#include <openssl/objects.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
+#include <openssl/err.h>
static int add_attribute(STACK_OF(X509_ATTRIBUTE) **sk, int nid, int atrtype,
void *value);
keylen=EVP_CIPHER_key_length(evp_cipher);
ivlen=EVP_CIPHER_iv_length(evp_cipher);
xalg->algorithm = OBJ_nid2obj(EVP_CIPHER_type(evp_cipher));
- if (ivlen > 0) RAND_pseudo_bytes(iv,ivlen);
+ if (ivlen > 0)
+ if (RAND_pseudo_bytes(iv,ivlen) <= 0)
+ goto err;
if (EVP_CipherInit_ex(ctx, evp_cipher, NULL, NULL, NULL, 1)<=0)
goto err;
if (EVP_CIPHER_CTX_rand_key(ctx, key) <= 0)
goto err;
if (ivlen > 0) {
- if (xalg->parameter == NULL)
- xalg->parameter=ASN1_TYPE_new();
+ if (xalg->parameter == NULL) {
+ xalg->parameter = ASN1_TYPE_new();
+ if (xalg->parameter == NULL)
+ goto err;
+ }
if(EVP_CIPHER_param_to_asn1(ctx, xalg->parameter) < 0)
- goto err;
+ goto err;
}
/* Lets do the pub key stuff :-) */
PKCS7err(PKCS7_F_PKCS7_DATAINIT,PKCS7_R_MISSING_CERIPEND_INFO);
goto err;
}
- pkey=X509_get_pubkey(ri->cert);
+ if ((pkey=X509_get_pubkey(ri->cert)) == NULL)
+ goto err;
jj=EVP_PKEY_size(pkey);
EVP_PKEY_free(pkey);
if (max < jj) max=jj;
for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++)
{
ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
- pkey=X509_get_pubkey(ri->cert);
+ if ((pkey=X509_get_pubkey(ri->cert)) == NULL)
+ goto err;
jj=EVP_PKEY_encrypt(tmp,key,keylen,pkey);
EVP_PKEY_free(pkey);
if (jj <= 0)
OPENSSL_free(tmp);
goto err;
}
- M_ASN1_OCTET_STRING_set(ri->enc_key,tmp,jj);
+ if (!M_ASN1_OCTET_STRING_set(ri->enc_key,tmp,jj))
+ {
+ PKCS7err(PKCS7_F_PKCS7_DATAINIT,
+ ERR_R_MALLOC_FAILURE);
+ OPENSSL_free(tmp);
+ goto err;
+ }
}
OPENSSL_free(tmp);
OPENSSL_cleanse(key, keylen);
if(bio == NULL)
{
bio=BIO_new(BIO_s_mem());
+ if (bio == NULL)
+ goto err;
BIO_set_mem_eof_return(bio,0);
}
}
return(out);
}
+static int pkcs7_cmp_ri(PKCS7_RECIP_INFO *ri, X509 *pcert)
+ {
+ int ret;
+ ret = X509_NAME_cmp(ri->issuer_and_serial->issuer,
+ pcert->cert_info->issuer);
+ if (ret)
+ return ret;
+ return M_ASN1_INTEGER_cmp(pcert->cert_info->serialNumber,
+ ri->issuer_and_serial->serial);
+ }
+
/* int */
BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
{
X509_ALGOR *enc_alg=NULL;
STACK_OF(X509_ALGOR) *md_sk=NULL;
STACK_OF(PKCS7_RECIP_INFO) *rsk=NULL;
- X509_ALGOR *xalg=NULL;
PKCS7_RECIP_INFO *ri=NULL;
i=OBJ_obj2nid(p7->type);
PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CIPHER_TYPE);
goto err;
}
- xalg=p7->d.signed_and_enveloped->enc_data->algorithm;
break;
case NID_pkcs7_enveloped:
rsk=p7->d.enveloped->recipientinfo;
PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CIPHER_TYPE);
goto err;
}
- xalg=p7->d.enveloped->enc_data->algorithm;
break;
default:
PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
* (if any)
*/
- for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++) {
- ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
- if(!X509_NAME_cmp(ri->issuer_and_serial->issuer,
- pcert->cert_info->issuer) &&
- !M_ASN1_INTEGER_cmp(pcert->cert_info->serialNumber,
- ri->issuer_and_serial->serial)) break;
- ri=NULL;
- }
- if (ri == NULL) {
- PKCS7err(PKCS7_F_PKCS7_DATADECODE,
- PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE);
- goto err;
+ if (pcert) {
