summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/pkcs7
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/pkcs7')
-rw-r--r--src/lib/libcrypto/pkcs7/pk7_attr.c9
-rw-r--r--src/lib/libcrypto/pkcs7/pk7_doit.c42
-rw-r--r--src/lib/libcrypto/pkcs7/pk7_lib.c44
-rw-r--r--src/lib/libcrypto/pkcs7/pk7_smime.c46
4 files changed, 109 insertions, 32 deletions
diff --git a/src/lib/libcrypto/pkcs7/pk7_attr.c b/src/lib/libcrypto/pkcs7/pk7_attr.c
index 5ff5a88b5c..039141027a 100644
--- a/src/lib/libcrypto/pkcs7/pk7_attr.c
+++ b/src/lib/libcrypto/pkcs7/pk7_attr.c
@@ -3,7 +3,7 @@
3 * project 2001. 3 * project 2001.
4 */ 4 */
5/* ==================================================================== 5/* ====================================================================
6 * Copyright (c) 2001 The OpenSSL Project. All rights reserved. 6 * Copyright (c) 2001-2004 The OpenSSL Project. All rights reserved.
7 * 7 *
8 * Redistribution and use in source and binary forms, with or without 8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions 9 * modification, are permitted provided that the following conditions
@@ -94,17 +94,18 @@ int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK_OF(X509_ALGOR) *cap)
94} 94}
95 95
96STACK_OF(X509_ALGOR) *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si) 96STACK_OF(X509_ALGOR) *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si)
97{ 97 {
98 ASN1_TYPE *cap; 98 ASN1_TYPE *cap;
99 unsigned char *p; 99 unsigned char *p;
100 cap = PKCS7_get_signed_attribute(si, NID_SMIMECapabilities); 100 cap = PKCS7_get_signed_attribute(si, NID_SMIMECapabilities);
101 if (!cap) return NULL; 101 if (!cap || (cap->type != V_ASN1_SEQUENCE))
102 return NULL;
102 p = cap->value.sequence->data; 103 p = cap->value.sequence->data;
103 return d2i_ASN1_SET_OF_X509_ALGOR(NULL, &p, 104 return d2i_ASN1_SET_OF_X509_ALGOR(NULL, &p,
104 cap->value.sequence->length, 105 cap->value.sequence->length,
105 d2i_X509_ALGOR, X509_ALGOR_free, 106 d2i_X509_ALGOR, X509_ALGOR_free,
106 V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL); 107 V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
107} 108 }
108 109
109/* Basic smime-capabilities OID and optional integer arg */ 110/* Basic smime-capabilities OID and optional integer arg */
110int PKCS7_simple_smimecap(STACK_OF(X509_ALGOR) *sk, int nid, int arg) 111int PKCS7_simple_smimecap(STACK_OF(X509_ALGOR) *sk, int nid, int arg)
diff --git a/src/lib/libcrypto/pkcs7/pk7_doit.c b/src/lib/libcrypto/pkcs7/pk7_doit.c
index b78e22819c..4ac29ae14d 100644
--- a/src/lib/libcrypto/pkcs7/pk7_doit.c
+++ b/src/lib/libcrypto/pkcs7/pk7_doit.c
@@ -239,7 +239,13 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
239 OPENSSL_free(tmp); 239 OPENSSL_free(tmp);
240 goto err; 240 goto err;
241 } 241 }
242 M_ASN1_OCTET_STRING_set(ri->enc_key,tmp,jj); 242 if (!M_ASN1_OCTET_STRING_set(ri->enc_key,tmp,jj))
243 {
244 PKCS7err(PKCS7_F_PKCS7_DATAINIT,
245 ERR_R_MALLOC_FAILURE);
246 OPENSSL_free(tmp);
247 goto err;
248 }
243 } 249 }
244 OPENSSL_free(tmp); 250 OPENSSL_free(tmp);
245 OPENSSL_cleanse(key, keylen); 251 OPENSSL_cleanse(key, keylen);
@@ -520,12 +526,20 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
520 case NID_pkcs7_signedAndEnveloped: 526 case NID_pkcs7_signedAndEnveloped:
521 /* XXXXXXXXXXXXXXXX */ 527 /* XXXXXXXXXXXXXXXX */
522 si_sk=p7->d.signed_and_enveloped->signer_info; 528 si_sk=p7->d.signed_and_enveloped->signer_info;
523 os=M_ASN1_OCTET_STRING_new(); 529 if (!(os=M_ASN1_OCTET_STRING_new()))
