summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/bio (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Unify *_up_ref() implementationstb2024-03-271-3/+2
| | | | | | No need for an inconsistently named local variable and a ternary operator. ok jsing
* Remove BIO_set()tb2024-03-022-11/+2
| | | | | | | This used to be a dangerous implementation detail of BIO_new() that was never used outside of libcrypto. ok jsing
* Remove BIO_dump_*{cb,fp}()tb2024-03-022-44/+4
| | | | | | | These were disabled and the internals that need to remain were fixed. Time for this garbage to go. ok jsing
* Remove BIO_{sn,v,vsn}printf(3)tb2024-03-023-72/+11
| | | | | | | Unsued printing functionality. If something should need this we can readily add it back. ok jsing
* Use calloc() instead of malloc() in BIO_new().jsing2024-02-171-16/+5
| | | | ok tb@
* Inline and disable BIO_set().jsing2024-02-161-21/+19
| | | | | | | | BIO_set() is a dangerous function that cannot be used safely. Thankfully, the only consumer is BIO_new(), hence inline the functionality and disable the BIO_set() function (for complete removal in the near future). ok tb@
* Use 'bio' more consistently for function arguments.jsing2024-02-161-58/+61
| | | | | | | | Rather than 'a' or 'b', use 'bio' more consistently - there are still some more complex cases that have been left alone for now. Also use fewer parentheses. No change to generated assembly other than line numbers.
* BIO_dump*() avoid signed integer overflowtb2024-02-151-1/+10
| | | | | | | | | This API returns an int encoding the number of bytes printed. Thus, a dump of a large enough byte string can make this overflow and rely on undefined behavior. With an indent of 64, as little as 26 MB is enough to make this happen. ok jsing
* Reimplement BIO_dump_indent() with CBS/CBB and BIO_printf()tb2024-02-021-64/+115
| | | | | | | | | | | | | Instead of heaps of unchecked strlcpy/strlcat/snprintf doing hard to follow gymnastics, use a byte string, a somewhat comprehensible computation of the number of bytes to dump per output line and write using checked BIO_printf() directly to the BIO. Longer strings will still overflow the terminal width of 80 and even longer strings will still overflow the return value (undefined behavior). I don't care much about the former but the latter should be fixed in a later pass. ok beck
* Prepare to remove the _cb() and _fp() versions of BIO_dump()tb2024-02-011-33/+30
| | | | | | | | | | | | | apache-httpd uses BIO_dump(), libssl uses BIO_dump_indent(), and the openssl(1) app uses both. Otherwise this is unused. This is horribly bad code even by libcrypto standards. By doing away with the callbacks fixes incorrect error checking for fwrite() but there is a lot more wrong in here. This can be cleaned up in a later pass, the only concern here is to be able to remove the unused variants in the next major bump. ok beck
* KNF, no assembly changeschwarze2023-08-251-13/+9
| | | | OK tb@ jsing@
* Fix two leaks in BIO_dup_chain()tb2023-08-071-19/+17
| | | | | | | | If CRYPTO_dup_ex_data() fails, the new_bio is leaked. If an error occurs after the first iteration, all members of the new chain except the head are leaked. ok jsing
* Add missing space before =tb2023-08-071-2/+2
|
* reinstate KNF for commenttb2023-07-291-2/+2
|
* Drop BIO_n{read,write}{,0}()tb2023-07-281-255/+2
| | | | | | | | | | | | | | | | | | This is one of those strange things that should never have made it into a security-oriented libraries. From BIO_s_bio.3: .\" The following non-copying I/O functions are intentionally undocumented .\" because they seem fragile and unused by anything: It was used in a single place: the gorgeous ssltest. I'm not smart enough to follow. Also: /* WARNING: The non-copying interface is largely untested as of yet * and may contain bugs. */ Oh, really? Into the great bitbucket in the sky you go. ok jsing