+ for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++) {
+ ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
+ if (!pkcs7_cmp_ri(ri, pcert))
+ break;
+ ri=NULL;
+ }
+ if (ri == NULL) {
+ PKCS7err(PKCS7_F_PKCS7_DATADECODE,
+ PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE);
+ goto err;
+ }
}
jj=EVP_PKEY_size(pkey);
goto err;
}
- jj=EVP_PKEY_decrypt(tmp, M_ASN1_STRING_data(ri->enc_key),
- M_ASN1_STRING_length(ri->enc_key), pkey);
- if (jj <= 0)
+ /* If we haven't got a certificate try each ri in turn */
+
+ if (pcert == NULL)
{
- PKCS7err(PKCS7_F_PKCS7_DATADECODE,ERR_R_EVP_LIB);
- goto err;
+ for (i=0; i<sk_PKCS7_RECIP_INFO_num(rsk); i++)
+ {
+ ri=sk_PKCS7_RECIP_INFO_value(rsk,i);
+ jj=EVP_PKEY_decrypt(tmp,
+ M_ASN1_STRING_data(ri->enc_key),
+ M_ASN1_STRING_length(ri->enc_key),
+ pkey);
+ if (jj > 0)
+ break;
+ ERR_clear_error();
+ ri = NULL;
+ }
+ if (ri == NULL)
+ {
+ PKCS7err(PKCS7_F_PKCS7_DATADECODE,
+ PKCS7_R_NO_RECIPIENT_MATCHES_KEY);
+ goto err;
+ }
+ }
+ else
+ {
+ jj=EVP_PKEY_decrypt(tmp,
+ M_ASN1_STRING_data(ri->enc_key),
+ M_ASN1_STRING_length(ri->enc_key), pkey);
+ if (jj <= 0)
+ {
+ PKCS7err(PKCS7_F_PKCS7_DATADECODE,
+ ERR_R_EVP_LIB);
+ goto err;
+ }
}
evp_ctx=NULL;
bio=BIO_new(BIO_s_mem());
BIO_set_mem_eof_return(bio,0);
}
+ if (bio == NULL)
+ goto err;
#endif
}
BIO_push(out,bio);
bio=BIO_find_type(bio,BIO_TYPE_MD);
if (bio == NULL)
{
- PKCS7err(PKCS7_F_FIND_DIGEST,PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST);
+ PKCS7err(PKCS7_F_PKCS7_FIND_DIGEST,PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST);
return NULL;
}
BIO_get_md_ctx(bio,pmd);
if (*pmd == NULL)
{
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_INTERNAL_ERROR);
+ PKCS7err(PKCS7_F_PKCS7_FIND_DIGEST,ERR_R_INTERNAL_ERROR);
return NULL;
}
if (EVP_MD_CTX_type(*pmd) == nid)
case NID_pkcs7_signedAndEnveloped:
/* XXXXXXXXXXXXXXXX */
si_sk=p7->d.signed_and_enveloped->signer_info;
- os=M_ASN1_OCTET_STRING_new();
+ if (!(os=M_ASN1_OCTET_STRING_new()))
+ {
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
p7->d.signed_and_enveloped->enc_data->enc_data=os;
break;
case NID_pkcs7_enveloped:
/* XXXXXXXXXXXXXXXX */
- os=M_ASN1_OCTET_STRING_new();
+ if (!(os=M_ASN1_OCTET_STRING_new()))
+ {
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
p7->d.enveloped->enc_data->enc_data=os;
break;
case NID_pkcs7_signed:
{
if ((buf=BUF_MEM_new()) == NULL)
{
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_BIO_LIB);
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_BIO_LIB);
goto err;
}
for (i=0; i<sk_PKCS7_SIGNER_INFO_num(si_sk); i++)
EVP_MD_CTX_copy_ex(&ctx_tmp,mdc);
if (!BUF_MEM_grow_clean(buf,EVP_PKEY_size(si->pkey)))
{
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_BIO_LIB);
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_BIO_LIB);
goto err;
}
if (!PKCS7_get_signed_attribute(si,
NID_pkcs9_signingTime))
{
- sign_time=X509_gmtime_adj(NULL,0);
- PKCS7_add_signed_attribute(si,
+ if (!(sign_time=X509_gmtime_adj(NULL,0)))
+ {
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL,
+ ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+ if (!PKCS7_add_signed_attribute(si,
NID_pkcs9_signingTime,
- V_ASN1_UTCTIME,sign_time);
+ V_ASN1_UTCTIME,sign_time))