530 {
531 PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_MALLOC_FAILURE);
532 goto err;
533 }
524 p7->d.signed_and_enveloped->enc_data->enc_data=os; 534 p7->d.signed_and_enveloped->enc_data->enc_data=os;
525 break; 535 break;
526 case NID_pkcs7_enveloped: 536 case NID_pkcs7_enveloped:
527 /* XXXXXXXXXXXXXXXX */ 537 /* XXXXXXXXXXXXXXXX */
528 os=M_ASN1_OCTET_STRING_new(); 538 if (!(os=M_ASN1_OCTET_STRING_new()))
539 {
540 PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_MALLOC_FAILURE);
541 goto err;
542 }
529 p7->d.enveloped->enc_data->enc_data=os; 543 p7->d.enveloped->enc_data->enc_data=os;
530 break; 544 break;
531 case NID_pkcs7_signed: 545 case NID_pkcs7_signed:
@@ -599,7 +613,12 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
599 if (!PKCS7_get_signed_attribute(si, 613 if (!PKCS7_get_signed_attribute(si,
600 NID_pkcs9_signingTime)) 614 NID_pkcs9_signingTime))
601 { 615 {
602 sign_time=X509_gmtime_adj(NULL,0); 616 if (!(sign_time=X509_gmtime_adj(NULL,0)))
617 {
618 PKCS7err(PKCS7_F_PKCS7_DATASIGN,
619 ERR_R_MALLOC_FAILURE);
620 goto err;
621 }
603 PKCS7_add_signed_attribute(si, 622 PKCS7_add_signed_attribute(si,
604 NID_pkcs9_signingTime, 623 NID_pkcs9_signingTime,
605 V_ASN1_UTCTIME,sign_time); 624 V_ASN1_UTCTIME,sign_time);
@@ -608,8 +627,19 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
608 /* Add digest */ 627 /* Add digest */
609 md_tmp=EVP_MD_CTX_md(&ctx_tmp); 628 md_tmp=EVP_MD_CTX_md(&ctx_tmp);
610 EVP_DigestFinal_ex(&ctx_tmp,md_data,&md_len); 629 EVP_DigestFinal_ex(&ctx_tmp,md_data,&md_len);
611 digest=M_ASN1_OCTET_STRING_new(); 630 if (!(digest=M_ASN1_OCTET_STRING_new()))
612 M_ASN1_OCTET_STRING_set(digest,md_data,md_len); 631 {
632 PKCS7err(PKCS7_F_PKCS7_DATASIGN,
633 ERR_R_MALLOC_FAILURE);
634 goto err;
635 }
636 if (!M_ASN1_OCTET_STRING_set(digest,md_data,
637 md_len))
638 {
639 PKCS7err(PKCS7_F_PKCS7_DATASIGN,
640 ERR_R_MALLOC_FAILURE);
641 goto err;
642 }
613 PKCS7_add_signed_attribute(si, 643 PKCS7_add_signed_attribute(si,
614 NID_pkcs9_messageDigest, 644 NID_pkcs9_messageDigest,
615 V_ASN1_OCTET_STRING,digest); 645 V_ASN1_OCTET_STRING,digest);
diff --git a/src/lib/libcrypto/pkcs7/pk7_lib.c b/src/lib/libcrypto/pkcs7/pk7_lib.c
index 985b07245c..ee1817c7af 100644
--- a/src/lib/libcrypto/pkcs7/pk7_lib.c
+++ b/src/lib/libcrypto/pkcs7/pk7_lib.c
@@ -164,7 +164,12 @@ int PKCS7_set_type(PKCS7 *p7, int type)
164 p7->type=obj; 164 p7->type=obj;
165 if ((p7->d.sign=PKCS7_SIGNED_new()) == NULL) 165 if ((p7->d.sign=PKCS7_SIGNED_new()) == NULL)
166 goto err; 166 goto err;
167 ASN1_INTEGER_set(p7->d.sign->version,1); 167 if (!ASN1_INTEGER_set(p7->d.sign->version,1))
168 {
169 PKCS7_SIGNED_free(p7->d.sign);
170 p7->d.sign=NULL;
171 goto err;
172 }
168 break; 173 break;
169 case NID_pkcs7_data: 174 case NID_pkcs7_data:
170 p7->type=obj; 175 p7->type=obj;
@@ -176,6 +181,8 @@ int PKCS7_set_type(PKCS7 *p7, int type)
176 if ((p7->d.signed_and_enveloped=PKCS7_SIGN_ENVELOPE_new()) 181 if ((p7->d.signed_and_enveloped=PKCS7_SIGN_ENVELOPE_new())
177 == NULL) goto err; 182 == NULL) goto err;
178 ASN1_INTEGER_set(p7->d.signed_and_enveloped->version,1); 183 ASN1_INTEGER_set(p7->d.signed_and_enveloped->version,1);
184 if (!ASN1_INTEGER_set(p7->d.signed_and_enveloped->version,1))
185 goto err;
179 p7->d.signed_and_enveloped->enc_data->content_type 186 p7->d.signed_and_enveloped->enc_data->content_type
180 = OBJ_nid2obj(NID_pkcs7_data); 187 = OBJ_nid2obj(NID_pkcs7_data);