* Make ASN.1 BIO internaltb2023-07-281-16/+1
| | | | | | | | | | | | With every bump we can remove a bit more of the ASN.1 BIO and the streaming interface. At some point enough will be internal so that we can rewrite it and bring it in a shape where mere mortals can follow all the twists and turns. This is the next step: BIO_f_asn1(3) goes away and takes BIO_asn1_{get,set}_{prefix,suffix}() with it, a bunch of functions helping along in a write-after-free recently. The getters go away, the setters stay for now. ok jsing
* BIO_indent: use %*s rather than puts in a looptb2023-07-101-6/+5
| | | | ok beck jsing millert
* Unbreak the namespace build after a broken mk.conf and tool misfire hadbeck2023-07-074-10/+4
| | | | | | | | me aliasing symbols not in the headers I was procesing. This unbreaks the namespace build so it will pass again ok tb@
* Hide symbols in asn1 and biobeck2023-07-0521-24/+149
| | | | ok jsing@
* Merge bio.h patch from libressl-portabletb2023-07-051-1/+15
| | | | ok beck@
* Correct formattingbeck2023-07-051-17/+9
| | | | ok jsing@
* Send the linebuffer BIO to the attictb2023-05-141-377/+0
| | | | | | | | | | | | | | | | | | | | | *) On VMS, stdout may very well lead to a file that is written to in a record-oriented fashion. That means that every write() will write a separate record, which will be read separately by the programs trying to read from it. This can be very confusing. The solution is to put a BIO filter in the way that will buffer text until a linefeed is reached, and then write everything a line at a time, so every record written will be an actual line, not chunks of lines and not (usually doesn't happen, but I've seen it once) several lines in one record. BIO_f_linebuffer() is the answer. Currently, it's a VMS-only method, because that's where it has been tested well enough. [Richard Levitte] Yeah, no, we don't care about any of this and haven't compiled this file since forever. Looks like tedu's chainsaw got blunt at some point...
* Streaming BIOs assume they can write to NULL BIOstb2023-03-151-5/+4
| | | | | | | | | | At least SMIME_text() relies on this. Pushing an error on the stack trips PKCS7 regress in py-cryptography, so indicate nothing was written instead of throwing an error. Reported by Alex Gaynor a while back ok jsing
* spelling fixes; from paul tagliamontejmc2022-12-261-2/+2
| | | | | | | i removed the arithmetics -> arithmetic changes, as i felt they were not clearly correct ok tb
* in case of failure, always report the error with BIOerror();schwarze2022-12-221-4/+14
| | | | OK tb@
* Revert BIO_push(3) cycle prevention (bio_lib.c rev. 1.42).schwarze2022-12-161-7/+1
| | | | | | | | | | | | | | | | | | | jsing@ worries that cycle prevention might increase risk because software that is not checking return values (and indeed, not checking is likely common in practice) might silently behave incorrectly with cycle prevention whereas without, it will likely either crash right away through infinite recursion or at least hang in an infinite loop when trying to use the cyclic chain, in both cases making it likely that the bug will be found and fixed. Besides, tb@ points out that BIO_set_next(3) ought to behave as similarly as possible to BIO_push(3), but adding cycle prevention to BIO_set_next(3) would be even less convincing because that function does not provide a return value, encouraging users to expect that it will always succeed. While a safe idiom for checking the success of BIO_set_next(3) could easily be designed, let's be realistic: application software would be highly unlikely to pick up such an idiom.
* Improve the implementation of BIO_push(3) such that it changes nothingschwarze2022-12-071-1/+7
| | | | | | and reports failure if a call would result in a cycle. The algorithm used was originally suggested by jsing@. Feedback and OK tb@.
