]> git.sur5r.net Git - openldap/blobdiff - libraries/liblber/decode.c
check for overflows
[openldap] / libraries / liblber / decode.c
index 6fcaa8fa3bdedc38a4acd05049127f427d75fbab..5238564ca8f6742b626a696dc8728bb58d13b312 100644 (file)
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Copyright 1998-2008 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -45,6 +45,52 @@ static ber_len_t ber_getnint LDAP_P((
        ber_int_t *num,
        ber_len_t len ));
 
+/* out->bv_len should be the buffer size on input */
+int
+ber_decode_oid( BerValue *in, BerValue *out )
+{
+       const unsigned char *der;
+       unsigned long val;
+       unsigned val1;
+       ber_len_t i;
+       char *ptr;
+
+       assert( in != NULL );
+       assert( out != NULL );
+
+       /* need 4 chars/inbyte + \0 for input={7f 7f 7f...} */
+       if ( !out->bv_val || (out->bv_len+3)/4 <= in->bv_len )
+               return -1;
+
+       ptr = NULL;
+       der = (unsigned char *) in->bv_val;
+       val = 0;
+       for ( i=0; i < in->bv_len; i++ ) {
+               val |= der[i] & 0x7f;
+               if ( !( der[i] & 0x80 )) {
+                       if ( ptr == NULL ) {
+                               /* Initial "x.y": val=x*40+y, x<=2, y<40 if x<2 */
+                               ptr = out->bv_val;
+                               val1 = (val < 80 ? val/40 : 2);
+                               val -= val1*40;
+                               ptr += sprintf( ptr, "%u", val1 );
+                       }
+                       ptr += sprintf( ptr, ".%lu", val );
+                       val = 0;
+               } else if ( val - 1UL < LBER_OID_COMPONENT_MAX >> 7 ) {
+                       val <<= 7;
+               } else {
+                       /* val would overflow, or is 0 from invalid initial 0x80 octet */
+                       return -1;
+               }
+       }
+       if ( ptr == NULL || val != 0 )
+               return -1;
+
+       out->bv_len = ptr - out->bv_val;
+       return 0;
+}
+
 /* return the tag - LBER_DEFAULT returned means trouble */
 ber_tag_t
 ber_get_tag( BerElement *ber )
@@ -373,7 +419,7 @@ ber_get_stringbvl( bgbvr *b, ber_len_t *rlen )
        case BvOff:
                *b->res.ba = ber_memalloc_x( (n+1) * b->siz, b->ber->ber_memctx );
                if ( *b->res.ba == NULL ) return LBER_DEFAULT;
-               ((struct berval *)((long)(*b->res.ba) + n*b->siz +
+               ((struct berval *)((char *)(*b->res.ba) + n*b->siz +
                        b->off))->bv_val = NULL;
                break;
        }
@@ -406,7 +452,7 @@ ber_get_stringbvl( bgbvr *b, ber_len_t *rlen )
                        *bvp = bv;
                        break;
                case BvOff:
-                       *(BerVarray)((long)(*b->res.ba)+n*b->siz+b->off) = bv;
+                       *(BerVarray)((char *)(*b->res.ba)+n*b->siz+b->off) = bv;
                        break;
                }
        }
@@ -437,7 +483,51 @@ nomem:
 }
 
