Require all ASN1_PRIMITIVE_FUNCS functions to be provided.

If an ASN.1 item provides its own ASN1_PRIMITIVE_FUNCS functions, require
all functions to be provided (currently excluding prim_clear). This avoids
situations such as having a custom allocator that returns a specific struct
but then is then printed using the default primative print functions, which
interpret the memory as a different struct.

Found by oss-fuzz, fixes issue #13799.

ok beck@, tb@

5 files changed, 42 insertions, 26 deletions

diff --git a/src/lib/libcrypto/asn1/tasn_dec.c b/src/lib/libcrypto/asn1/tasn_dec.c
index 3a27b82288..70dc355ca1 100644
--- a/src/lib/libcrypto/asn1/tasn_dec.c
+++ b/src/lib/libcrypto/asn1/tasn_dec.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_dec.c,v 1.36 2018/09/17 18:18:01 tb Exp $ */
+/* $OpenBSD: tasn_dec.c,v 1.37 2019/04/01 15:48:04 jsing Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -793,14 +793,17 @@ asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype,
         ASN1_VALUE **opval = NULL;
         ASN1_STRING *stmp;
         ASN1_TYPE *typ = NULL;
-        int ret = 0;
-        const ASN1_PRIMITIVE_FUNCS *pf;
         ASN1_INTEGER **tint;
+        int ret = 0;
 
-        pf = it->funcs;
+        if (it->funcs != NULL) {
+                const ASN1_PRIMITIVE_FUNCS *pf = it->funcs;
 
-        if (pf && pf->prim_c2i)
+                if (pf->prim_c2i == NULL)
+                        return 0;
                 return pf->prim_c2i(pval, cont, len, utype, free_cont, it);
+        }
+
         /* If ANY type clear type and set pointer to internal value */
         if (it->utype == V_ASN1_ANY) {
                 if (!*pval) {
diff --git a/src/lib/libcrypto/asn1/tasn_enc.c b/src/lib/libcrypto/asn1/tasn_enc.c
index f3341901fe..d103c4d096 100644
--- a/src/lib/libcrypto/asn1/tasn_enc.c
+++ b/src/lib/libcrypto/asn1/tasn_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_enc.c,v 1.21 2016/12/30 16:04:34 jsing Exp $ */
+/* $OpenBSD: tasn_enc.c,v 1.22 2019/04/01 15:48:04 jsing Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -541,11 +541,14 @@ asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cout, int *putype,
         const unsigned char *cont;
         unsigned char c;
         int len;
-        const ASN1_PRIMITIVE_FUNCS *pf;
 
-        pf = it->funcs;
-        if (pf && pf->prim_i2c)
+        if (it->funcs != NULL) {
+                const ASN1_PRIMITIVE_FUNCS *pf = it->funcs;
+
+                if (pf->prim_i2c == NULL)
+                        return -1;
                 return pf->prim_i2c(pval, cout, putype, it);
+        }
 
         /* Should type be omitted? */
         if ((it->itype != ASN1_ITYPE_PRIMITIVE) ||
diff --git a/src/lib/libcrypto/asn1/tasn_fre.c b/src/lib/libcrypto/asn1/tasn_fre.c
index c05310ec28..b621af3b37 100644
--- a/src/lib/libcrypto/asn1/tasn_fre.c
+++ b/src/lib/libcrypto/asn1/tasn_fre.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_fre.c,v 1.16 2018/04/06 12:16:06 bluhm Exp $ */
+/* $OpenBSD: tasn_fre.c,v 1.17 2019/04/01 15:48:04 jsing Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -193,14 +193,14 @@ void
 ASN1_primitive_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
 {
         int utype;
-        if (it) {
-                const ASN1_PRIMITIVE_FUNCS *pf;
-                pf = it->funcs;
-                if (pf && pf->prim_free) {
-                        pf->prim_free(pval, it);
-                        return;
-                }
+
+        if (it != NULL && it->funcs != NULL) {
+                const ASN1_PRIMITIVE_FUNCS *pf = it->funcs;
+
+                pf->prim_free(pval, it);
+                return;
         }
+
         /* Special case: if 'it' is NULL free contents of ASN1_TYPE */
         if (!it) {
                 ASN1_TYPE *typ = (ASN1_TYPE *)*pval;
diff --git a/src/lib/libcrypto/asn1/tasn_new.c b/src/lib/libcrypto/asn1/tasn_new.c
index e9bbc05e08..7c9bb98974 100644
--- a/src/lib/libcrypto/asn1/tasn_new.c
+++ b/src/lib/libcrypto/asn1/tasn_new.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_new.c,v 1.17 2017/01/29 17:49:22 beck Exp $ */
+/* $OpenBSD: tasn_new.c,v 1.18 2019/04/01 15:48:04 jsing Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -306,10 +306,12 @@ ASN1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
         ASN1_STRING *str;
         int utype;
 
-        if (it && it->funcs) {
+        if (it != NULL && it->funcs != NULL) {
                 const ASN1_PRIMITIVE_FUNCS *pf = it->funcs;
-                if (pf->prim_new)
-                        return pf->prim_new(pval, it);
+
+                if (pf->prim_new == NULL)
+                        return 0;
+                return pf->prim_new(pval, it);
         }
 
         if (!it || (it->itype == ASN1_ITYPE_MSTRING))
@@ -355,14 +357,17 @@ static void
 asn1_primitive_clear(ASN1_VALUE **pval, const ASN1_ITEM *it)
 {
         int utype;
-        if (it && it->funcs) {
+
+        if (it != NULL && it->funcs != NULL) {
                 const ASN1_PRIMITIVE_FUNCS *pf = it->funcs;
+
                 if (pf->prim_clear)
                         pf->prim_clear(pval, it);
                 else
                         *pval = NULL;
                 return;
         }
+
         if (!it || (it->itype == ASN1_ITYPE_MSTRING))
                 utype = V_ASN1_UNDEF;
         else
diff --git a/src/lib/libcrypto/asn1/tasn_prn.c b/src/lib/libcrypto/asn1/tasn_prn.c
index 9fbf177ba4..36bb4ddc4b 100644
--- a/src/lib/libcrypto/asn1/tasn_prn.c
+++ b/src/lib/libcrypto/asn1/tasn_prn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_prn.c,v 1.18 2019/03/23 18:48:14 beck Exp $ */
+/* $OpenBSD: tasn_prn.c,v 1.19 2019/04/01 15:48:04 jsing Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -500,13 +500,18 @@ asn1_primitive_print(BIO *out, ASN1_VALUE **fld, const ASN1_ITEM *it,
         ASN1_STRING *str;
         int ret = 1, needlf = 1;
         const char *pname;
-        const ASN1_PRIMITIVE_FUNCS *pf;
 
-        pf = it->funcs;
         if (!asn1_print_fsname(out, indent, fname, sname, pctx))
                 return 0;
-        if (pf && pf->prim_print)
+
+        if (it != NULL && it->funcs != NULL) {
+                const ASN1_PRIMITIVE_FUNCS *pf = it->funcs;
+
+                if (pf->prim_print == NULL)
+                        return 0;
+
                 return pf->prim_print(out, fld, it, indent, pctx);
+        }
 
         str = (ASN1_STRING *)*fld;