PR: 2727

[oweals/openssl.git] / crypto / pkcs7 / pk7_doit.c

diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index 001c8b918417f86a9d40ef633e3d9beb6fdbf52d..cb8434b322957b7a33eb52b4fb1a6735d5e179b4 100644 (file)
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -331,7 +331,9 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                keylen=EVP_CIPHER_key_length(evp_cipher);
                ivlen=EVP_CIPHER_iv_length(evp_cipher);
                xalg->algorithm = OBJ_nid2obj(EVP_CIPHER_type(evp_cipher));
-               if (ivlen > 0) RAND_pseudo_bytes(iv,ivlen);
+               if (ivlen > 0)
+                       if (RAND_pseudo_bytes(iv,ivlen) <= 0)
+                               goto err;
                if (EVP_CipherInit_ex(ctx, evp_cipher, NULL, NULL, NULL, 1)<=0)
                        goto err;
                if (EVP_CIPHER_CTX_rand_key(ctx, key) <= 0)
@@ -340,10 +342,13 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                        goto err;
 
                if (ivlen > 0) {
-                       if (xalg->parameter == NULL) 
-                                               xalg->parameter=ASN1_TYPE_new();
+                       if (xalg->parameter == NULL) {
+                               xalg->parameter = ASN1_TYPE_new();
+                               if (xalg->parameter == NULL)
+                                       goto err;
+                       }
                        if(EVP_CIPHER_param_to_asn1(ctx, xalg->parameter) < 0)
-                                                                      goto err;
+                               goto err;
                }
 
                /* Lets do the pub key stuff :-) */
@@ -371,6 +376,8 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                if(bio == NULL)
                        {
                        bio=BIO_new(BIO_s_mem());
+                       if (bio == NULL)
+                               goto err;
                        BIO_set_mem_eof_return(bio,0);
                        }
                }
@@ -415,7 +422,6 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
        X509_ALGOR *enc_alg=NULL;
        STACK_OF(X509_ALGOR) *md_sk=NULL;
        STACK_OF(PKCS7_RECIP_INFO) *rsk=NULL;
-       X509_ALGOR *xalg=NULL;
        PKCS7_RECIP_INFO *ri=NULL;
 
        i=OBJ_obj2nid(p7->type);
@@ -438,7 +444,6 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                        PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CIPHER_TYPE);
                        goto err;
                        }
-               xalg=p7->d.signed_and_enveloped->enc_data->algorithm;
                break;
        case NID_pkcs7_enveloped:
                rsk=p7->d.enveloped->recipientinfo;
@@ -450,7 +455,6 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                        PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CIPHER_TYPE);
                        goto err;
                        }
-               xalg=p7->d.enveloped->enc_data->algorithm;
                break;
        default:
                PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
@@ -613,6 +617,8 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                        bio=BIO_new(BIO_s_mem());
                        BIO_set_mem_eof_return(bio,0);
                }
+               if (bio == NULL)
+                       goto err;
 #endif
                }
        BIO_push(out,bio);
@@ -670,7 +676,11 @@ static int do_pkcs7_signed_attrib(PKCS7_SIGNER_INFO *si, EVP_MD_CTX *mctx)
                }
 
        /* Add digest */
-       EVP_DigestFinal_ex(mctx, md_data,&md_len);
+       if (!EVP_DigestFinal_ex(mctx, md_data,&md_len))
+               {
+               PKCS7err(PKCS7_F_DO_PKCS7_SIGNED_ATTRIB, ERR_R_EVP_LIB);
+               return 0;
+               }
        if (!PKCS7_add1_attrib_digest(si, md_data, md_len))
                {
                PKCS7err(PKCS7_F_DO_PKCS7_SIGNED_ATTRIB, ERR_R_MALLOC_FAILURE);
@@ -754,6 +764,9 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                        }
                break;
 
+       default:
+               PKCS7err(PKCS7_F_PKCS7_DATAFINAL,PKCS7_R_UNSUPPORTED_CONTENT_TYPE);
+               goto err;
                }
 
        if (si_sk != NULL)
@@ -775,7 +788,8 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
 
                        /* We now have the EVP_MD_CTX, lets do the
                         * signing. */
-                       EVP_MD_CTX_copy_ex(&ctx_tmp,mdc);
+                       if (!EVP_MD_CTX_copy_ex(&ctx_tmp,mdc))
+                               goto err;
 
                        sk=si->auth_attr;
 
@@ -813,7 +827,8 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                if (!PKCS7_find_digest(&mdc, bio,
                                OBJ_obj2nid(p7->d.digest->md->algorithm)))
                        goto err;
-               EVP_DigestFinal_ex(mdc,md_data,&md_len);
+               if (!EVP_DigestFinal_ex(mdc,md_data,&md_len))
+                       goto err;
                M_ASN1_OCTET_STRING_set(p7->d.digest->digest, md_data, md_len);
                }
 
