5 files changed, 167 insertions, 118 deletions

diff --git a/src/lib/libcrypto/asn1/a_bitstr.c b/src/lib/libcrypto/asn1/a_bitstr.c
index ed0bdfbde1..e0265f69d2 100644
--- a/src/lib/libcrypto/asn1/a_bitstr.c
+++ b/src/lib/libcrypto/asn1/a_bitstr.c
@@ -120,6 +120,12 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
         unsigned char *p,*s;
         int i;
 
+        if (len < 1)
+                {
+                i=ASN1_R_STRING_TOO_SHORT;
+                goto err;
+                }
+
         if ((a == NULL) || ((*a) == NULL))
                 {
                 if ((ret=M_ASN1_BIT_STRING_new()) == NULL) return(NULL);
diff --git a/src/lib/libcrypto/asn1/a_strex.c b/src/lib/libcrypto/asn1/a_strex.c
index 8dab29dca1..7ddb7662f1 100644
--- a/src/lib/libcrypto/asn1/a_strex.c
+++ b/src/lib/libcrypto/asn1/a_strex.c
@@ -544,7 +544,7 @@ int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in)
 {
         ASN1_STRING stmp, *str = &stmp;
         int mbflag, type, ret;
-        if(!*out || !in) return -1;
+        if(!in) return -1;
         type = in->type;
         if((type < 0) || (type > 30)) return -1;
         mbflag = tag2nbyte[type];
@@ -553,6 +553,6 @@ int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in)
         stmp.data = NULL;
         ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag, B_ASN1_UTF8STRING);
         if(ret < 0) return ret;
-        if(out) *out = stmp.data;
+        *out = stmp.data;
         return stmp.length;
 }
diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index 422685a3b4..0638870ab7 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -57,6 +57,7 @@
  */
 
 #include <stdio.h>
+#include <limits.h>
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 #include <openssl/asn1_mac.h>
@@ -124,7 +125,7 @@ int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
                 (int)(omax+ *pp));
 
 #endif
-        if (*plength > (omax - (*pp - p)))
+        if (*plength > (omax - (p - *pp)))
                 {
                 ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);
                 /* Set this so that even if things are not long enough
@@ -141,7 +142,7 @@ err:
 static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
         {
         unsigned char *p= *pp;
-        long ret=0;
+        unsigned long ret=0;
         int i;
 
         if (max-- < 1) return(0);
@@ -170,10 +171,10 @@ static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
                 else
                         ret=i;
                 }
-        if (ret < 0)
+        if (ret > LONG_MAX)
                 return 0;
         *pp=p;
-        *rl=ret;
+        *rl=(long)ret;
         return(1);
         }
 
diff --git a/src/lib/libcrypto/asn1/t_req.c b/src/lib/libcrypto/asn1/t_req.c
index 848c29a2dd..739f272ecf 100644
--- a/src/lib/libcrypto/asn1/t_req.c
+++ b/src/lib/libcrypto/asn1/t_req.c
@@ -82,7 +82,7 @@ int X509_REQ_print_fp(FILE *fp, X509_REQ *x)
         }
 #endif
 
-int X509_REQ_print(BIO *bp, X509_REQ *x)
+int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long cflag)
         {
         unsigned long l;
         int i;
@@ -92,143 +92,185 @@ int X509_REQ_print(BIO *bp, X509_REQ *x)
         STACK_OF(X509_ATTRIBUTE) *sk;
         STACK_OF(X509_EXTENSION) *exts;
         char str[128];
+        char mlch = ' ';
+        int nmindent = 0;
+
+        if((nmflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) {
+                mlch = '\n';
+                nmindent = 12;
+        }
+
+        if(nmflags == X509_FLAG_COMPAT)
+                nmindent = 16;
+
 
