Fixed NULL pointer dereference in PKCS7_dataDecode reported by David Ramos in PR...

[openssl.git] / crypto / pkcs7 / pk7_attr.c

diff --git a/crypto/pkcs7/pk7_attr.c b/crypto/pkcs7/pk7_attr.c
index 5ad6670a4e11c5c283d5f2a070db01a56e41e18c..a97db512107f13022b7f7d477d709e31e1546395 100644 (file)
--- a/crypto/pkcs7/pk7_attr.c
+++ b/crypto/pkcs7/pk7_attr.c
@@ -1,5 +1,5 @@
 /* pk7_attr.c */
-/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2001.
  */
 /* ====================================================================
@@ -60,6 +60,7 @@
 #include <stdlib.h>
 #include <openssl/bio.h>
 #include <openssl/asn1.h>
+#include <openssl/asn1t.h>
 #include <openssl/pem.h>
 #include <openssl/pkcs7.h>
 #include <openssl/x509.h>
@@ -68,27 +69,12 @@
 int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK_OF(X509_ALGOR) *cap)
 {
        ASN1_STRING *seq;
-       unsigned char *p, *pp;
-       int len;
-       len=i2d_ASN1_SET_OF_X509_ALGOR(cap,NULL,i2d_X509_ALGOR,
-                                      V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL,
-                                      IS_SEQUENCE);
-       if(!(pp=(unsigned char *)OPENSSL_malloc(len))) {
-               PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
-               return 0;
-       }
-       p=pp;
-       i2d_ASN1_SET_OF_X509_ALGOR(cap,&p,i2d_X509_ALGOR, V_ASN1_SEQUENCE,
-                                  V_ASN1_UNIVERSAL, IS_SEQUENCE);
        if(!(seq = ASN1_STRING_new())) {
                PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
                return 0;
        }
-       if(!ASN1_STRING_set (seq, pp, len)) {
-               PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
-               return 0;
-       }
-       OPENSSL_free (pp);
+       seq->length = ASN1_item_i2d((ASN1_VALUE *)cap,&seq->data,
+                               ASN1_ITEM_rptr(X509_ALGORS));
         return PKCS7_add_signed_attribute(si, NID_SMIMECapabilities,
                                                        V_ASN1_SEQUENCE, seq);
 }
@@ -102,10 +88,9 @@ STACK_OF(X509_ALGOR) *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si)
        if (!cap || (cap->type != V_ASN1_SEQUENCE))
                return NULL;
        p = cap->value.sequence->data;
-       return d2i_ASN1_SET_OF_X509_ALGOR(NULL, &p,
-                                         cap->value.sequence->length,
-                                         d2i_X509_ALGOR, X509_ALGOR_free,
-                                         V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
+       return (STACK_OF(X509_ALGOR) *)
+               ASN1_item_d2i(NULL, &p, cap->value.sequence->length,
+                               ASN1_ITEM_rptr(X509_ALGORS));
        }
 
 /* Basic smime-capabilities OID and optional integer arg */
@@ -170,7 +155,7 @@ int PKCS7_add1_attrib_digest(PKCS7_SIGNER_INFO *si,
        if (!os)
                return 0;
        if (!ASN1_STRING_set(os, md, mdlen)
-               || PKCS7_add_signed_attribute(si, NID_pkcs9_messageDigest,
+               || !PKCS7_add_signed_attribute(si, NID_pkcs9_messageDigest,
                                                V_ASN1_OCTET_STRING, os))
                {
                ASN1_OCTET_STRING_free(os);