@@ -1006,16 +1021,19 @@ int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
 
        /* mdc is the digest ctx that we want, unless there are attributes,
         * in which case the digest is the signed attributes */
-       EVP_MD_CTX_copy_ex(&mdc_tmp,mdc);
+       if (!EVP_MD_CTX_copy_ex(&mdc_tmp,mdc))
+               goto err;
 
        sk=si->auth_attr;
        if ((sk != NULL) && (sk_X509_ATTRIBUTE_num(sk) != 0))
                {
                unsigned char md_dat[EVP_MAX_MD_SIZE], *abuf = NULL;
-                unsigned int md_len, alen;
+                unsigned int md_len;
+               int alen;
                ASN1_OCTET_STRING *message_digest;
 
-               EVP_DigestFinal_ex(&mdc_tmp,md_dat,&md_len);
+               if (!EVP_DigestFinal_ex(&mdc_tmp,md_dat,&md_len))
+                       goto err;
                message_digest=PKCS7_digest_from_attributes(sk);
                if (!message_digest)
                        {
@@ -1040,11 +1058,19 @@ for (ii=0; ii<md_len; ii++) printf("%02X",md_dat[ii]); printf(" calc\n");
                        goto err;
                        }
 
-               EVP_VerifyInit_ex(&mdc_tmp,EVP_get_digestbynid(md_type), NULL);
+               if (!EVP_VerifyInit_ex(&mdc_tmp,EVP_get_digestbynid(md_type), NULL))
+                       goto err;
 
                alen = ASN1_item_i2d((ASN1_VALUE *)sk, &abuf,
                                                ASN1_ITEM_rptr(PKCS7_ATTR_VERIFY));
-               EVP_VerifyUpdate(&mdc_tmp, abuf, alen);
+               if (alen <= 0) 
+                       {
+                       PKCS7err(PKCS7_F_PKCS7_SIGNATUREVERIFY,ERR_R_ASN1_LIB);
+                       ret = -1;
+                       goto err;
+                       }
+               if (!EVP_VerifyUpdate(&mdc_tmp, abuf, alen))
+                       goto err;
 
                OPENSSL_free(abuf);
                }
@@ -1080,8 +1106,13 @@ PKCS7_ISSUER_AND_SERIAL *PKCS7_get_issuer_and_serial(PKCS7 *p7, int idx)
        int i;
 
        i=OBJ_obj2nid(p7->type);
-       if (i != NID_pkcs7_signedAndEnveloped) return(NULL);
+       if (i != NID_pkcs7_signedAndEnveloped)
+               return NULL;
+       if (p7->d.signed_and_enveloped == NULL)
+               return NULL;
        rsk=p7->d.signed_and_enveloped->recipientinfo;
+       if (rsk == NULL)
+               return NULL;
        ri=sk_PKCS7_RECIP_INFO_value(rsk,0);
        if (sk_PKCS7_RECIP_INFO_num(rsk) <= idx) return(NULL);
        ri=sk_PKCS7_RECIP_INFO_value(rsk,idx);
@@ -1135,6 +1166,8 @@ int PKCS7_set_signed_attributes(PKCS7_SIGNER_INFO *p7si,
        if (p7si->auth_attr != NULL)
                sk_X509_ATTRIBUTE_pop_free(p7si->auth_attr,X509_ATTRIBUTE_free);
        p7si->auth_attr=sk_X509_ATTRIBUTE_dup(sk);
+       if (p7si->auth_attr == NULL)
+               return 0;
        for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++)
                {
                if ((sk_X509_ATTRIBUTE_set(p7si->auth_attr,i,
@@ -1153,6 +1186,8 @@ int PKCS7_set_attributes(PKCS7_SIGNER_INFO *p7si, STACK_OF(X509_ATTRIBUTE) *sk)
                sk_X509_ATTRIBUTE_pop_free(p7si->unauth_attr,
                                           X509_ATTRIBUTE_free);
        p7si->unauth_attr=sk_X509_ATTRIBUTE_dup(sk);
+       if (p7si->unauth_attr == NULL)
+               return 0;
        for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++)
                {
                if ((sk_X509_ATTRIBUTE_set(p7si->unauth_attr,i,
@@ -1183,9 +1218,16 @@ static int add_attribute(STACK_OF(X509_ATTRIBUTE) **sk, int nid, int atrtype,
        if (*sk == NULL)
                {
                *sk = sk_X509_ATTRIBUTE_new_null();
+               if (*sk == NULL)
+                       return 0;       
 new_attrib:
-               attr=X509_ATTRIBUTE_create(nid,atrtype,value);
-               sk_X509_ATTRIBUTE_push(*sk,attr);
+               if (!(attr=X509_ATTRIBUTE_create(nid,atrtype,value)))
+                       return 0;
+               if (!sk_X509_ATTRIBUTE_push(*sk,attr))
+                       {
+                       X509_ATTRIBUTE_free(attr);
+                       return 0;
+                       }
                }
        else
                {
@@ -1198,7 +1240,13 @@ new_attrib:
                                {
                                X509_ATTRIBUTE_free(attr);
                                attr=X509_ATTRIBUTE_create(nid,atrtype,value);
-                               sk_X509_ATTRIBUTE_set(*sk,i,attr);
+                               if (attr == NULL)
+                                       return 0;
+                               if (!sk_X509_ATTRIBUTE_set(*sk,i,attr))
+                                       {
+                                       X509_ATTRIBUTE_free(attr);
+                                       return 0;
+                                       }
                                goto end;
                                }
                        }