         ri=x->req_info;
-        sprintf(str,"Certificate Request:\n");
-        if (BIO_puts(bp,str) <= 0) goto err;
-        sprintf(str,"%4sData:\n","");
-        if (BIO_puts(bp,str) <= 0) goto err;
-
-        neg=(ri->version->type == V_ASN1_NEG_INTEGER)?"-":"";
-        l=0;
-        for (i=0; i<ri->version->length; i++)
-                { l<<=8; l+=ri->version->data[i]; }
-        sprintf(str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,l,neg,l);
-        if (BIO_puts(bp,str) <= 0) goto err;
-        sprintf(str,"%8sSubject: ","");
-        if (BIO_puts(bp,str) <= 0) goto err;
-
-        X509_NAME_print(bp,ri->subject,16);
-        sprintf(str,"\n%8sSubject Public Key Info:\n","");
-        if (BIO_puts(bp,str) <= 0) goto err;
-        i=OBJ_obj2nid(ri->pubkey->algor->algorithm);
-        sprintf(str,"%12sPublic Key Algorithm: %s\n","",
-                (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
-        if (BIO_puts(bp,str) <= 0) goto err;
-
-        pkey=X509_REQ_get_pubkey(x);
-#ifndef OPENSSL_NO_RSA
-        if (pkey != NULL && pkey->type == EVP_PKEY_RSA)
+        if(!(cflag & X509_FLAG_NO_HEADER))
                 {
-                BIO_printf(bp,"%12sRSA Public Key: (%d bit)\n","",
-                        BN_num_bits(pkey->pkey.rsa->n));
-                RSA_print(bp,pkey->pkey.rsa,16);
+                if (BIO_write(bp,"Certificate Request:\n",21) <= 0) goto err;
+                if (BIO_write(bp,"    Data:\n",10) <= 0) goto err;
                 }
-        else 
-#endif
-#ifndef OPENSSL_NO_DSA
-                if (pkey != NULL && pkey->type == EVP_PKEY_DSA)
+        if(!(cflag & X509_FLAG_NO_VERSION))
                 {
-                BIO_printf(bp,"%12sDSA Public Key:\n","");
-                DSA_print(bp,pkey->pkey.dsa,16);
+                neg=(ri->version->type == V_ASN1_NEG_INTEGER)?"-":"";
+                l=0;
+                for (i=0; i<ri->version->length; i++)
+                        { l<<=8; l+=ri->version->data[i]; }
+                sprintf(str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,l,neg,l);
+                if (BIO_puts(bp,str) <= 0) goto err;
                 }
-        else
-#endif
-                BIO_printf(bp,"%12sUnknown Public Key:\n","");
+        if(!(cflag & X509_FLAG_NO_SUBJECT))
+                {
+                if (BIO_printf(bp,"        Subject:%c",mlch) <= 0) goto err;
+                if (X509_NAME_print_ex(bp,ri->subject,nmindent, nmflags) < 0) goto err;
+                if (BIO_write(bp,"\n",1) <= 0) goto err;
+                }
+        if(!(cflag & X509_FLAG_NO_PUBKEY))
+                {
+                if (BIO_write(bp,"        Subject Public Key Info:\n",33) <= 0)
+                        goto err;
+                if (BIO_printf(bp,"%12sPublic Key Algorithm: ","") <= 0)
+                        goto err;
+                if (i2a_ASN1_OBJECT(bp, ri->pubkey->algor->algorithm) <= 0)
+                        goto err;
+                if (BIO_puts(bp, "\n") <= 0)
+                        goto err;
 
-        if (pkey != NULL)
-            EVP_PKEY_free(pkey);
+                pkey=X509_REQ_get_pubkey(x);
+                if (pkey == NULL)
+                        {
+                        BIO_printf(bp,"%12sUnable to load Public Key\n","");
+                        ERR_print_errors(bp);
+                        }
+                else
+#ifndef OPENSSL_NO_RSA
+                if (pkey->type == EVP_PKEY_RSA)
+                        {
+                        BIO_printf(bp,"%12sRSA Public Key: (%d bit)\n","",
+                        BN_num_bits(pkey->pkey.rsa->n));
+                        RSA_print(bp,pkey->pkey.rsa,16);
+                        }
+                else
+#endif
+#ifndef OPENSSL_NO_DSA
+                if (pkey->type == EVP_PKEY_DSA)
+                        {
+                        BIO_printf(bp,"%12sDSA Public Key:\n","");
+                        DSA_print(bp,pkey->pkey.dsa,16);
+                        }
+                else
+#endif
+                        BIO_printf(bp,"%12sUnknown Public Key:\n","");
 