181 break; 188 break;
@@ -183,7 +190,8 @@ int PKCS7_set_type(PKCS7 *p7, int type)
183 p7->type=obj; 190 p7->type=obj;
184 if ((p7->d.enveloped=PKCS7_ENVELOPE_new()) 191 if ((p7->d.enveloped=PKCS7_ENVELOPE_new())
185 == NULL) goto err; 192 == NULL) goto err;
186 ASN1_INTEGER_set(p7->d.enveloped->version,0); 193 if (!ASN1_INTEGER_set(p7->d.enveloped->version,0))
194 goto err;
187 p7->d.enveloped->enc_data->content_type 195 p7->d.enveloped->enc_data->content_type
188 = OBJ_nid2obj(NID_pkcs7_data); 196 = OBJ_nid2obj(NID_pkcs7_data);
189 break; 197 break;
@@ -191,7 +199,8 @@ int PKCS7_set_type(PKCS7 *p7, int type)
191 p7->type=obj; 199 p7->type=obj;
192 if ((p7->d.encrypted=PKCS7_ENCRYPT_new()) 200 if ((p7->d.encrypted=PKCS7_ENCRYPT_new())
193 == NULL) goto err; 201 == NULL) goto err;
194 ASN1_INTEGER_set(p7->d.encrypted->version,0); 202 if (!ASN1_INTEGER_set(p7->d.encrypted->version,0))
203 goto err;
195 p7->d.encrypted->enc_data->content_type 204 p7->d.encrypted->enc_data->content_type
196 = OBJ_nid2obj(NID_pkcs7_data); 205 = OBJ_nid2obj(NID_pkcs7_data);
197 break; 206 break;
@@ -318,15 +327,18 @@ int PKCS7_SIGNER_INFO_set(PKCS7_SIGNER_INFO *p7i, X509 *x509, EVP_PKEY *pkey,
318 if (pkey->type == EVP_PKEY_DSA) is_dsa = 1; 327 if (pkey->type == EVP_PKEY_DSA) is_dsa = 1;
319 else is_dsa = 0; 328 else is_dsa = 0;
320 /* We now need to add another PKCS7_SIGNER_INFO entry */ 329 /* We now need to add another PKCS7_SIGNER_INFO entry */
321 ASN1_INTEGER_set(p7i->version,1); 330 if (!ASN1_INTEGER_set(p7i->version,1))
322 X509_NAME_set(&p7i->issuer_and_serial->issuer, 331 goto err;
323 X509_get_issuer_name(x509)); 332 if (!X509_NAME_set(&p7i->issuer_and_serial->issuer,
333 X509_get_issuer_name(x509)))
334 goto err;
324 335
325 /* because ASN1_INTEGER_set is used to set a 'long' we will do 336 /* because ASN1_INTEGER_set is used to set a 'long' we will do
326 * things the ugly way. */ 337 * things the ugly way. */
327 M_ASN1_INTEGER_free(p7i->issuer_and_serial->serial); 338 M_ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
328 p7i->issuer_and_serial->serial= 339 if (!(p7i->issuer_and_serial->serial=
329 M_ASN1_INTEGER_dup(X509_get_serialNumber(x509)); 340 M_ASN1_INTEGER_dup(X509_get_serialNumber(x509))))
341 goto err;
330 342
331 /* lets keep the pkey around for a while */ 343 /* lets keep the pkey around for a while */
332 CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY); 344 CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
@@ -423,16 +435,20 @@ int PKCS7_add_recipient_info(PKCS7 *p7, PKCS7_RECIP_INFO *ri)
423 435
424int PKCS7_RECIP_INFO_set(PKCS7_RECIP_INFO *p7i, X509 *x509) 436int PKCS7_RECIP_INFO_set(PKCS7_RECIP_INFO *p7i, X509 *x509)
425 { 437 {
426 ASN1_INTEGER_set(p7i->version,0); 438 if (!ASN1_INTEGER_set(p7i->version,0))
427 X509_NAME_set(&p7i->issuer_and_serial->issuer, 439 return 0;
428 X509_get_issuer_name(x509)); 440 if (!X509_NAME_set(&p7i->issuer_and_serial->issuer,
441 X509_get_issuer_name(x509)))
442 return 0;
429 443
430 M_ASN1_INTEGER_free(p7i->issuer_and_serial->serial); 444 M_ASN1_INTEGER_free(p7i->issuer_and_serial->serial);
431 p7i->issuer_and_serial->serial= 445 if (!(p7i->issuer_and_serial->serial=
432 M_ASN1_INTEGER_dup(X509_get_serialNumber(x509)); 446 M_ASN1_INTEGER_dup(X509_get_serialNumber(x509))))
447 return 0;
433 448
434 X509_ALGOR_free(p7i->key_enc_algor); 449 X509_ALGOR_free(p7i->key_enc_algor);
