Fix multiple OpenSSL vulnerabilities.
Approved by: so Security: SA-21:16.openssl Security: CVE-2021-3711 Security: CVE-2021-3712
This commit is contained in:
parent
64ae2f785e
commit
aef815e787
@ -292,7 +292,12 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len_in)
|
||||
}
|
||||
if ((size_t)str->length <= len || str->data == NULL) {
|
||||
c = str->data;
|
||||
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
|
||||
/* No NUL terminator in fuzzing builds */
|
||||
str->data = OPENSSL_realloc(c, len);
|
||||
#else
|
||||
str->data = OPENSSL_realloc(c, len + 1);
|
||||
#endif
|
||||
if (str->data == NULL) {
|
||||
ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
|
||||
str->data = c;
|
||||
@ -302,8 +307,13 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len_in)
|
||||
str->length = len;
|
||||
if (data != NULL) {
|
||||
memcpy(str->data, data, len);
|
||||
/* an allowance for strings :-) */
|
||||
#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
|
||||
/*
|
||||
* Add a NUL terminator. This should not be necessary - but we add it as
|
||||
* a safety precaution
|
||||
*/
|
||||
str->data[len] = '\0';
|
||||
#endif
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
@ -38,7 +38,7 @@ int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
|
||||
}
|
||||
chal = spki->spkac->challenge;
|
||||
if (chal->length)
|
||||
BIO_printf(out, " Challenge String: %s\n", chal->data);
|
||||
BIO_printf(out, " Challenge String: %.*s\n", chal->length, chal->data);
|
||||
i = OBJ_obj2nid(spki->sig_algor.algorithm);
|
||||
BIO_printf(out, " Signature Algorithm: %s",
|
||||
(i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
|
||||
|
@ -761,7 +761,10 @@ EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params)
|
||||
ret->seed_len = params->curve->seed->length;
|
||||
}
|
||||
|
||||
if (!params->order || !params->base || !params->base->data) {
|
||||
if (params->order == NULL
|
||||
|| params->base == NULL
|
||||
|| params->base->data == NULL
|
||||
|| params->base->length == 0) {
|
||||
ECerr(EC_F_EC_GROUP_NEW_FROM_ECPARAMETERS, EC_R_ASN1_ERROR);
|
||||
goto err;
|
||||
}
|
||||
|
@ -61,29 +61,20 @@ static size_t ec_field_size(const EC_GROUP *group)
|
||||
return field_size;
|
||||
}
|
||||
|
||||
int sm2_plaintext_size(const EC_KEY *key, const EVP_MD *digest, size_t msg_len,
|
||||
size_t *pt_size)
|
||||
int sm2_plaintext_size(const unsigned char *ct, size_t ct_size, size_t *pt_size)
|
||||
{
|
||||
const size_t field_size = ec_field_size(EC_KEY_get0_group(key));
|
||||
const int md_size = EVP_MD_size(digest);
|
||||
size_t overhead;
|
||||
struct SM2_Ciphertext_st *sm2_ctext = NULL;
|
||||
|
||||
if (md_size < 0) {
|
||||
SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_DIGEST);
|
||||
return 0;
|
||||
}
|
||||
if (field_size == 0) {
|
||||
SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_FIELD);
|
||||
return 0;
|
||||
}
|
||||
sm2_ctext = d2i_SM2_Ciphertext(NULL, &ct, ct_size);
|
||||
|
||||
overhead = 10 + 2 * field_size + (size_t)md_size;
|
||||
if (msg_len <= overhead) {
|
||||
if (sm2_ctext == NULL) {
|
||||
SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_ENCODING);
