romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-04-14 22:51:53 +03:00
Code Issues Projects Releases Packages Wiki Activity

x509asn1: improve encodeOID

Browse source 
- return error on zero length input
- return error on OOM or doing too large output
- fix full 32-bit number support
- fix the broken handling of the first and second numbers
- support up to 32-bit minus 80 for the second number
- a field with a leading 0x80 is now considered an error, since it only
  works as padding and is then no longer the shortest possible version

Add unit tests in 1666

Bonus: removed the last argument to OID2str() as it was always set TRUE.

Closes #21003
This commit is contained in:
Daniel Stenberg 2026-03-19 09:55:46 +01:00
parent ce51fb493c
commit 673e14cd33
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 285 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

88
lib/vtls/x509asn1.c
View file

@ -417,33 +417,65 @@ static CURLcode utf8asn1str(struct dynbuf *to, int type, const char *from,
}
/*
* Convert an ASN.1 OID into its dotted string representation.
* Convert an ASN.1 OID into its dotted string representation. Each field is
* limited to unsigned 32-bit values.
*
* A minor limitation is in the second number, which can be no larger than 32
* bits - 80 == 4294967215.
*
* Return error code.
*
* @unittest 1666
*/
static CURLcode encodeOID(struct dynbuf *store,
const char *beg, const char *end)
UNITTEST CURLcode encodeOID(struct dynbuf *buf, const char *b, const char *e);
UNITTEST CURLcode encodeOID(struct dynbuf *store,
const char *beg, const char *end)
{
unsigned int x;
unsigned int y;
uint32_t x;
uint32_t y;
CURLcode result = CURLE_OK;
/* Process the first two numbers. */
y = *(const unsigned char *)beg++;
x = y / 40;
y -= x * 40;
if(end <= beg)
return CURLE_BAD_FUNCTION_ARGUMENT;
result = curlx_dyn_addf(store, "%u.%u", x, y);
/* Process the first two numbers. The initial digit cannot be larger than
2 */
y = *(const unsigned char *)beg++;
if(y <= 80)
x = y / 40;
else
x = 2;
result = curlx_dyn_addf(store, "%u", x);
if(result)
return result;
if(y & 0x80) {
uint32_t t = (y & 0x7f); /* the second number */
if(!t)
/* reject leading 0x80 padding */
return CURLE_BAD_FUNCTION_ARGUMENT;
do {
if((t & 0xFE000000) || (beg >= end))
return CURLE_BAD_FUNCTION_ARGUMENT;
y = *(const unsigned char *)beg++;
t = (t << 7) | (y & 0x7F);
} while(y & 0x80);
y = t;
}
result = curlx_dyn_addf(store, ".%u", y - (x * 40));
if(result)
return result;
/* Process the trailing numbers. */
while(beg < end) {
while((beg < end) && !result) {
x = 0;
y = 0;
do {
if(x & 0xFF000000)
/* 0x80 as the first value is invalid since it only adds padding */
if((y & 0x80) && !x)
return CURLE_BAD_FUNCTION_ARGUMENT;
else if(beg == end)
else if((x & 0xFE000000) || (beg == end))
return CURLE_BAD_FUNCTION_ARGUMENT;
y = *(const unsigned char *)beg++;
x = (x << 7) | (y & 0x7F);
@ -460,26 +492,22 @@ static CURLcode encodeOID(struct dynbuf *store,
*/
static CURLcode OID2str(struct dynbuf *store,
const char *beg, const char *end, bool symbolic)
const char *beg, const char *end)
{
CURLcode result = CURLE_OK;
if(beg < end) {
if(symbolic) {
struct dynbuf buf;
curlx_dyn_init(&buf, CURL_X509_STR_MAX);
result = encodeOID(&buf, beg, end);
struct dynbuf buf;
curlx_dyn_init(&buf, CURL_X509_STR_MAX);
result = encodeOID(&buf, beg, end);
if(!result) {
const struct Curl_OID *op = searchOID(curlx_dyn_ptr(&buf));
if(op)
result = curlx_dyn_add(store, op->textoid);
else
result = curlx_dyn_add(store, curlx_dyn_ptr(&buf));
}
curlx_dyn_free(&buf);
if(!result) {
const struct Curl_OID *op = searchOID(curlx_dyn_ptr(&buf));
if(op)
result = curlx_dyn_add(store, op->textoid);
else
result = curlx_dyn_add(store, curlx_dyn_ptr(&buf));
}
else
result = encodeOID(store, beg, end);
curlx_dyn_free(&buf);
}
return result;
}
@ -647,7 +675,7 @@ static CURLcode ASN1tostr(struct dynbuf *store,
result = curlx_dyn_addn(store, "", 1);
break;
case CURL_ASN1_OBJECT_IDENTIFIER:
result = OID2str(store, elem->beg, elem->end, TRUE);
result = OID2str(store, elem->beg, elem->end);
break;
case CURL_ASN1_UTC_TIME:
result = UTime2str(store, elem->beg, elem->end);
@ -905,7 +933,7 @@ static CURLcode dumpAlgo(struct dynbuf *store,
if(!p)
return CURLE_BAD_FUNCTION_ARGUMENT;
}
return OID2str(store, oid.beg, oid.end, TRUE);
return OID2str(store, oid.beg, oid.end);
}
/*