Convert c2i_ASN1_OBJECT() and d2i_ASN1_OBJECT to CBS.

Along the way, rather than having yet another piece of code that parses
OID arcs, reuse oid_parse_arc(). Always allocate a new ASN1_OBJECT rather
than doing a crazy dance with ASN1_OBJECT_FLAG_DYNAMIC and trying to free
parts of an ASN1_OBJECT if one is passed in.

ok inoguchi@ tb@

1 files changed, 92 insertions, 81 deletions

diff --git a/src/lib/libcrypto/asn1/a_object.c b/src/lib/libcrypto/asn1/a_object.c
index 1d94d49679..0cf649910b 100644
--- a/src/lib/libcrypto/asn1/a_object.c
+++ b/src/lib/libcrypto/asn1/a_object.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_object.c,v 1.44 2022/03/20 13:27:23 jsing Exp $ */
+/* $OpenBSD: a_object.c,v 1.45 2022/03/26 14:54:58 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -155,12 +155,13 @@ oid_parse_arc(CBS *cbs, uint64_t *out_arc)
                         return 0;
                 if (arc == 0 && val == 0x80)
                         return 0;
-                if (arc > (UINT64_MAX >> 7))
+                if (out_arc != NULL && arc > (UINT64_MAX >> 7))
                         return 0;
                 arc = (arc << 7) | (val & 0x7f);
         } while (val & 0x80);
 
-        *out_arc = arc;
+        if (out_arc != NULL)
+                *out_arc = arc;
 
         return 1;
 }
@@ -519,80 +520,81 @@ i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *aobj)
         return ret;
 }
 
-ASN1_OBJECT *
-c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp, long len)
+int
+c2i_ASN1_OBJECT_cbs(ASN1_OBJECT **out_aobj, CBS *content)
 {
-        ASN1_OBJECT *ret;
-        const unsigned char *p;
-        unsigned char *data;
-        int i, length;
+        ASN1_OBJECT *aobj = NULL;
+        uint8_t *data = NULL;
+        size_t data_len;
+        CBS cbs;
 
-        /*
-         * Sanity check OID encoding:
-         * - need at least one content octet
-         * - MSB must be clear in the last octet
-         * - can't have leading 0x80 in subidentifiers, see: X.690 8.19.2
-         */
-        if (len <= 0 || len > INT_MAX || pp == NULL || (p = *pp) == NULL ||
-            p[len - 1] & 0x80) {
+        if (out_aobj == NULL || *out_aobj != NULL)
+                goto err;
+
+        /* Parse and validate OID encoding per X.690 8.19.2. */
+        CBS_dup(content, &cbs);
+        if (CBS_len(&cbs) == 0) {
                 ASN1error(ASN1_R_INVALID_OBJECT_ENCODING);
-                return (NULL);
+                goto err;
         }
-
-        /* Now 0 < len <= INT_MAX, so the cast is safe. */
-        length = (int)len;
-        for (i = 0; i < length; i++, p++) {
-                if (*p == 0x80 && (!i || !(p[-1] & 0x80))) {
+        while (CBS_len(&cbs) > 0) {
+                if (!oid_parse_arc(&cbs, NULL)) {
                         ASN1error(ASN1_R_INVALID_OBJECT_ENCODING);
-                        return (NULL);
+                        goto err;
                 }
         }
 
-        if ((a == NULL) || ((*a) == NULL) ||
-            !((*a)->flags & ASN1_OBJECT_FLAG_DYNAMIC)) {
-                if ((ret = ASN1_OBJECT_new()) == NULL)
-                        return (NULL);
-        } else
-                ret = *a;
-
-        p = *pp;
+        if (!CBS_stow(content, &data, &data_len))
+                goto err;
 
-        /* detach data from object */
-        data = (unsigned char *)ret->data;
-        freezero(data, ret->length);
+        if (data_len > INT_MAX)
+                goto err;
 
-        data = malloc(length);
-        if (data == NULL) {
-                ASN1error(ERR_R_MALLOC_FAILURE);
+        if ((aobj = ASN1_OBJECT_new()) == NULL)
                 goto err;
-        }
 
-        memcpy(data, p, length);
+        aobj->data = data;
+        aobj->length = (int)data_len; /* XXX - change length to size_t. */
+        aobj->flags |= ASN1_OBJECT_FLAG_DYNAMIC_DATA;
+
+        *out_aobj = aobj;
 
-        /* If there are dynamic strings, free them here, and clear the flag. */
-        if ((ret->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS) != 0) {
-                free((void *)ret->sn);
-                free((void *)ret->ln);
-                ret->flags &= ~ASN1_OBJECT_FLAG_DYNAMIC_STRINGS;
+        return 1;
+
+ err:
+        ASN1_OBJECT_free(aobj);
+        free(data);
+
+        return 0;
+}
+
+ASN1_OBJECT *
+c2i_ASN1_OBJECT(ASN1_OBJECT **out_aobj, const unsigned char **pp, long len)
+{
+        ASN1_OBJECT *aobj = NULL;
+        CBS content;
+
+        if (out_aobj != NULL) {
+                ASN1_OBJECT_free(*out_aobj);
+                *out_aobj = NULL;
         }
 
-        /* reattach data to object, after which it remains const */
-        ret->data = data;
-        ret->length = length;
-        ret->sn = NULL;
-        ret->ln = NULL;
-        ret->flags |= ASN1_OBJECT_FLAG_DYNAMIC_DATA;
-        p += length;
+        if (len < 0) {
+                ASN1error(ASN1_R_LENGTH_ERROR);
+                return NULL;
+        }
 
-        if (a != NULL)
-                *a = ret;
-        *pp = p;
-        return (ret);
+        CBS_init(&content, *pp, len);
 
- err:
-        if (a == NULL || ret != *a)
-                ASN1_OBJECT_free(ret);
-        return (NULL);
+        if (!c2i_ASN1_OBJECT_cbs(&aobj, &content))
+                return NULL;
+
+        *pp = CBS_data(&content);
+
+        if (out_aobj != NULL)
+                *out_aobj = aobj;
+
+        return aobj;
 }
 
 int
@@ -618,31 +620,40 @@ i2d_ASN1_OBJECT(const ASN1_OBJECT *a, unsigned char **pp)
 }
 
 ASN1_OBJECT *
-d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp, long length)
+d2i_ASN1_OBJECT(ASN1_OBJECT **out_aobj, const unsigned char **pp, long length)
 {
-        const unsigned char *p;
-        long len;
-        int tag, xclass;
-        int inf, i;
-        ASN1_OBJECT *ret = NULL;
+        ASN1_OBJECT *aobj = NULL;
+        uint32_t tag_number;
+        CBS cbs, content;
 
-        p = *pp;
-        inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
-        if (inf & 0x80) {
-                i = ASN1_R_BAD_OBJECT_HEADER;
-                goto err;
+        if (out_aobj != NULL) {
+                ASN1_OBJECT_free(*out_aobj);
+                *out_aobj = NULL;
         }
 
-        if (tag != V_ASN1_OBJECT) {
-                i = ASN1_R_EXPECTING_AN_OBJECT;
-                goto err;
+        if (length < 0) {
+                ASN1error(ASN1_R_LENGTH_ERROR);
+                return NULL;
         }
-        ret = c2i_ASN1_OBJECT(a, &p, len);
-        if (ret)
-                *pp = p;
-        return ret;
 
- err:
-        ASN1error(i);
-        return (NULL);
+        CBS_init(&cbs, *pp, length);
+
+        if (!asn1_get_primitive(&cbs, 0, &tag_number, &content)) {
+                ASN1error(ASN1_R_BAD_OBJECT_HEADER);
+                return NULL;
+        }
+        if (tag_number != V_ASN1_OBJECT) {
+                ASN1error(ASN1_R_EXPECTING_AN_OBJECT);
+                return NULL;
+        }
+
+        if (!c2i_ASN1_OBJECT_cbs(&aobj, &content))
+                return NULL;
+
+        *pp = CBS_data(&content);
+
+        if (out_aobj != NULL)
+                *out_aobj = aobj;
+
+        return aobj;
 }