|
||||
return 0;
|
||||
}
|
||||
|
||||
*pt_size = msg_len - overhead;
|
||||
*pt_size = sm2_ctext->C2->length;
|
||||
SM2_Ciphertext_free(sm2_ctext);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
@ -303,6 +294,10 @@ int sm2_decrypt(const EC_KEY *key,
|
||||
C2 = sm2_ctext->C2->data;
|
||||
C3 = sm2_ctext->C3->data;
|
||||
msg_len = sm2_ctext->C2->length;
|
||||
if (*ptext_len < (size_t)msg_len) {
|
||||
SM2err(SM2_F_SM2_DECRYPT, SM2_R_BUFFER_TOO_SMALL);
|
||||
goto done;
|
||||
}
|
||||
|
||||
ctx = BN_CTX_new();
|
||||
if (ctx == NULL) {
|
||||
|
@ -151,7 +151,7 @@ static int pkey_sm2_decrypt(EVP_PKEY_CTX *ctx,
|
||||
const EVP_MD *md = (dctx->md == NULL) ? EVP_sm3() : dctx->md;
|
||||
|
||||
if (out == NULL) {
|
||||
if (!sm2_plaintext_size(ec, md, inlen, outlen))
|
||||
if (!sm2_plaintext_size(in, inlen, outlen))
|
||||
return -1;
|
||||
else
|
||||
return 1;
|
||||
|
@ -39,20 +39,48 @@ static STACK_OF(CONF_VALUE) *i2v_AUTHORITY_KEYID(X509V3_EXT_METHOD *method,
|
||||
STACK_OF(CONF_VALUE)
|
||||
*extlist)
|
||||
{
|
||||
char *tmp;
|
||||
char *tmp = NULL;
|
||||
STACK_OF(CONF_VALUE) *origextlist = extlist, *tmpextlist;
|
||||
|
||||
if (akeyid->keyid) {
|
||||
tmp = OPENSSL_buf2hexstr(akeyid->keyid->data, akeyid->keyid->length);
|
||||
X509V3_add_value("keyid", tmp, &extlist);
|
||||
if (tmp == NULL) {
|
||||
X509V3err(X509V3_F_V2I_AUTHORITY_KEYID, ERR_R_MALLOC_FAILURE);
|
||||
return NULL;
|
||||
}
|
||||
if (!X509V3_add_value("keyid", tmp, &extlist)) {
|
||||
OPENSSL_free(tmp);
|
||||
X509V3err(X509V3_F_V2I_AUTHORITY_KEYID, ERR_R_X509_LIB);
|
||||
goto err;
|
||||
}
|
||||
OPENSSL_free(tmp);
|
||||
}
|
||||
if (akeyid->issuer)
|
||||
extlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer, extlist);
|
||||
if (akeyid->issuer) {
|
||||
tmpextlist = i2v_GENERAL_NAMES(NULL, akeyid->issuer, extlist);
|
||||
if (tmpextlist == NULL) {
|
||||
X509V3err(X509V3_F_V2I_AUTHORITY_KEYID, ERR_R_X509_LIB);
|
||||
goto err;
|
||||
}
|
||||
extlist = tmpextlist;
|
||||
}
|
||||
if (akeyid->serial) {
|
||||
tmp = OPENSSL_buf2hexstr(akeyid->serial->data, akeyid->serial->length);
|
||||
X509V3_add_value("serial", tmp, &extlist);
|
||||
if (tmp == NULL) {
|
||||
X509V3err(X509V3_F_V2I_AUTHORITY_KEYID, ERR_R_MALLOC_FAILURE);
|
||||
goto err;
|
||||
}
|
||||
if (!X509V3_add_value("serial", tmp, &extlist)) {
|
||||
OPENSSL_free(tmp);
|
||||
X509V3err(X509V3_F_V2I_AUTHORITY_KEYID, ERR_R_X509_LIB);
|
||||
goto err;
|
||||
}
|
||||
OPENSSL_free(tmp);
|
||||
}
|
||||
return extlist;
|
||||
err:
|
||||
if (origextlist == NULL)
|
||||
sk_CONF_VALUE_pop_free(extlist, X509V3_conf_free);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/*-
|
||||
|
@ -9,6 +9,7 @@
|
||||
|
||||
#include <stdio.h>
|
||||
#include "internal/cryptlib.h"
|
||||
#include "crypto/x509.h"
|
||||
#include <openssl/conf.h>
|
||||
#include <openssl/x509v3.h>
|
||||
#include "ext_dat.h"
|
||||
@ -99,17 +100,20 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
|
||||
break;
|
||||
|
||||
case GEN_EMAIL:
|
||||
if (!X509V3_add_value_uchar("email", gen->d.ia5->data, &ret))
|
||||
if (!x509v3_add_len_value_uchar("email", gen->d.ia5->data,
|
||||
gen->d.ia5->length, &ret))
|
||||
return NULL;
|
||||
break;
|
||||
|
||||
case GEN_DNS:
|
||||
if (!X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret))
|
||||
if (!x509v3_add_len_value_uchar("DNS", gen->d.ia5->data,
|
||||
gen->d.ia5->length, &ret))
|
||||
return NULL;
|
||||
break;
|
||||
|
||||
case GEN_URI:
|
||||
if (!X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret))
|
||||
if (!x509v3_add_len_value_uchar("URI", gen->d.ia5->data,
|
||||
gen->d.ia5->length, &ret))
|
||||
return NULL;
|
||||
break;
|
||||
|
||||
|
@ -422,7 +422,8 @@ static void print_qualifiers(BIO *out, STACK_OF(POLICYQUALINFO) *quals,
|
||||
qualinfo = sk_POLICYQUALINFO_value(quals, i);
|
||||
switch (OBJ_obj2nid(qualinfo->pqualid)) {
|
||||
case NID_id_qt_cps:
|
||||
BIO_printf(out, "%*sCPS: %s\n", indent, "",
|
||||
BIO_printf(out, "%*sCPS: %.*s\n", indent, "",
|
||||
qualinfo->d.cpsuri->length,
|
||||
qualinfo->d.cpsuri->data);
|
||||
break;
|
||||
|
||||
@ -447,7 +448,8 @@ static void print_notice(BIO *out, USERNOTICE *notice, int indent)
|
||||
if (notice->noticeref) {
|
||||
NOTICEREF *ref;
|
||||
ref = notice->noticeref;
|
||||
BIO_printf(out, "%*sOrganization: %s\n", indent, "",
|
||||
BIO_printf(out, "%*sOrganization: %.*s\n", indent, "",
|
||||
ref->organization->length,
|
||||
ref->organization->data);
|
||||
BIO_printf(out, "%*sNumber%s: ", indent, "",
|
||||
sk_ASN1_INTEGER_num(ref->noticenos) > 1 ? "s" : "");
|
||||
@ -470,7 +472,8 @@ static void print_notice(BIO *out, USERNOTICE *notice, int indent)
|
||||
BIO_puts(out, "\n");
|
||||
}
|
||||
if (notice->exptext)
|
||||
BIO_printf(out, "%*sExplicit Text: %s\n", indent, "",
|
||||
BIO_printf(out, "%*sExplicit Text: %.*s\n", indent, "",
|
||||
notice->exptext->length,
|
||||
notice->exptext->data);
|
||||
}
|
||||
|
||||
|
@ -63,8 +63,31 @@ ASN1_SEQUENCE(NAME_CONSTRAINTS) = {
|
||||
IMPLEMENT_ASN1_ALLOC_FUNCTIONS(GENERAL_SUBTREE)
|
||||
IMPLEMENT_ASN1_ALLOC_FUNCTIONS(NAME_CONSTRAINTS)
|
||||
|
||||
|
||||
#define IA5_OFFSET_LEN(ia5base, offset) \
|
||||
((ia5base)->length - ((unsigned char *)(offset) - (ia5base)->data))
|
||||
|
||||
/* Like memchr but for ASN1_IA5STRING. Additionally you can specify the
|
||||
* starting point to search from
|
||||
*/
|
||||
# define ia5memchr(str, start, c) memchr(start, c, IA5_OFFSET_LEN(str, start))
|
||||
|
||||
/* Like memrrchr but for ASN1_IA5STRING */
|
||||
static char *ia5memrchr(ASN1_IA5STRING *str, int c)
|
||||
{
|
||||
int i;
|
||||
|
||||
for (i = str->length; i > 0 && str->data[i - 1] != c; i--);
|
||||
|
||||
if (i == 0)
|
||||
return NULL;
|
||||
|
||||
return (char *)&str->data[i - 1];
|
||||
}
|
||||
|
||||
/*
|
||||
* We cannot use strncasecmp here because that applies locale specific rules.
|
||||
* We cannot use strncasecmp here because that applies locale specific rules. It
|
||||
* also doesn't work with ASN1_STRINGs that may have embedded NUL characters.
|
||||
* For example in Turkish 'I' is not the uppercase character for 'i'. We need to
|
||||
* do a simple ASCII case comparison ignoring the locale (that is why we use
|
||||
* numeric constants below).
