concern because config files should never come from untrusted
+ * sources. We just set an arbitrary limit on the allowed
+ * number of includes when fuzzing to prevent this timeout.
+ */
+ if (numincludes++ > 10)
+ goto err;
+#endif
+
+ if (include_dir == NULL)
+ include_dir = conf->includedir;
+
+ if (*p == '=') {
+ p++;
+ p = eat_ws(conf, p);
+ }
+ trim_ws(conf, p);
+ if (!str_copy(conf, psection, &include, p))
+ goto err;
+
+ if (include_dir != NULL && !ossl_is_absolute_path(include)) {
+ size_t newlen = strlen(include_dir) + strlen(include) + 2;
+
+ include_path = OPENSSL_malloc(newlen);
+ if (include_path == NULL) {
+ OPENSSL_free(include);
+ goto err;
+ }
+
+ OPENSSL_strlcpy(include_path, include_dir, newlen);
+ if (!ossl_ends_with_dirsep(include_path))
+ OPENSSL_strlcat(include_path, "/", newlen);
+ OPENSSL_strlcat(include_path, include, newlen);
+ OPENSSL_free(include);
+ } else {
+ include_path = include;
+ }
+
+ if (conf->flag_abspath
+ && !ossl_is_absolute_path(include_path)) {
+ ERR_raise(ERR_LIB_CONF, CONF_R_RELATIVE_PATH);
+ OPENSSL_free(include_path);
+ goto err;
+ }
+
+ /* get the BIO of the included file */
+#ifndef OPENSSL_NO_POSIX_IO
+ next = process_include(include_path, &dirctx, &dirpath);
+ if (include_path != dirpath) {
+ /* dirpath will contain include in case of a directory */
+ OPENSSL_free(include_path);
+ }