* Make sure BIO_push(3) always preserves all invariants of the prev_bioschwarze2022-12-061-3/+10
| | | | | | | | | | | | | | | | | | | | and next_bio fields of all BIO objects in all affected chains, no matter what the arguments are. In particular, if the second argument (the one to be appended) is not at the beginning of its chain, properly detach the beginning of its chain before appending. We have weak indications that this bug might affect real-world code. For example, in FreeRDP, file libfreerdp/crypto/tls.c, function bio_rdp_tls_ctrl(), case BIO_C_SET_SSL, BIO_push(3) is definitely called with a second argument that is *not* at the beginning of its chain. Admittedly, that code is hard to fathom, but it does appear to result in a bogus prev_bio pointer without this patch. The practical impact of this bug in this and other software remains unknown; the consequences might possibly escalate up to use-after-free issues if BIO_pop(3) is afterwards called on corrupted BIO objects. OK tb@
* Improve the poorly designed BIO_set_next(3) API to always preserve allschwarze2022-12-061-3/+18
| | | | | | | | | | | | | | | | | invariants of the prev_bio and next_bio fields of all BIO objects in all involved chains, no matter which arguments this function is called with. Both real-world uses of this function (in libssl and freerdp) have been audited to make sure this makes nothing worse. We believe libssl behaves correctly before and after the patch (mostly because the second argument is NULL there), and we believe the code in freerdp behaves incorrectly before and after the patch, leaving a prev_bio pointer in place that is becoming bogus, only in a different object before and after the patch. But after the patch, that bogus pointer is due to a separate bug in BIO_push(3), which we are planning to fix afterwards. Joint work with and OK tb@.
* Revert bio_prev removaltb2022-12-022-2/+12
| | | | | | | | | As schwarze points out, you can pop any BIO in a chain, not just the first one (bonus points for a great name for this API). The internal doubly linked was used to fix up the BIO chain bio was part of when you BIO_pop() a bio that wasn't in the first position, which is explicitly allowed in our documentation and implied by OpenSSL's.
* Mostly align BIO_read()/BIO_write() return values with OpenSSL 3.x.jsing2022-11-301-7/+21
| | | | | | | | | | For various historical reasons, there are a number of cases where our BIO_read() and BIO_write() return slightly different values to what OpenSSL 3.x does (of course OpenSSL 1.0 differs from OpenSSL 1.1 which differs from OpenSSL 3.x). Mostly align these - some further work will be needed. Issue raised by tb@ who also wrote some test code.
* Retire prev_biotb2022-11-282-12/+2
| | | | | | | | | | | | | While BIO chains are doubly linked lists, nothing has ever made use of this fact internally. Even libssl has failed to maintain prev_bio properly in two places for a long time. When BIO was made opaque, the opportunity to fix that was missed. Instead, BIO_set_next() now allows breaking the lists from outside the library, which freerdp has long done. Problem found by schwarze while trying to document BIO_set_next(). schwarze likes the idea ok jsing
* Avoid potential divide by zero in BIO_dump_indent_cb()jsing2022-10-171-8/+7
| | | | | | | | | | | | | Passing an indent value of 67 results in DUMP_WIDTH_LESS_IDENT returning a value of zero, which is promptly used for division. Likewise, passing a value larger than 67 results in a negative value being returned. Prevent this by limiting indent to 64 (which matches OpenSSL's current behaviour), as well as ensuring that dump_width is > 0. Should fix oss-fuzz #52464 and #52467. ok miod@ tb@
* Make BIO_info_cb() identical to bio_info_cb()tb2022-09-111-2/+3
| | | | | | | | | | | | | Various projects use bio_info_cb and BIO_info_cb interchangeably, for example mupdf and freerdp. This is because this was changed in OpenSSL commit fce78bd4 (2017), triggered by new warnings in gcc 8. https://github.com/openssl/openssl/pull/4493 This results in some scary compiler warnings and useless patches in ports. Nobody seems to be using the old bio_info_cb() version. ok jsing