|
||||
@ -89,20 +112,12 @@ static int ia5ncasecmp(const char *s1, const char *s2, size_t n)
|
||||
|
||||
/* c1 > c2 */
|
||||
return 1;
|
||||
} else if (*s1 == 0) {
|
||||
/* If we get here we know that *s2 == 0 too */
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int ia5casecmp(const char *s1, const char *s2)
|
||||
{
|
||||
return ia5ncasecmp(s1, s2, SIZE_MAX);
|
||||
}
|
||||
|
||||
static void *v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method,
|
||||
X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
|
||||
{
|
||||
@ -337,7 +352,7 @@ static int cn2dnsid(ASN1_STRING *cn, unsigned char **dnsid, size_t *idlen)
|
||||
--utf8_length;
|
||||
|
||||
/* Reject *embedded* NULs */
|
||||
if ((size_t)utf8_length != strlen((char *)utf8_value)) {
|
||||
if (memchr(utf8_value, 0, utf8_length) != NULL) {
|
||||
OPENSSL_free(utf8_value);
|
||||
return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
|
||||
}
|
||||
@ -536,9 +551,14 @@ static int nc_dns(ASN1_IA5STRING *dns, ASN1_IA5STRING *base)
|
||||
{
|
||||
char *baseptr = (char *)base->data;
|
||||
char *dnsptr = (char *)dns->data;
|
||||
|
||||
/* Empty matches everything */
|
||||
if (!*baseptr)
|
||||
if (base->length == 0)
|
||||
return X509_V_OK;
|
||||
|
||||
if (dns->length < base->length)
|
||||
return X509_V_ERR_PERMITTED_VIOLATION;
|
||||
|
||||
/*
|
||||
* Otherwise can add zero or more components on the left so compare RHS
|
||||
* and if dns is longer and expect '.' as preceding character.
|
||||
@ -549,7 +569,7 @@ static int nc_dns(ASN1_IA5STRING *dns, ASN1_IA5STRING *base)
|
||||
return X509_V_ERR_PERMITTED_VIOLATION;
|
||||
}
|
||||
|
||||
if (ia5casecmp(baseptr, dnsptr))
|
||||
if (ia5ncasecmp(baseptr, dnsptr, base->length))
|
||||
return X509_V_ERR_PERMITTED_VIOLATION;
|
||||
|
||||
return X509_V_OK;
|
||||
@ -560,16 +580,17 @@ static int nc_email(ASN1_IA5STRING *eml, ASN1_IA5STRING *base)
|
||||
{
|
||||
const char *baseptr = (char *)base->data;
|
||||
const char *emlptr = (char *)eml->data;
|
||||
const char *baseat = ia5memrchr(base, '@');
|
||||
const char *emlat = ia5memrchr(eml, '@');
|
||||
size_t basehostlen, emlhostlen;
|
||||
|
||||
const char *baseat = strchr(baseptr, '@');
|
||||
const char *emlat = strchr(emlptr, '@');
|
||||
if (!emlat)
|
||||
return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
|
||||
/* Special case: initial '.' is RHS match */
|
||||
if (!baseat && (*baseptr == '.')) {
|
||||
if (!baseat && base->length > 0 && (*baseptr == '.')) {
|
||||
if (eml->length > base->length) {
|
||||
emlptr += eml->length - base->length;
|
||||
if (ia5casecmp(baseptr, emlptr) == 0)
|
||||
if (ia5ncasecmp(baseptr, emlptr, base->length) == 0)
|
||||
return X509_V_OK;
|
||||
}
|
||||
return X509_V_ERR_PERMITTED_VIOLATION;
|
||||
@ -589,8 +610,10 @@ static int nc_email(ASN1_IA5STRING *eml, ASN1_IA5STRING *base)
|
||||
baseptr = baseat + 1;
|
||||
}
|
||||
emlptr = emlat + 1;
|
||||
basehostlen = IA5_OFFSET_LEN(base, baseptr);
|
||||
emlhostlen = IA5_OFFSET_LEN(eml, emlptr);
|
||||
/* Just have hostname left to match: case insensitive */
|
||||
if (ia5casecmp(baseptr, emlptr))
|
||||
if (basehostlen != emlhostlen || ia5ncasecmp(baseptr, emlptr, emlhostlen))
|
||||
return X509_V_ERR_PERMITTED_VIOLATION;
|
||||
|
||||
return X509_V_OK;
|
||||
@ -601,10 +624,14 @@ static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base)
|
||||
{
|
||||
const char *baseptr = (char *)base->data;
|
||||
const char *hostptr = (char *)uri->data;
|
||||
const char *p = strchr(hostptr, ':');
|
||||
const char *p = ia5memchr(uri, (char *)uri->data, ':');
|
||||
int hostlen;
|
||||
|
||||
/* Check for foo:// and skip past it */
|
||||
if (!p || (p[1] != '/') || (p[2] != '/'))
|
||||
if (p == NULL
|
||||
|| IA5_OFFSET_LEN(uri, p) < 3
|
||||
|| p[1] != '/'
|
||||
|| p[2] != '/')
|
||||
return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
|
||||
hostptr = p + 3;
|
||||
|
||||
@ -612,13 +639,13 @@ static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base)
|
||||
|
||||
/* Look for a port indicator as end of hostname first */
|
||||
|
||||
p = strchr(hostptr, ':');
|
||||
p = ia5memchr(uri, hostptr, ':');
|
||||
/* Otherwise look for trailing slash */
|
||||
if (!p)
|
||||
p = strchr(hostptr, '/');
|
||||
if (p == NULL)
|
||||
p = ia5memchr(uri, hostptr, '/');
|
||||
|
||||
if (!p)
|
||||
hostlen = strlen(hostptr);
|
||||
if (p == NULL)
|
||||
hostlen = IA5_OFFSET_LEN(uri, hostptr);
|
||||
else
|
||||
hostlen = p - hostptr;
|
||||
|
||||
@ -626,7 +653,7 @@ static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base)
|
||||
return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
|
||||
|
||||
/* Special case: initial '.' is RHS match */
|
||||
if (*baseptr == '.') {
|
||||
if (base->length > 0 && *baseptr == '.') {
|
||||
if (hostlen > base->length) {
|
||||
p = hostptr + hostlen - base->length;
|
||||
if (ia5ncasecmp(p, baseptr, base->length) == 0)
|
||||
|
@ -77,7 +77,8 @@ static int i2r_pci(X509V3_EXT_METHOD *method, PROXY_CERT_INFO_EXTENSION *pci,
|
||||
i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage);
|
||||
BIO_puts(out, "\n");
|
||||
if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data)
|
||||
BIO_printf(out, "%*sPolicy Text: %s\n", indent, "",
|
||||
BIO_printf(out, "%*sPolicy Text: %.*s\n", indent, "",
|
||||
pci->proxyPolicy->policy->length,
|
||||
pci->proxyPolicy->policy->data);
|
||||
return 1;
|
||||
}
|
||||
|
@ -12,6 +12,7 @@
|
||||
#include "e_os.h"
|
||||
#include "internal/cryptlib.h"
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include "crypto/ctype.h"
|
||||
#include <openssl/conf.h>
|
||||
#include <openssl/crypto.h>
|
||||
@ -34,17 +35,23 @@ static int ipv6_hex(unsigned char *out, const char *in, int inlen);
|
||||
|
||||
/* Add a CONF_VALUE name value pair to stack */
|
||||
|
||||
int X509V3_add_value(const char *name, const char *value,
|
||||
STACK_OF(CONF_VALUE) **extlist)
|
||||
static int x509v3_add_len_value(const char *name, const char *value,
|
||||
size_t vallen, STACK_OF(CONF_VALUE) **extlist)
|
||||
{
|
||||
CONF_VALUE *vtmp = NULL;
|
||||
char *tname = NULL, *tvalue = NULL;
|
||||
int sk_allocated = (*extlist == NULL);
|
||||
|
||||
if (name && (tname = OPENSSL_strdup(name)) == NULL)
|
||||
goto err;
|
||||
if (value && (tvalue = OPENSSL_strdup(value)) == NULL)
|
||||
if (name != NULL && (tname = OPENSSL_strdup(name)) == NULL)
|
||||
goto err;
|
||||
if (value != NULL) {
|
||||
/* We don't allow embeded NUL characters */
|
||||
if (memchr(value, 0, vallen) != NULL)
|
||||
goto err;
|
||||
tvalue = OPENSSL_strndup(value, vallen);
|
||||
if (tvalue == NULL)
|
||||
goto err;
|
||||
}
|
||||
if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)
|
||||
goto err;
|
||||
if (sk_allocated && (*extlist = sk_CONF_VALUE_new_null()) == NULL)
|
||||
@ -67,10 +74,26 @@ int X509V3_add_value(const char *name, const char *value,
|
||||
return 0;
|
||||
}
|
||||
|
||||
int X509V3_add_value(const char *name, const char *value,
|
||||
STACK_OF(CONF_VALUE) **extlist)
|
||||
{
|
||||
return x509v3_add_len_value(name, value,
|
||||
value != NULL ? strlen((const char *)value) : 0,
|
||||
extlist);
|
||||
}
|
||||
|
||||
int X509V3_add_value_uchar(const char *name, const unsigned char *value,
|
||||
STACK_OF(CONF_VALUE) **extlist)
|
||||
{
|
||||
return X509V3_add_value(name, (const char *)value, extlist);
|
||||
return x509v3_add_len_value(name, (const char *)value,
|
||||
value != NULL ? strlen((const char *)value) : 0,
|
||||
extlist);
|
||||
}
|
||||
|
||||
int x509v3_add_len_value_uchar(const char *name, const unsigned char *value,
|
||||
size_t vallen, STACK_OF(CONF_VALUE) **extlist)
|
||||
{
|
||||
return x509v3_add_len_value(name, (const char *)value, vallen, extlist);
|
||||
}
|
||||
|
||||
/* Free function for STACK_OF(CONF_VALUE) */
|
||||
@ -502,18 +525,26 @@ static int append_ia5(STACK_OF(OPENSSL_STRING) **sk, const ASN1_IA5STRING *email
|
||||
/* First some sanity checks */
|
||||
if (email->type != V_ASN1_IA5STRING)
|
||||
return 1;
|
||||
if (!email->data || !email->length)
|
||||
if (email->data == NULL || email->length == 0)
|
||||
return 1;
|
||||
if (memchr(email->data, 0, email->length) != NULL)
|
||||
return 1;
|
||||
if (*sk == NULL)
|
||||
*sk = sk_OPENSSL_STRING_new(sk_strcmp);
|
||||
if (*sk == NULL)
|
||||
return 0;
|
||||
|
||||
emtmp = OPENSSL_strndup((char *)email->data, email->length);
|
||||
if (emtmp == NULL)
|
||||
return 0;
|
||||
|
||||
/* Don't add duplicates */
|
||||
if (sk_OPENSSL_STRING_find(*sk, (char *)email->data) != -1)
|
||||
if (sk_OPENSSL_STRING_find(*sk, emtmp) != -1) {
|
||||
OPENSSL_free(emtmp);
|
||||
return 1;
|
||||
emtmp = OPENSSL_strdup((char *)email->data);
|
||||
if (emtmp == NULL || !sk_OPENSSL_STRING_push(*sk, emtmp)) {
|
||||
OPENSSL_free(emtmp); /* free on push failure */
|
||||
}
|
||||
if (!sk_OPENSSL_STRING_push(*sk, emtmp)) {
|
||||
OPENSSL_free(emtmp); /* free on push failure */
|
||||
X509_email_free(*sk);
|
||||
*sk = NULL;
|
||||
return 0;
|
||||
|
@ -60,8 +60,7 @@ int sm2_verify(const unsigned char *dgst, int dgstlen,
|
||||
int sm2_ciphertext_size(const EC_KEY *key, const EVP_MD *digest, size_t msg_len,
|
||||
size_t *ct_size);
|
||||
|
||||
int sm2_plaintext_size(const EC_KEY *key, const EVP_MD *digest, size_t msg_len,
|
||||
size_t *pt_size);
|
||||
int sm2_plaintext_size(const unsigned char *ct, size_t ct_size, size_t *pt_size);
|
||||
|
||||
int sm2_encrypt(const EC_KEY *key,
|
||||
const EVP_MD *digest,
|
||||
|
@ -8,6 +8,8 @@
|
||||
*/
|
||||
|
||||
#include "internal/refcount.h"
|
||||
#include <openssl/x509.h>
|
||||
#include <openssl/conf.h>
|
||||
|
||||
/* Internal X509 structures and functions: not for application use */
|
||||
|
||||
@ -284,3 +286,6 @@ int a2i_ipadd(unsigned char *ipout, const char *ipasc);
|
||||
int x509_set1_time(ASN1_TIME **ptm, const ASN1_TIME *tm);
|
||||
|
||||
void x509_init_sig_info(X509 *x);
|
||||
|
||||
int x509v3_add_len_value_uchar(const char *name, const unsigned char *value,
|
||||
size_t vallen, STACK_OF(CONF_VALUE) **extlist);
|
||||
|
@ -40,7 +40,7 @@ extern "C" {
|
||||
* major minor fix final patch/beta)
|
||||
*/
|
||||
# define OPENSSL_VERSION_NUMBER 0x101010bfL
|
||||
# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1k-freebsd 25 Mar 2021"
|
||||
# define OPENSSL_VERSION_TEXT "OpenSSL 1.1.1k-freebsd 24 Aug 2021"
|
||||
|
||||
/*-
|
||||
* The macros below are to be used for shared library (.so, .dll, ...)
|
||||
|
Loading…
Reference in New Issue
Block a user