435 p7i->key_enc_algor= X509_ALGOR_dup(x509->cert_info->key->algor); 450 if (!(p7i->key_enc_algor= X509_ALGOR_dup(x509->cert_info->key->algor)))
451 return 0;
436 452
437 CRYPTO_add(&x509->references,1,CRYPTO_LOCK_X509); 453 CRYPTO_add(&x509->references,1,CRYPTO_LOCK_X509);
438 p7i->cert=x509; 454 p7i->cert=x509;
diff --git a/src/lib/libcrypto/pkcs7/pk7_smime.c b/src/lib/libcrypto/pkcs7/pk7_smime.c
index 6e5735de11..a852b49235 100644
--- a/src/lib/libcrypto/pkcs7/pk7_smime.c
+++ b/src/lib/libcrypto/pkcs7/pk7_smime.c
@@ -155,7 +155,7 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
155 char buf[4096]; 155 char buf[4096];
156 int i, j=0, k, ret = 0; 156 int i, j=0, k, ret = 0;
157 BIO *p7bio; 157 BIO *p7bio;
158 BIO *tmpout; 158 BIO *tmpin, *tmpout;
159 159
160 if(!p7) { 160 if(!p7) {
161 PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_INVALID_NULL_POINTER); 161 PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_INVALID_NULL_POINTER);
@@ -228,7 +228,30 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
228 /* Check for revocation status here */ 228 /* Check for revocation status here */
229 } 229 }
230 230
231 p7bio=PKCS7_dataInit(p7,indata); 231 /* Performance optimization: if the content is a memory BIO then
232 * store its contents in a temporary read only memory BIO. This
233 * avoids potentially large numbers of slow copies of data which will
234 * occur when reading from a read write memory BIO when signatures
235 * are calculated.
236 */
237
238 if (indata && (BIO_method_type(indata) == BIO_TYPE_MEM))
239 {
240 char *ptr;
241 long len;
242 len = BIO_get_mem_data(indata, &ptr);
243 tmpin = BIO_new_mem_buf(ptr, len);
244 if (tmpin == NULL)
245 {
246 PKCS7err(PKCS7_F_PKCS7_VERIFY,ERR_R_MALLOC_FAILURE);
247 return 0;
248 }
249 }
250 else
251 tmpin = indata;
252
253
254 p7bio=PKCS7_dataInit(p7,tmpin);
232 255
233 if(flags & PKCS7_TEXT) { 256 if(flags & PKCS7_TEXT) {
234 if(!(tmpout = BIO_new(BIO_s_mem()))) { 257 if(!(tmpout = BIO_new(BIO_s_mem()))) {
@@ -270,9 +293,15 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
270 ret = 1; 293 ret = 1;
271 294
272 err: 295 err:
296
297 if (tmpin == indata)
298 {
299 if(indata) BIO_pop(p7bio);
300 BIO_free_all(p7bio);
301 }
302 else
303 BIO_free_all(tmpin);
273 304
274 if(indata) BIO_pop(p7bio);
275 BIO_free_all(p7bio);
276 sk_X509_free(signers); 305 sk_X509_free(signers);
277 306
278 return ret; 307 return ret;
@@ -296,10 +325,6 @@ STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
296 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_WRONG_CONTENT_TYPE); 325 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_WRONG_CONTENT_TYPE);
297 return NULL; 326 return NULL;
298 } 327 }
299 if(!(signers = sk_X509_new_null())) {
300 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,ERR_R_MALLOC_FAILURE);
301 return NULL;
302 }
303 328
304 /* Collect all the signers together */ 329 /* Collect all the signers together */
305 330
@@ -310,6 +335,11 @@ STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
310 return 0; 335 return 0;
311 } 336 }
312 337
338 if(!(signers = sk_X509_new_null())) {
339 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,ERR_R_MALLOC_FAILURE);
340 return NULL;
341 }
342
313 for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++) 343 for (i = 0; i < sk_PKCS7_SIGNER_INFO_num(sinfos); i++)
314 { 344 {
315 si = sk_PKCS7_SIGNER_INFO_value(sinfos, i); 345 si = sk_PKCS7_SIGNER_INFO_value(sinfos, i);
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-04 05:58:53 +0000