lib/asn1/der_get.c

   1 /*
   2  * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "der_locl.h"
  35
  36 /*
  37  * All decoding functions take a pointer `p' to first position in
  38  * which to read, from the left, `len' which means the maximum number
  39  * of characters we are able to read, `ret' were the value will be
  40  * returned and `size' where the number of used bytes is stored.
  41  * Either 0 or an error code is returned.
  42  */
  43
  44 int ASN1CALL
  45 der_get_unsigned (const unsigned char *p, size_t len,
  46                   unsigned *ret, size_t *size)
  47 {
  48     unsigned val = 0;
  49     size_t oldlen = len;
  50
  51     if (len == sizeof(val) + 1 && p[0] == 0)
  52         ;
  53     else if (len > sizeof(val))
  54         return ASN1_OVERRUN;
  55
  56     while (len--)
  57         val = val * 256 + *p++;
  58     *ret = val;
  59     if(size) *size = oldlen;
  60     return 0;
  61 }
  62
  63 int ASN1CALL
  64 der_get_unsigned64 (const unsigned char *p, size_t len,
  65                    uint64_t *ret, size_t *size)
  66 {
  67     uint64_t val = 0;
  68     size_t oldlen = len;
  69
  70     if (len == sizeof(val) + 1 && p[0] == 0)
  71        ;
  72     else if (len > sizeof(val))
  73         return ASN1_OVERRUN;
  74
  75     while (len--)
  76         val = val * 256 + *p++;
  77     *ret = val;
  78     if(size) *size = oldlen;
  79     return 0;
  80 }
  81
  82 int ASN1CALL
  83 der_get_integer (const unsigned char *p, size_t len,
  84                  int *ret, size_t *size)
  85 {
  86     int val = 0;
  87     size_t oldlen = len;
  88
  89     if (len > sizeof(val))
  90         return ASN1_OVERRUN;
  91
  92     if (len > 0) {
  93         val = (signed char)*p++;
  94         while (--len)
  95             val = val * 256 + *p++;
  96     }
  97     *ret = val;
  98     if(size) *size = oldlen;
  99     return 0;
 100 }
 101
 102 int ASN1CALL
 103 der_get_integer64 (const unsigned char *p, size_t len,
 104                    int64_t *ret, size_t *size)
 105 {
 106     int64_t val = 0;
 107     size_t oldlen = len;
 108
 109     if (len > sizeof(val))
 110         return ASN1_OVERRUN;
 111
 112     if (len > 0) {
 113        val = (signed char)*p++;
 114        while (--len)
 115            val = val * 256 + *p++;
 116     }
 117     *ret = val;
 118     if(size) *size = oldlen;
 119     return 0;
 120 }
 121
 122
 123 int ASN1CALL
 124 der_get_length (const unsigned char *p, size_t len,
 125                 size_t *val, size_t *size)
 126 {
 127     size_t v;
 128
 129     if (len <= 0)
 130         return ASN1_OVERRUN;
 131     --len;
 132     v = *p++;
 133     if (v < 128) {
 134         *val = v;
 135         if(size) *size = 1;
 136     } else {
 137         int e;
 138         size_t l;
 139         unsigned tmp;
 140
 141         if(v == 0x80){
 142             *val = ASN1_INDEFINITE;
 143             if(size) *size = 1;
 144             return 0;
 145         }
 146         v &= 0x7F;
 147         if (len < v)
 148             return ASN1_OVERRUN;
 149         e = der_get_unsigned (p, v, &tmp, &l);
 150         if(e) return e;
 151         *val = tmp;
 152         if(size) *size = l + 1;
 153     }
 154     return 0;
 155 }
 156
 157 int ASN1CALL
 158 der_get_boolean(const unsigned char *p, size_t len, int *data, size_t *size)
 159 {
 160     if(len < 1)
 161         return ASN1_OVERRUN;
 162     if(*p != 0)
 163         *data = 1;
 164     else
 165         *data = 0;
 166     *size = 1;
 167     return 0;
 168 }
 169
 170 int ASN1CALL
 171 der_get_general_string (const unsigned char *p, size_t len,
 172                         heim_general_string *str, size_t *size)
 173 {
 174     const unsigned char *p1;
 175     char *s;
 176
 177     if (size)
 178         *size = 0;
 179
 180     p1 = memchr(p, 0, len);
 181     if (p1 != NULL) {
 182         /*
 183          * Allow trailing NULs. We allow this since MIT Kerberos sends
 184          * an strings in the NEED_PREAUTH case that includes a
 185          * trailing NUL.
 186          */
 187         while ((size_t)(p1 - p) < len && *p1 == '\0')
 188             p1++;
 189         if ((size_t)(p1 - p) != len) {
 190             *str = NULL;
 191             return ASN1_BAD_CHARACTER;
 192         }
 193     }
 194     if (len == SIZE_MAX) {
 195         *str = NULL;
 196         return ASN1_BAD_LENGTH;
 197     }
 198
 199     *str = s = malloc (len + 1);
 200     if (s == NULL)
 201         return ENOMEM;
 202     memcpy (s, p, len);
 203     s[len] = '\0';
 204
 205     if(size) *size = len;
 206     return 0;
 207 }
 208
 209 int ASN1CALL
 210 der_get_utf8string (const unsigned char *p, size_t len,
 211                     heim_utf8_string *str, size_t *size)
 212 {
 213     return der_get_general_string(p, len, str, size);
 214 }
 215
 216 #define gen_data_zero(_data) \
 217         do { (_data)->length = 0; (_data)->data = NULL; } while(0)
 218
 219 int ASN1CALL
 220 der_get_printable_string(const unsigned char *p, size_t len,
 221                          heim_printable_string *str, size_t *size)
 222 {
 223     if (size)
 224         *size = 0;
 225
 226     if (len == SIZE_MAX) {
 227         gen_data_zero(str);
 228         return ASN1_BAD_LENGTH;
 229     }
 230     str->length = len;
 231     str->data = malloc(len + 1);
 232     if (str->data == NULL) {
 233         gen_data_zero(str);
 234         return ENOMEM;
 235     }
 236     memcpy(str->data, p, len);
 237     ((char *)str->data)[len] = '\0';
 238     if(size) *size = len;
 239     return 0;
 240 }
 241
 242 int ASN1CALL
 243 der_get_ia5_string(const unsigned char *p, size_t len,
 244                    heim_ia5_string *str, size_t *size)
 245 {
 246     return der_get_printable_string(p, len, str, size);
 247 }
 248
 249 int ASN1CALL
 250 der_get_bmp_string (const unsigned char *p, size_t len,
 251                     heim_bmp_string *data, size_t *size)
 252 {
 253     size_t i;
 254
 255     if (size)
 256         *size = 0;
 257
 258     if (len & 1) {
 259         gen_data_zero(data);
 260         return ASN1_BAD_FORMAT;
 261     }
 262     data->length = len / 2;
 263     if (data->length > UINT_MAX/sizeof(data->data[0])) {
 264         gen_data_zero(data);
 265         return ERANGE;
 266     }
 267     data->data = malloc(data->length * sizeof(data->data[0]));
 268     if (data->data == NULL && data->length != 0) {
 269         gen_data_zero(data);
 270         return ENOMEM;
 271     }
 272
 273     for (i = 0; i < data->length; i++) {
 274         data->data[i] = (p[0] << 8) | p[1];
 275         p += 2;
 276         /* check for NUL in the middle of the string */
 277         if (data->data[i] == 0 && i != (data->length - 1)) {
 278             free(data->data);
 279             gen_data_zero(data);
 280             return ASN1_BAD_CHARACTER;
 281         }
 282     }
 283     if (size) *size = len;
 284
 285     return 0;
 286 }
 287
 288 int ASN1CALL
 289 der_get_universal_string (const unsigned char *p, size_t len,
 290                           heim_universal_string *data, size_t *size)
 291 {
 292     size_t i;
 293
 294     if (size)
 295         *size = 0;
 296
 297     if (len & 3) {
 298         gen_data_zero(data);
 299         return ASN1_BAD_FORMAT;
 300     }
 301     data->length = len / 4;
 302     if (data->length > UINT_MAX/sizeof(data->data[0])) {
 303         gen_data_zero(data);
 304         return ERANGE;
 305     }
 306     data->data = malloc(data->length * sizeof(data->data[0]));
 307     if (data->data == NULL && data->length != 0) {
 308         gen_data_zero(data);
 309         return ENOMEM;
 310     }
 311
 312     for (i = 0; i < data->length; i++) {
 313         data->data[i] = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
 314         p += 4;
 315         /* check for NUL in the middle of the string */
 316         if (data->data[i] == 0 && i != (data->length - 1)) {
 317             free(data->data);
 318             gen_data_zero(data);
 319             return ASN1_BAD_CHARACTER;
 320         }
 321     }
 322     if (size) *size = len;
 323     return 0;
 324 }
 325
 326 int ASN1CALL
 327 der_get_visible_string (const unsigned char *p, size_t len,
 328                         heim_visible_string *str, size_t *size)
 329 {
 330     return der_get_general_string(p, len, str, size);
 331 }
 332
 333 int ASN1CALL
 334 der_get_octet_string (const unsigned char *p, size_t len,
 335                       heim_octet_string *data, size_t *size)
 336 {
 337     if (size)
 338         *size = 0;
 339     data->length = len;
 340     data->data = malloc(len);
 341     if (data->data == NULL && data->length != 0)
 342         return ENOMEM;
 343     memcpy (data->data, p, len);
 344     if(size) *size = len;
 345     return 0;
 346 }
 347
 348 int ASN1CALL
 349 der_get_octet_string_ber (const unsigned char *p, size_t len,
 350                           heim_octet_string *data, size_t *size)
 351 {
 352     int e;
 353     Der_type type;
 354     Der_class cls;
 355     unsigned int tag, depth = 0;
 356     size_t l, datalen, oldlen = len;
 357
 358     if (size)
 359         *size = 0;
 360
 361     data->length = 0;
 362     data->data = NULL;
 363
 364     while (len) {
 365         e = der_get_tag (p, len, &cls, &type, &tag, &l);
 366         if (e) goto out;
 367         if (cls != ASN1_C_UNIV) {
 368             e = ASN1_BAD_ID;
 369             goto out;
 370         }
 371         if (type == PRIM && tag == UT_EndOfContent) {
 372             if (depth == 0)
 373                 break;
 374             depth--;
 375         }
 376         if (tag != UT_OctetString) {
 377             e = ASN1_BAD_ID;
 378             goto out;
 379         }
 380
 381         p += l;
 382         len -= l;
 383         e = der_get_length (p, len, &datalen, &l);
 384         if (e) goto out;
 385         p += l;
 386         len -= l;
 387
 388         if (datalen > len)
 389             return ASN1_OVERRUN;
 390
 391         if (type == PRIM && datalen) {
 392             void *ptr;
 393
 394             ptr = realloc(data->data, data->length + datalen);
 395             if (ptr == NULL) {
 396                 e = ENOMEM;
 397                 goto out;
 398             }
 399             data->data = ptr;
 400             memcpy(((unsigned char *)data->data) + data->length, p, datalen);
 401             data->length += datalen;
 402         } else if (type != PRIM)
 403             depth++;
 404
 405         p += datalen;
 406         len -= datalen;
 407     }
 408     if (depth != 0)
 409         return ASN1_INDEF_OVERRUN;
 410     if(size) *size = oldlen - len;
 411     return 0;
 412  out:
 413     free(data->data);
 414     data->data = NULL;
 415     data->length = 0;
 416     return e;
 417 }
 418
 419
 420 int ASN1CALL
 421 der_get_heim_integer (const unsigned char *p, size_t len,
 422                       heim_integer *data, size_t *size)
 423 {
 424     data->length = 0;
 425     data->negative = 0;
 426     data->data = NULL;
 427
 428     if (size)
 429         *size = 0;
 430
 431     if (len == 0)
 432         return 0;
 433
 434     if (p[0] & 0x80) {
 435         unsigned char *q;
 436         int carry = 1;
 437         data->negative = 1;
 438
 439         data->length = len;
 440
 441         if (p[0] == 0xff) {
 442             p++;
 443             data->length--;
 444         }
 445         data->data = malloc(data->length);
 446         if (data->data == NULL) {
 447             data->length = 0;
 448             if (size)
 449                 *size = 0;
 450             return ENOMEM;
 451         }
 452         q = &((unsigned char*)data->data)[data->length - 1];
 453         p += data->length - 1;
 454         while (q >= (unsigned char*)data->data) {
 455             *q = *p ^ 0xff;
 456             if (carry)
 457                 carry = !++*q;
 458             p--;
 459             q--;
 460         }
 461     } else {
 462         data->negative = 0;
 463         data->length = len;
 464
 465         if (p[0] == 0) {
 466             p++;
 467             data->length--;
 468         }
 469         data->data = malloc(data->length);
 470         if (data->data == NULL && data->length != 0) {
 471             data->length = 0;
 472             if (size)
 473                 *size = 0;
 474             return ENOMEM;
 475         }
 476         memcpy(data->data, p, data->length);
 477     }
 478     if (size)
 479         *size = len;
 480     return 0;
 481 }
 482
 483 static int
 484 generalizedtime2time (const char *s, time_t *t)
 485 {
 486     struct tm tm;
 487
 488     memset(&tm, 0, sizeof(tm));
 489     if (sscanf (s, "%04d%02d%02d%02d%02d%02dZ",
 490                 &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour,
 491                 &tm.tm_min, &tm.tm_sec) != 6) {
 492         if (sscanf (s, "%02d%02d%02d%02d%02d%02dZ",
 493                     &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour,
 494                     &tm.tm_min, &tm.tm_sec) != 6)
 495             return ASN1_BAD_TIMEFORMAT;
 496         if (tm.tm_year < 50)
 497             tm.tm_year += 2000;
 498         else
 499             tm.tm_year += 1900;
 500     }
 501     tm.tm_year -= 1900;
 502     tm.tm_mon -= 1;
 503     *t = _der_timegm (&tm);
 504     return 0;
 505 }
 506
 507 static int ASN1CALL
 508 der_get_time (const unsigned char *p, size_t len,
 509               time_t *data, size_t *size)
 510 {
 511     char *times;
 512     int e;
 513
 514     if (size)
 515         *size = 0;
 516
 517     if (len == SIZE_MAX || len == 0)
 518         return ASN1_BAD_LENGTH;
 519
 520     times = malloc(len + 1);
 521     if (times == NULL)
 522         return ENOMEM;
 523     memcpy(times, p, len);
 524     times[len] = '\0';
 525     e = generalizedtime2time(times, data);
 526     free (times);
 527     if(size) *size = len;
 528     return e;
 529 }
 530
 531 int ASN1CALL
 532 der_get_generalized_time (const unsigned char *p, size_t len,
 533                           time_t *data, size_t *size)
 534 {
 535     return der_get_time(p, len, data, size);
 536 }
 537
 538 int ASN1CALL
 539 der_get_utctime (const unsigned char *p, size_t len,
 540                           time_t *data, size_t *size)
 541 {
 542     return der_get_time(p, len, data, size);
 543 }
 544
 545 int ASN1CALL
 546 der_get_oid (const unsigned char *p, size_t len,
 547              heim_oid *data, size_t *size)
 548 {
 549     size_t n;
 550     size_t oldlen = len;
 551
 552     if (size)
 553         *size = 0;
 554