* Initialize readbytes in BIO_gets()tb2022-08-151-2/+2
| | | | | | | | If the bgets() callback returns <= 0, we currently rely on the user provided callback to set readbytes, which isn't ideal. This also matches what's done in BIO_read() and BIO_write(). ok jsing
* Remove mkerr.pl remnants from LibreSSLkn2022-07-122-12/+2
| | | | | | | This script is not used at all and files are edited by hand instead. Thus remove misleading comments incl. the obsolete script/config. Feedback OK jsing tb
* Reduce memmoves in memory BIOs.jsing2022-02-191-22/+38
| | | | | | | | | | | | | | | | | Currently, a read/write memory BIO pulls up the data via memmove() on each read. This becomes very expensive when a lot of small reads are performed, especially if there is a reasonable amount of data stored in the memory BIO. Instead, store a read offset into the buffer and only perform a memmove() to pull up the data on a write, if we have read more than 4096 bytes. This way we only perform memmove() when the space saving will potentially be of benefit, while avoiding frequent memmove() in the case of small interleaved reads and writes. Should address oss-fuzz #19881. ok inoguchi@ tb@
* Provide a struct bio_mem for memory BIO specific data.jsing2022-02-191-47/+58
| | | | | | | | | In order to fix and improve the memory BIO, we need to be able to track more than just a single BUF_MEM *. Provide a struct bio_mem (which currently only contains a BUF_MEM *) and rework the internals to use this struct. ok inoguchi@ tb@
* Clean up and simplify memory BIO code.jsing2022-02-181-124/+139
| | | | | | | | This is a first pass that uses sensible and consistent names for variables. Call the BIO 'bio' (instead of 'a', 'b', 'bp', or 'h'), drop a bunch of unnecessary casts, simplify some logic and add additional error checking. With input from and ok tb@
* Implement new-style OpenSSL BIO callbackstb2022-01-1410-130/+251
| | | | | | | | | | This provides support for new-style BIO callbacks in BIO_{read,write,gets,puts}() and a helper function to work out whether it should call the new or the old style callback. It also adds a few typedefs and minor code cleanup as well as the BIO_{get,set}_callback_ex() from jsing, ok tb
* Make structs in bio.h opaquetb2022-01-142-60/+60
| | | | | | | Move BIO, BIO_METHOD and BIO_F_BUFFER_CTX to bio_local.h and provide BIO typedef in ossl_typ.h. ok inoguchi jsing
* Remove BIO_s_file_internaltb2022-01-141-4/+1
| | | | | | | Pointed out by schwarze. How something with this name ever made its way into a public header will remain a mystery. ok inoguchi jsing
* Unifdef LIBRESSL_OPAQUE_* and LIBRESSL_NEXT_APItb2022-01-141-5/+1
| | | | | This marks the start of major surgery in libcrypto. Do not attempt to build the tree for a while (~50 commits).
* Add a new, mostly empty, bio_local.h and include it in the filestb2022-01-0717-16/+114
| | | | | | that will need it in the upcoming bump. discussed with jsing
* Prepare to provide BIO_set_retry_reason()tb2022-01-052-2/+11
| | | | | | Needed by freerdp. ok inoguchi jsing
* Prepare to provide BIO_set_next().tb2022-01-052-2/+11
| | | | | | This will be needed in libssl and freerdp after the next bump. ok inoguchi jsing
* Fix an issue that might possibly turn into a DOS depending onschwarze2021-12-091-3/+3
| | | | | | | | | | how application software uses the API function BIO_indent(3): If the caller asks for some output, but not more than some negative number of bytes, give them zero bytes of output rather than drowning them in nearly INT_MAX bytes. OK tb@
* Hide BIO_s_file_internal() from internal view.tb2021-11-291-2/+4
| | | | ok jsing
* Unifdef LIBRESSL_NEW_API. Now that the library is bumped, this istb2021-11-011-3/+1
| | | | | | no longer needed. ok jsing
* Prepare to provide BIO_get_init()tb2021-10-242-5/+14
| | | | ok beck jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-26 10:02:00 +0000