-        /* may not be */
-        sprintf(str,"%8sAttributes:\n","");
-        if (BIO_puts(bp,str) <= 0) goto err;
+                EVP_PKEY_free(pkey);
+                }
 
-        sk=x->req_info->attributes;
-        if (sk_X509_ATTRIBUTE_num(sk) == 0)
+        if(!(cflag & X509_FLAG_NO_ATTRIBUTES))
                 {
-                sprintf(str,"%12sa0:00\n","");
+                /* may not be */
+                sprintf(str,"%8sAttributes:\n","");
                 if (BIO_puts(bp,str) <= 0) goto err;
-                }
-        else
-                {
-                for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++)
+
+                sk=x->req_info->attributes;
+                if (sk_X509_ATTRIBUTE_num(sk) == 0)
                         {
-                        ASN1_TYPE *at;
-                        X509_ATTRIBUTE *a;
-                        ASN1_BIT_STRING *bs=NULL;
-                        ASN1_TYPE *t;
-                        int j,type=0,count=1,ii=0;
-
-                        a=sk_X509_ATTRIBUTE_value(sk,i);
-                        if(X509_REQ_extension_nid(OBJ_obj2nid(a->object)))
-                                                                continue;
-                        sprintf(str,"%12s","");
+                        sprintf(str,"%12sa0:00\n","");
                         if (BIO_puts(bp,str) <= 0) goto err;
-                        if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0)
+                        }
+                else
                         {
-                        if (a->single)
+                        for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++)
                                 {
-                                t=a->value.single;
-                                type=t->type;
-                                bs=t->value.bit_string;
-                                }
-                        else
+                                ASN1_TYPE *at;
+                                X509_ATTRIBUTE *a;
+                                ASN1_BIT_STRING *bs=NULL;
+                                ASN1_TYPE *t;
+                                int j,type=0,count=1,ii=0;
+
+                                a=sk_X509_ATTRIBUTE_value(sk,i);
+                                if(X509_REQ_extension_nid(OBJ_obj2nid(a->object)))
+                                                                        continue;
+                                sprintf(str,"%12s","");
+                                if (BIO_puts(bp,str) <= 0) goto err;
+                                if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0)
                                 {
-                                ii=0;
-                                count=sk_ASN1_TYPE_num(a->value.set);
+                                if (a->single)
+                                        {
+                                        t=a->value.single;
+                                        type=t->type;
+                                        bs=t->value.bit_string;
+                                        }
+                                else
+                                        {
+                                        ii=0;
+                                        count=sk_ASN1_TYPE_num(a->value.set);
 get_next:
-                                at=sk_ASN1_TYPE_value(a->value.set,ii);
-                                type=at->type;
-                                bs=at->value.asn1_string;
+                                        at=sk_ASN1_TYPE_value(a->value.set,ii);
+                                        type=at->type;
+                                        bs=at->value.asn1_string;
+                                        }
+                                }
+                                for (j=25-j; j>0; j--)
+                                        if (BIO_write(bp," ",1) != 1) goto err;
+                                if (BIO_puts(bp,":") <= 0) goto err;
+                                if (    (type == V_ASN1_PRINTABLESTRING) ||
+                                        (type == V_ASN1_T61STRING) ||
+                                        (type == V_ASN1_IA5STRING))
+                                        {
+                                        if (BIO_write(bp,(char *)bs->data,bs->length)
+                                                != bs->length)
+                                                goto err;
+                                        BIO_puts(bp,"\n");
+                                        }
+                                else
+                                        {
+                                        BIO_puts(bp,"unable to print attribute\n");
+                                        }
+                                if (++ii < count) goto get_next;
                                 }
                         }
-                        for (j=25-j; j>0; j--)
-                                if (BIO_write(bp," ",1) != 1) goto err;
-                        if (BIO_puts(bp,":") <= 0) goto err;
-                        if (    (type == V_ASN1_PRINTABLESTRING) ||
-                                (type == V_ASN1_T61STRING) ||
-                                (type == V_ASN1_IA5STRING))
+                }
+        if(!(cflag & X509_FLAG_NO_ATTRIBUTES))
+                {
+                exts = X509_REQ_get_extensions(x);
+                if(exts)
+                        {
+                        BIO_printf(bp,"%8sRequested Extensions:\n","");
+                        for (i=0; i<sk_X509_EXTENSION_num(exts); i++)
                                 {
-                                if (BIO_write(bp,(char *)bs->data,bs->length)
-                                        != bs->length)
+                                ASN1_OBJECT *obj;
+                                X509_EXTENSION *ex;
+                                int j;
+                                ex=sk_X509_EXTENSION_value(exts, i);
+                                if (BIO_printf(bp,"%12s","") <= 0) goto err;
+                                obj=X509_EXTENSION_get_object(ex);
+                                i2a_ASN1_OBJECT(bp,obj);
+                                j=X509_EXTENSION_get_critical(ex);
+                                if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0)
                                         goto err;
-                                BIO_puts(bp,"\n");
-                                }
-                        else
-                                {
-                                BIO_puts(bp,"unable to print attribute\n");
+                                if(!X509V3_EXT_print(bp, ex, 0, 16))
+                                        {
+                                        BIO_printf(bp, "%16s", "");
+                                        M_ASN1_OCTET_STRING_print(bp,ex->value);
+                                        }
+                                if (BIO_write(bp,"\n",1) <= 0) goto err;
                                 }
-                        if (++ii < count) goto get_next;
+                        sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
                         }
                 }
 