 555     if (len < 1)
 556         return ASN1_OVERRUN;
 557
 558     if (len == SIZE_MAX)
 559         return ASN1_BAD_LENGTH;
 560
 561     if (len + 1 > UINT_MAX/sizeof(data->components[0]))
 562         return ERANGE;
 563
 564     data->components = malloc((len + 1) * sizeof(data->components[0]));
 565     if (data->components == NULL)
 566         return ENOMEM;
 567     data->components[0] = (*p) / 40;
 568     data->components[1] = (*p) % 40;
 569     --len;
 570     ++p;
 571     for (n = 2; len > 0; ++n) {
 572         unsigned u = 0, u1;
 573
 574         do {
 575             --len;
 576             u1 = u * 128 + (*p++ % 128);
 577             /* check that we don't overflow the element */
 578             if (u1 < u) {
 579                 der_free_oid(data);
 580                 return ASN1_OVERRUN;
 581             }
 582             u = u1;
 583         } while (len > 0 && p[-1] & 0x80);
 584         data->components[n] = u;
 585     }
 586     if (n > 2 && p[-1] & 0x80) {
 587         der_free_oid (data);
 588         return ASN1_OVERRUN;
 589     }
 590     data->length = n;
 591     if (size)
 592         *size = oldlen;
 593     return 0;
 594 }
 595
 596 int ASN1CALL
 597 der_get_tag (const unsigned char *p, size_t len,
 598              Der_class *cls, Der_type *type,
 599              unsigned int *tag, size_t *size)
 600 {
 601     size_t ret = 0;
 602
 603     if (size)
 604         *size = 0;
 605
 606     if (len < 1)
 607         return ASN1_MISSING_FIELD;
 608     *cls = (Der_class)(((*p) >> 6) & 0x03);
 609     *type = (Der_type)(((*p) >> 5) & 0x01);
 610     *tag = (*p) & 0x1f;
 611     p++; len--; ret++;
 612     if(*tag == 0x1f) {
 613         unsigned int continuation;
 614         unsigned int tag1;
 615         *tag = 0;
 616         do {
 617             if(len < 1)
 618                 return ASN1_OVERRUN;
 619             continuation = *p & 128;
 620             tag1 = *tag * 128 + (*p % 128);
 621             /* check that we don't overflow the tag */
 622             if (tag1 < *tag)
 623                 return ASN1_OVERFLOW;
 624             *tag = tag1;
 625             p++; len--; ret++;
 626         } while(continuation);
 627     }
 628     if(size) *size = ret;
 629     return 0;
 630 }
 631
 632 int ASN1CALL
 633 der_match_tag (const unsigned char *p, size_t len,
 634                Der_class cls, Der_type type,
 635                unsigned int tag, size_t *size)
 636 {
 637     Der_type thistype;
 638     int e;
 639
 640     e = der_match_tag2(p, len, cls, &thistype, tag, size);
 641     if (e) return e;
 642     if (thistype != type) return ASN1_BAD_ID;
 643     return 0;
 644 }
 645
 646 int ASN1CALL
 647 der_match_tag2 (const unsigned char *p, size_t len,
 648                 Der_class cls, Der_type *type,
 649                 unsigned int tag, size_t *size)
 650 {
 651     size_t l;
 652     Der_class thisclass;
 653     unsigned int thistag;
 654     int e;
 655
 656     if (size)
 657         *size = 0;
 658
 659     e = der_get_tag(p, len, &thisclass, type, &thistag, &l);
 660     if (e) return e;
 661     /*
 662      * We do depend on ASN1_BAD_ID being returned in places where we're
 663      * essentially implementing an application-level CHOICE where we try to
 664      * decode one way then the other.  In Heimdal this happens only in lib/hdb/
 665      * where we try to decode a blob as an hdb_entry, then as an
 666      * hdb_entry_alias.  Applications should really not depend on this.
 667      */
 668     if (cls != thisclass && (cls == ASN1_C_APPL || thisclass == ASN1_C_APPL))
 669         return ASN1_BAD_ID;
 670     if (cls != thisclass || tag != thistag)
 671         return ASN1_MISSING_FIELD;
 672     if (size) *size = l;
 673     return 0;
 674 }
 675
 676 /*
 677  * Returns 0 if the encoded data at `p' of length `len' starts with the tag of
 678  * class `cls`, type `type', and tag value `tag', and puts the length of the
 679  * payload (i.e., the length of V in TLV, not the length of TLV) in
 680  * `*length_ret', and the size of the whole thing (the TLV) in `*size' if
 681  * `size' is not NULL.
 682  *
 683  * Else returns an error.
 684  */
 685 int ASN1CALL
 686 der_match_tag_and_length (const unsigned char *p, size_t len,
 687                           Der_class cls, Der_type *type, unsigned int tag,
 688                           size_t *length_ret, size_t *size)
 689 {
 690     size_t l, ret = 0;
 691     int e;
 692
 693     e = der_match_tag2 (p, len, cls, type, tag, &l);
 694     if (e) return e;
 695     p += l;
 696     len -= l;
 697     ret += l;
 698     e = der_get_length (p, len, length_ret, &l);
 699     if (e) return e;
 700     if(size) *size = ret + l;
 701     return 0;
 702 }
 703
 704
 705
 706 /*
 707  * Old versions of DCE was based on a very early beta of the MIT code,
 708  * which used MAVROS for ASN.1 encoding. MAVROS had the interesting
 709  * feature that it encoded data in the forward direction, which has
 710  * it's problems, since you have no idea how long the data will be
 711  * until after you're done. MAVROS solved this by reserving one byte
 712  * for length, and later, if the actual length was longer, it reverted
 713  * to indefinite, BER style, lengths. The version of MAVROS used by
 714  * the DCE people could apparently generate correct X.509 DER encodings, and
 715  * did this by making space for the length after encoding, but
 716  * unfortunately this feature wasn't used with Kerberos.
 717  */
 718
 719 int
 720 _heim_fix_dce(size_t reallen, size_t *len)
 721 {
 722     if(reallen == ASN1_INDEFINITE)
 723         return 1;
 724     if(*len < reallen)
 725         return -1;
 726     *len = reallen;
 727     return 0;
 728 }
 729
 730 int ASN1CALL
 731 der_get_bit_string (const unsigned char *p, size_t len,
 732                     heim_bit_string *data, size_t *size)
 733 {
 734     if (size)
 735         *size = 0;
 736
 737     if (len < 1)
 738         return ASN1_OVERRUN;
 739     if (p[0] > 7)
 740         return ASN1_BAD_FORMAT;
 741     if (len - 1 == 0 && p[0] != 0)
 742         return ASN1_BAD_FORMAT;
 743     /* check if any of the three upper bits are set
 744      * any of them will cause a interger overrun */
 745     if ((len - 1) >> (sizeof(len) * 8 - 3))
 746         return ASN1_OVERRUN;
 747     /*
 748      * If there is data to copy, do that now.
 749      */
 750     if (len - 1 > 0) {
 751         data->length = (len - 1) * 8;
 752         data->data = malloc(len - 1);
 753         if (data->data == NULL)
 754             return ENOMEM;
 755         memcpy (data->data, p + 1, len - 1);
 756         data->length -= p[0];
 757     } else {
 758         data->data = NULL;
 759         data->length = 0;
 760     }
 761     if(size) *size = len;
 762     return 0;
 763 }