Fix for crashing INTEGERs, ENUMERATEDs and OBJECT IDENTIFIERs.

Also fix a memory leak in PKCS#7 routines.

diff --git a/CHANGES b/CHANGES
index 5e1883f375082aca275c52d63c50119e9fb9a3ac..196e56d1b6d2fb8f54576bb0bb9da9cf999cd1d3 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,10 @@
 
  Changes between 0.9.4 and 0.9.5  [xx XXX 1999]
 
+  *) Some ASN1 types with illegal zero length encoding (INTEGER,
+     ENUMERATED and OBJECT IDENTIFIER) choked the ASN1 routines.
+     [Frans Heymans <fheymans@isaserver.be>, modified by Steve Henson]
+
   *) Merge in my S/MIME library for OpenSSL. This provides a simple
      S/MIME API on top of the PKCS#7 code, a MIME parser (with enough
      functionality to handle multipart/signed properly) and a utility

diff --git a/crypto/asn1/a_enum.c b/crypto/asn1/a_enum.c
index 61349ed003ce20c5850d19dc5092ba8d7cfe740c..38134f36888c9ea7b176b36a2747fc429fb58b2e 100644 (file)
--- a/crypto/asn1/a_enum.c
+++ b/crypto/asn1/a_enum.c
@@ -177,7 +177,12 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
                goto err;
                }
        to=s;
-       if (*p & 0x80) /* a negative number */
+       if(!len) {
+               /* Strictly speaking this is an illegal ENUMERATED but we
+                * tolerate it.
+                */
+               ret->type=V_ASN1_INTEGER;
+       } else if (*p & 0x80) /* a negative number */
                {
                ret->type=V_ASN1_NEG_ENUMERATED;
                if ((*p == 0xff) && (len != 1)) {

diff --git a/crypto/asn1/a_int.c b/crypto/asn1/a_int.c
index 7ed99eb3994aff7f949e9bc8eb2c3d3489ff3ad7..bcbdc7d4e128cbd995bb1a93c3ca9480b92e221c 100644 (file)
--- a/crypto/asn1/a_int.c
+++ b/crypto/asn1/a_int.c
@@ -202,7 +202,12 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
                goto err;
                }
        to=s;
-       if (*p & 0x80) /* a negative number */
+       if(!len) {
+               /* Strictly speaking this is an illegal INTEGER but we
+                * tolerate it.
+                */
+               ret->type=V_ASN1_INTEGER;
+       } else if (*p & 0x80) /* a negative number */
                {
                ret->type=V_ASN1_NEG_INTEGER;
                if ((*p == 0xff) && (len != 1)) {
@@ -301,7 +306,8 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
                goto err;
                }
        to=s;
-               ret->type=V_ASN1_INTEGER;
+       ret->type=V_ASN1_INTEGER;
+       if(len) {
                if ((*p == 0) && (len != 1))
                        {
                        p++;
@@ -309,6 +315,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
                        }
                memcpy(s,p,(int)len);
                p+=len;
+       }
 
        if (ret->data != NULL) Free((char *)ret->data);
        ret->data=s;

diff --git a/crypto/asn1/a_object.c b/crypto/asn1/a_object.c
index b94b418ee89a8f1ff424134fe022bccaad3867e3..ab69b955b51f315c924423ac5b1f22dcbd18819d 100644 (file)
--- a/crypto/asn1/a_object.c
+++ b/crypto/asn1/a_object.c
@@ -223,7 +223,7 @@ ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, unsigned char **pp,
        if ((ret->data == NULL) || (ret->length < len))
                {
                if (ret->data != NULL) Free((char *)ret->data);
-               ret->data=(unsigned char *)Malloc((int)len);
+               ret->data=(unsigned char *)Malloc(len ? (int)len : 1);
                ret->flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
                if (ret->data == NULL)
                        { i=ERR_R_MALLOC_FAILURE; goto err; }

diff --git a/crypto/pkcs7/pk7_lib.c b/crypto/pkcs7/pk7_lib.c
index 312a5ed064b9dd71e9435576a5b2323377fc7e8c..388a1d78b3f5bf34e3ceb8deeac58d74c4235716 100644 (file)
--- a/crypto/pkcs7/pk7_lib.c
+++ b/crypto/pkcs7/pk7_lib.c
@@ -123,7 +123,7 @@ int PKCS7_set_content(PKCS7 *p7, PKCS7 *p7_data)
                {
        case NID_pkcs7_signed:
                if (p7->d.sign->contents != NULL)
-                       PKCS7_content_free(p7->d.sign->contents);
+                       PKCS7_free(p7->d.sign->contents);
                p7->d.sign->contents=p7_data;
                break;
        case NID_pkcs7_digest: