crypto/dist/heimdal/lib/asn1/der_get.c

   1 /*
   2  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "der_locl.h"
  35
  36 __RCSID("$Heimdal: der_get.c 21369 2007-06-27 10:14:39Z lha $"
  37         "$NetBSD$");
  38
  39 #include <version.h>
  40
  41 /*
  42  * All decoding functions take a pointer `p' to first position in
  43  * which to read, from the left, `len' which means the maximum number
  44  * of characters we are able to read, `ret' were the value will be
  45  * returned and `size' where the number of used bytes is stored.
  46  * Either 0 or an error code is returned.
  47  */
  48
  49 int
  50 der_get_unsigned (const unsigned char *p, size_t len,
  51                   unsigned *ret, size_t *size)
  52 {
  53     unsigned val = 0;
  54     size_t oldlen = len;
  55
  56     if (len == sizeof(unsigned) + 1 && p[0] == 0)
  57         ;
  58     else if (len > sizeof(unsigned))
  59         return ASN1_OVERRUN;
  60
  61     while (len--)
  62         val = val * 256 + *p++;
  63     *ret = val;
  64     if(size) *size = oldlen;
  65     return 0;
  66 }
  67
  68 int
  69 der_get_integer (const unsigned char *p, size_t len,
  70                  int *ret, size_t *size)
  71 {
  72     int val = 0;
  73     size_t oldlen = len;
  74
  75     if (len > sizeof(int))
  76         return ASN1_OVERRUN;
  77
  78     if (len > 0) {
  79         val = (signed char)*p++;
  80         while (--len)
  81             val = val * 256 + *p++;
  82     }
  83     *ret = val;
  84     if(size) *size = oldlen;
  85     return 0;
  86 }
  87
  88 int
  89 der_get_length (const unsigned char *p, size_t len,
  90                 size_t *val, size_t *size)
  91 {
  92     size_t v;
  93
  94     if (len <= 0)
  95         return ASN1_OVERRUN;
  96     --len;
  97     v = *p++;
  98     if (v < 128) {
  99         *val = v;
 100         if(size) *size = 1;
 101     } else {
 102         int e;
 103         size_t l;
 104         unsigned tmp;
 105
 106         if(v == 0x80){
 107             *val = ASN1_INDEFINITE;
 108             if(size) *size = 1;
 109             return 0;
 110         }
 111         v &= 0x7F;
 112         if (len < v)
 113             return ASN1_OVERRUN;
 114         e = der_get_unsigned (p, v, &tmp, &l);
 115         if(e) return e;
 116         *val = tmp;
 117         if(size) *size = l + 1;
 118     }
 119     return 0;
 120 }
 121
 122 int
 123 der_get_boolean(const unsigned char *p, size_t len, int *data, size_t *size)
 124 {
 125     if(len < 1)
 126         return ASN1_OVERRUN;
 127     if(*p != 0)
 128         *data = 1;
 129     else
 130         *data = 0;
 131     *size = 1;
 132     return 0;
 133 }
 134
 135 int
 136 der_get_general_string (const unsigned char *p, size_t len,
 137                         heim_general_string *str, size_t *size)
 138 {
 139     const unsigned char *p1;
 140     char *s;
 141
 142     p1 = memchr(p, 0, len);
 143     if (p1 != NULL) {
 144         /*
 145          * Allow trailing NULs. We allow this since MIT Kerberos sends
 146          * an strings in the NEED_PREAUTH case that includes a
 147          * trailing NUL.