-        exts = X509_REQ_get_extensions(x);
-        if(exts) {
-                BIO_printf(bp,"%8sRequested Extensions:\n","");
-                for (i=0; i<sk_X509_EXTENSION_num(exts); i++) {
-                        ASN1_OBJECT *obj;
-                        X509_EXTENSION *ex;
-                        int j;
-                        ex=sk_X509_EXTENSION_value(exts, i);
-                        if (BIO_printf(bp,"%12s","") <= 0) goto err;
-                        obj=X509_EXTENSION_get_object(ex);
-                        i2a_ASN1_OBJECT(bp,obj);
-                        j=X509_EXTENSION_get_critical(ex);
-                        if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0)
-                                goto err;
-                        if(!X509V3_EXT_print(bp, ex, 0, 16)) {
-                                BIO_printf(bp, "%16s", "");
-                                M_ASN1_OCTET_STRING_print(bp,ex->value);
-                        }
-                        if (BIO_write(bp,"\n",1) <= 0) goto err;
+        if(!(cflag & X509_FLAG_NO_SIGDUMP))
+                {
+                if(!X509_signature_print(bp, x->sig_alg, x->signature)) goto err;
                 }
-                sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
-        }
-
-        if(!X509_signature_print(bp, x->sig_alg, x->signature)) goto err;
 
         return(1);
 err:
         X509err(X509_F_X509_REQ_PRINT,ERR_R_BUF_LIB);
         return(0);
         }
+
+int X509_REQ_print(BIO *bp, X509_REQ *x)
+        {
+        return X509_REQ_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT);
+        }
diff --git a/src/lib/libcrypto/asn1/tasn_dec.c b/src/lib/libcrypto/asn1/tasn_dec.c
index 0fc1f421e2..f87c08793a 100644
--- a/src/lib/libcrypto/asn1/tasn_dec.c
+++ b/src/lib/libcrypto/asn1/tasn_dec.c
@@ -913,10 +913,10 @@ static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass, char *i
                         ctx->ptag = ptag;
                         ctx->hdrlen = p - q;
                         ctx->valid = 1;
-                        /* If definite length, length + header can't exceed total
-                         * amount of data available.
+                        /* If definite length, and no error, length +
+                         * header can't exceed total amount of data available. 
                          */
-                        if(!(i & 1) && ((plen + ctx->hdrlen) > len)) {
+                        if(!(i & 0x81) && ((plen + ctx->hdrlen) > len)) {
                                 ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_TOO_LONG);
                                 asn1_tlc_clear(ctx);
                                 return 0;