+ {
+ M_ASN1_UTCTIME_free(sign_time);
+ goto err;
+ }
}
/* Add digest */
md_tmp=EVP_MD_CTX_md(&ctx_tmp);
EVP_DigestFinal_ex(&ctx_tmp,md_data,&md_len);
- digest=M_ASN1_OCTET_STRING_new();
- M_ASN1_OCTET_STRING_set(digest,md_data,md_len);
- PKCS7_add_signed_attribute(si,
+ if (!(digest=M_ASN1_OCTET_STRING_new()))
+ {
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL,
+ ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+ if (!M_ASN1_OCTET_STRING_set(digest,md_data,
+ md_len))
+ {
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL,
+ ERR_R_MALLOC_FAILURE);
+ M_ASN1_OCTET_STRING_free(digest);
+ goto err;
+ }
+ if (!PKCS7_add_signed_attribute(si,
NID_pkcs9_messageDigest,
- V_ASN1_OCTET_STRING,digest);
+ V_ASN1_OCTET_STRING,digest))
+ {
+ M_ASN1_OCTET_STRING_free(digest);
+ goto err;
+ }
/* Now sign the attributes */
EVP_SignInit_ex(&ctx_tmp,md_tmp,NULL);
if (!EVP_SignFinal(&ctx_tmp,(unsigned char *)buf->data,
(unsigned int *)&buf->length,si->pkey))
{
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_EVP_LIB);
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_EVP_LIB);
goto err;
}
if (!ASN1_STRING_set(si->enc_digest,
(unsigned char *)buf->data,buf->length))
{
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,ERR_R_ASN1_LIB);
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL,ERR_R_ASN1_LIB);
goto err;
}
}
btmp=BIO_find_type(bio,BIO_TYPE_MEM);
if (btmp == NULL)
{
- PKCS7err(PKCS7_F_PKCS7_DATASIGN,PKCS7_R_UNABLE_TO_FIND_MEM_BIO);
+ PKCS7err(PKCS7_F_PKCS7_DATAFINAL,PKCS7_R_UNABLE_TO_FIND_MEM_BIO);
goto err;
}
BIO_get_mem_ptr(btmp,&buf_mem);
int i;
i=OBJ_obj2nid(p7->type);
- if (i != NID_pkcs7_signedAndEnveloped) return(NULL);
+ if (i != NID_pkcs7_signedAndEnveloped)
+ return NULL;
+ if (p7->d.signed_and_enveloped == NULL)
+ return NULL;
rsk=p7->d.signed_and_enveloped->recipientinfo;
+ if (rsk == NULL)
+ return NULL;
ri=sk_PKCS7_RECIP_INFO_value(rsk,0);
if (sk_PKCS7_RECIP_INFO_num(rsk) <= idx) return(NULL);
ri=sk_PKCS7_RECIP_INFO_value(rsk,idx);
if (p7si->auth_attr != NULL)
sk_X509_ATTRIBUTE_pop_free(p7si->auth_attr,X509_ATTRIBUTE_free);
p7si->auth_attr=sk_X509_ATTRIBUTE_dup(sk);
+ if (p7si->auth_attr == NULL)
+ return 0;
for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++)
{
if ((sk_X509_ATTRIBUTE_set(p7si->auth_attr,i,
sk_X509_ATTRIBUTE_pop_free(p7si->unauth_attr,
X509_ATTRIBUTE_free);
p7si->unauth_attr=sk_X509_ATTRIBUTE_dup(sk);
+ if (p7si->unauth_attr == NULL)
+ return 0;
for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++)
{
if ((sk_X509_ATTRIBUTE_set(p7si->unauth_attr,i,
if (*sk == NULL)
{
- *sk = sk_X509_ATTRIBUTE_new_null();
+ if (!(*sk = sk_X509_ATTRIBUTE_new_null()))
+ return 0;
new_attrib:
- attr=X509_ATTRIBUTE_create(nid,atrtype,value);
- sk_X509_ATTRIBUTE_push(*sk,attr);
+ if (!(attr=X509_ATTRIBUTE_create(nid,atrtype,value)))
+ return 0;
+ if (!sk_X509_ATTRIBUTE_push(*sk,attr))
+ {
+ X509_ATTRIBUTE_free(attr);
+ return 0;
+ }
}
else
{
{
X509_ATTRIBUTE_free(attr);
attr=X509_ATTRIBUTE_create(nid,atrtype,value);
- sk_X509_ATTRIBUTE_set(*sk,i,attr);
+ if (attr == NULL)
+ return 0;
+ if (!sk_X509_ATTRIBUTE_set(*sk,i,attr))
+ {
+ X509_ATTRIBUTE_free(attr);
+ return 0;
+ }
goto end;
}
}
projects / oweals / openssl.git / blobdiff