 148          */
 149         while (p1 - p < len && *p1 == '\0')
 150             p1++;
 151        if (p1 - p != len)
 152             return ASN1_BAD_CHARACTER;
 153     }
 154     if (len > len + 1)
 155         return ASN1_BAD_LENGTH;
 156
 157     s = malloc (len + 1);
 158     if (s == NULL)
 159         return ENOMEM;
 160     memcpy (s, p, len);
 161     s[len] = '\0';
 162     *str = s;
 163     if(size) *size = len;
 164     return 0;
 165 }
 166
 167 int
 168 der_get_utf8string (const unsigned char *p, size_t len,
 169                     heim_utf8_string *str, size_t *size)
 170 {
 171     return der_get_general_string(p, len, str, size);
 172 }
 173
 174 int
 175 der_get_printable_string (const unsigned char *p, size_t len,
 176                           heim_printable_string *str, size_t *size)
 177 {
 178     return der_get_general_string(p, len, str, size);
 179 }
 180
 181 int
 182 der_get_ia5_string (const unsigned char *p, size_t len,
 183                     heim_ia5_string *str, size_t *size)
 184 {
 185     return der_get_general_string(p, len, str, size);
 186 }
 187
 188 int
 189 der_get_bmp_string (const unsigned char *p, size_t len,
 190                     heim_bmp_string *data, size_t *size)
 191 {
 192     size_t i;
 193
 194     if (len & 1)
 195         return ASN1_BAD_FORMAT;
 196     data->length = len / 2;
 197     if (data->length > UINT_MAX/sizeof(data->data[0]))
 198         return ERANGE;
 199     data->data = malloc(data->length * sizeof(data->data[0]));
 200     if (data->data == NULL && data->length != 0)
 201         return ENOMEM;
 202
 203     for (i = 0; i < data->length; i++) {
 204         data->data[i] = (p[0] << 8) | p[1];
 205         p += 2;
 206     }
 207     if (size) *size = len;
 208
 209     return 0;
 210 }
 211
 212 int
 213 der_get_universal_string (const unsigned char *p, size_t len,
 214                           heim_universal_string *data, size_t *size)
 215 {
 216     size_t i;
 217
 218     if (len & 3)
 219         return ASN1_BAD_FORMAT;
 220     data->length = len / 4;
 221     if (data->length > UINT_MAX/sizeof(data->data[0]))
 222         return ERANGE;
 223     data->data = malloc(data->length * sizeof(data->data[0]));
 224     if (data->data == NULL && data->length != 0)
 225         return ENOMEM;
 226
 227     for (i = 0; i < data->length; i++) {
 228         data->data[i] = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
 229         p += 4;
 230     }
 231     if (size) *size = len;
 232     return 0;
 233 }
 234
 235 int
 236 der_get_visible_string (const unsigned char *p, size_t len,
 237                         heim_visible_string *str, size_t *size)
 238 {
 239     return der_get_general_string(p, len, str, size);
 240 }
 241
 242 int
 243 der_get_octet_string (const unsigned char *p, size_t len,
 244                       heim_octet_string *data, size_t *size)
 245 {
 246     data->length = len;
 247     data->data = malloc(len);
 248     if (data->data == NULL && data->length != 0)
 249         return ENOMEM;
 250     memcpy (data->data, p, len);
 251     if(size) *size = len;
 252     return 0;
 253 }
 254
 255 int
 256 der_get_heim_integer (const unsigned char *p, size_t len,
 257                       heim_integer *data, size_t *size)
 258 {
 259     data->length = 0;
 260     data->negative = 0;
 261     data->data = NULL;
 262
 263     if (len == 0) {
 264         if (size)
 265             *size = 0;
 266         return 0;
 267     }
 268     if (p[0] & 0x80) {
 269         unsigned char *q;
 270         int carry = 1;
 271         data->negative = 1;
 272
 273         data->length = len;
 274
 275         if (p[0] == 0xff) {
 276             p++;
 277             data->length--;
 278         }
 279         data->data = malloc(data->length);
 280         if (data->data == NULL) {
 281             data->length = 0;
 282             if (size)
 283                 *size = 0;
 284             return ENOMEM;
 285         }
 286         q = &((unsigned char*)data->data)[data->length - 1];
 287         p += data->length - 1;
 288         while (q >= (unsigned char*)data->data) {
 289             *q = *p ^ 0xff;
 290             if (carry)
 291                 carry = !++*q;
 292             p--;
 293             q--;
 294         }
 295     } else {
 296         data->negative = 0;
 297         data->length = len;
 298
 299         if (p[0] == 0) {
 300             p++;
 301             data->length--;
 302         }
 303         data->data = malloc(data->length);
 304         if (data->data == NULL && data->length != 0) {
 305             data->length = 0;
 306             if (size)
 307                 *size = 0;
 308             return ENOMEM;
 309         }
 310         memcpy(data->data, p, data->length);
 311     }
 312     if (size)
 313         *size = len;
 314     return 0;
 315 }
 316
 317 static int
 318 generalizedtime2time (const char *s, time_t *t)
 319 {
 320     struct tm tm;
 321
 322     memset(&tm, 0, sizeof(tm));
 323     if (sscanf (s, "%04d%02d%02d%02d%02d%02dZ",
 324                 &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour,
 325                 &tm.tm_min, &tm.tm_sec) != 6) {
 326         if (sscanf (s, "%02d%02d%02d%02d%02d%02dZ",
 327                     &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour,
 328                     &tm.tm_min, &tm.tm_sec) != 6)
 329             return ASN1_BAD_TIMEFORMAT;
 330         if (tm.tm_year < 50)
 331             tm.tm_year += 2000;
 332         else
 333             tm.tm_year += 1900;
 334     }
 335     tm.tm_year -= 1900;
 336     tm.tm_mon -= 1;
 337     *t = _der_timegm (&tm);
 338     return 0;
 339 }
 340
 341 static int
 342 der_get_time (const unsigned char *p, size_t len,
 343               time_t *data, size_t *size)
 344 {
 345     char *times;
 346     int e;
 347
 348     if (len > len + 1 || len == 0)
 349         return ASN1_BAD_LENGTH;
 350
 351     times = malloc(len + 1);
 352     if (times == NULL)
 353         return ENOMEM;
 354     memcpy(times, p, len);
 355     times[len] = '\0';
 356     e = generalizedtime2time(times, data);
 357     free (times);
 358     if(size) *size = len;
 359     return e;
 360 }
 361
 362 int
 363 der_get_generalized_time (const unsigned char *p, size_t len,
 364                           time_t *data, size_t *size)
 365 {
 366     return der_get_time(p, len, data, size);
 367 }
 368
 369 int
 370 der_get_utctime (const unsigned char *p, size_t len,
 371                           time_t *data, size_t *size)
 372 {
 373     return der_get_time(p, len, data, size);
 374 }
 375
 376 int
 377 der_get_oid (const unsigned char *p, size_t len,
 378              heim_oid *data, size_t *size)
 379 {
 380     size_t n;
 381     size_t oldlen = len;
 382
 383     if (len < 1)
 384         return ASN1_OVERRUN;
 385
 386     if (len > len + 1)
 387         return ASN1_BAD_LENGTH;
 388
 389     if (len + 1 > UINT_MAX/sizeof(data->components[0]))
 390         return ERANGE;
 391
 392     data->components = malloc((len + 1) * sizeof(data->components[0]));
 393     if (data->components == NULL)
 394         return ENOMEM;
 395     data->components[0] = (*p) / 40;
 396     data->components[1] = (*p) % 40;
 397     --len;
 398     ++p;
 399     for (n = 2; len > 0; ++n) {
 400         unsigned u = 0, u1;
 401
 402         do {
 403             --len;
 404             u1 = u * 128 + (*p++ % 128);
 405             /* check that we don't overflow the element */
 406             if (u1 < u) {
 407                 der_free_oid(data);
 408                 return ASN1_OVERRUN;
 409             }
 410             u = u1;
 411         } while (len > 0 && p[-1] & 0x80);
 412         data->components[n] = u;
 413     }
 414     if (n > 2 && p[-1] & 0x80) {
 415         der_free_oid (data);
 416         return ASN1_OVERRUN;
 417     }
 418     data->length = n;
 419     if (size)
 420         *size = oldlen;
 421     return 0;
 422 }
 423
 424 int
 425 der_get_tag (const unsigned char *p, size_t len,
 426              Der_class *class, Der_type *type,
 427              unsigned int *tag, size_t *size)
 428 {
 429     size_t ret = 0;
 430     if (len < 1)
 431         return ASN1_OVERRUN;
 432     *class = (Der_class)(((*p) >> 6) & 0x03);
 433     *type = (Der_type)(((*p) >> 5) & 0x01);
 434     *tag = (*p) & 0x1f;
 435     p++; len--; ret++;
 436     if(*tag == 0x1f) {
 437         unsigned int continuation;
 438         unsigned int tag1;
 439         *tag = 0;
 440         do {
 441             if(len < 1)
 442                 return ASN1_OVERRUN;
 443             continuation = *p & 128;
 444             tag1 = *tag * 128 + (*p % 128);
 445             /* check that we don't overflow the tag */
 446             if (tag1 < *tag)
 447                 return ASN1_OVERFLOW;
 448             *tag = tag1;
 449             p++; len--; ret++;
 450         } while(continuation);
 451     }
 452     if(size) *size = ret;
 453     return 0;
 454 }
 455
 456 int
 457 der_match_tag (const unsigned char *p, size_t len,
 458                Der_class class, Der_type type,
 459                unsigned int tag, size_t *size)
 460 {
 461     size_t l;
 462     Der_class thisclass;
 463     Der_type thistype;
 464     unsigned int thistag;
 465     int e;
 466
 467     e = der_get_tag (p, len, &thisclass, &thistype, &thistag, &l);
 468     if (e) return e;
 469     if (class != thisclass || type != thistype)
 470         return ASN1_BAD_ID;
 471     if(tag > thistag)
 472         return ASN1_MISPLACED_FIELD;
 473     if(tag < thistag)
 474         return ASN1_MISSING_FIELD;
 475     if(size) *size = l;
 476     return 0;
 477 }
 478
 479 int
 480 der_match_tag_and_length (const unsigned char *p, size_t len,
 481                           Der_class class, Der_type type, unsigned int tag,
 482                           size_t *length_ret, size_t *size)
 483 {
 484     size_t l, ret = 0;
 485     int e;
 486
 487     e = der_match_tag (p, len, class, type, tag, &l);
 488     if (e) return e;
 489     p += l;
 490     len -= l;
 491     ret += l;
 492     e = der_get_length (p, len, length_ret, &l);
 493     if (e) return e;
 494     p += l;
 495     len -= l;
 496     ret += l;
 497     if(size) *size = ret;
 498     return 0;
 499 }
 500
 501 /*
 502  * Old versions of DCE was based on a very early beta of the MIT code,
 503  * which used MAVROS for ASN.1 encoding. MAVROS had the interesting
 504  * feature that it encoded data in the forward direction, which has
 505  * it's problems, since you have no idea how long the data will be
 506  * until after you're done. MAVROS solved this by reserving one byte
 507  * for length, and later, if the actual length was longer, it reverted
 508  * to indefinite, BER style, lengths. The version of MAVROS used by
 509  * the DCE people could apparently generate correct X.509 DER encodings, and
 510  * did this by making space for the length after encoding, but
 511  * unfortunately this feature wasn't used with Kerberos.
 512  */
 513
 514 int
 515 _heim_fix_dce(size_t reallen, size_t *len)
 516 {
 517     if(reallen == ASN1_INDEFINITE)
 518         return 1;
 519     if(*len < reallen)
 520         return -1;
 521     *len = reallen;
 522     return 0;
 523 }
 524
 525 int
 526 der_get_bit_string (const unsigned char *p, size_t len,
 527                     heim_bit_string *data, size_t *size)
 528 {
 529     if (len < 1)
 530         return ASN1_OVERRUN;
 531     if (p[0] > 7)
 532         return ASN1_BAD_FORMAT;
 533     if (len - 1 == 0 && p[0] != 0)
 534         return ASN1_BAD_FORMAT;
 535     /* check if any of the three upper bits are set
 536      * any of them will cause a interger overrun */
 537     if ((len - 1) >> (sizeof(len) * 8 - 3))
 538         return ASN1_OVERRUN;
 539     data->length = (len - 1) * 8;
 540     data->data = malloc(len - 1);
 541     if (data->data == NULL && (len - 1) != 0)
 542         return ENOMEM;
 543     memcpy (data->data, p + 1, len - 1);
 544     data->length -= p[0];
 545     if(size) *size = len;
 546     return 0;
 547 }