 ber_tag_t
-ber_get_stringbv( BerElement *ber, struct berval *bv, int alloc )
+ber_get_stringbv( BerElement *ber, struct berval *bv, int option )
+{
+       ber_tag_t       tag;
+
+       assert( ber != NULL );
+       assert( bv != NULL );
+
+       assert( LBER_VALID( ber ) );
+
+       if ( (tag = ber_skip_tag( ber, &bv->bv_len )) == LBER_DEFAULT ) {
+               bv->bv_val = NULL;
+               return LBER_DEFAULT;
+       }
+
+       if ( (ber_len_t) ber_pvt_ber_remaining( ber ) < bv->bv_len ) {
+               return LBER_DEFAULT;
+       }
+
+       if ( option & LBER_BV_ALLOC ) {
+               bv->bv_val = (char *) ber_memalloc_x( bv->bv_len + 1,
+                       ber->ber_memctx );
+               if ( bv->bv_val == NULL ) {
+                       return LBER_DEFAULT;
+               }
+
+               if ( bv->bv_len > 0 && (ber_len_t) ber_read( ber, bv->bv_val,
+                       bv->bv_len ) != bv->bv_len )
+               {
+                       LBER_FREE( bv->bv_val );
+                       bv->bv_val = NULL;
+                       return LBER_DEFAULT;
+               }
+       } else {
+               bv->bv_val = ber->ber_ptr;
+               ber->ber_ptr += bv->bv_len;
+       }
+       ber->ber_tag = *(unsigned char *)ber->ber_ptr;
+       if ( !( option & LBER_BV_NOTERM ))
+               bv->bv_val[bv->bv_len] = '\0';
+
+       return tag;
+}
+
+ber_tag_t
+ber_get_stringbv_null( BerElement *ber, struct berval *bv, int option )
 {
        ber_tag_t       tag;
 
@@ -455,7 +545,13 @@ ber_get_stringbv( BerElement *ber, struct berval *bv, int alloc )
                return LBER_DEFAULT;
        }
 
-       if ( alloc ) {
+       if ( bv->bv_len == 0 ) {
+               bv->bv_val = NULL;
+               ber->ber_tag = *(unsigned char *)ber->ber_ptr;
+               return tag;
+       }
+
+       if ( option & LBER_BV_ALLOC ) {
                bv->bv_val = (char *) ber_memalloc_x( bv->bv_len + 1,
                        ber->ber_memctx );
                if ( bv->bv_val == NULL ) {
@@ -474,7 +570,8 @@ ber_get_stringbv( BerElement *ber, struct berval *bv, int alloc )
                ber->ber_ptr += bv->bv_len;
        }
        ber->ber_tag = *(unsigned char *)ber->ber_ptr;
-       bv->bv_val[bv->bv_len] = '\0';
+       if ( !( option & LBER_BV_NOTERM ))
+               bv->bv_val[bv->bv_len] = '\0';
 
        return tag;
 }
@@ -487,7 +584,21 @@ ber_get_stringa( BerElement *ber, char **buf )
 
        assert( buf != NULL );
 
-       tag = ber_get_stringbv( ber, &bv, 1 );
+       tag = ber_get_stringbv( ber, &bv, LBER_BV_ALLOC );
+       *buf = bv.bv_val;
+
+       return tag;
+}
+
+ber_tag_t
+ber_get_stringa_null( BerElement *ber, char **buf )
+{
+       BerValue        bv;
+       ber_tag_t       tag;
+
+       assert( buf != NULL );
+
+       tag = ber_get_stringbv_null( ber, &bv, LBER_BV_ALLOC );
        *buf = bv.bv_val;
 
        return tag;
@@ -507,7 +618,7 @@ ber_get_stringal( BerElement *ber, struct berval **bv )
                return LBER_DEFAULT;
        }
 
-       tag = ber_get_stringbv( ber, *bv, 1 );
+       tag = ber_get_stringbv( ber, *bv, LBER_BV_ALLOC );
        if ( tag == LBER_DEFAULT ) {
                LBER_FREE( *bv );
                *bv = NULL;
@@ -669,9 +780,11 @@ ber_scanf ( BerElement *ber,
 
        fmt_reset = fmt;
 
-       ber_log_printf( LDAP_DEBUG_TRACE, ber->ber_debug,
-               "ber_scanf fmt (%s) ber:\n", fmt );
-       ber_log_dump( LDAP_DEBUG_BER, ber->ber_debug, ber, 1 );
+       if ( ber->ber_debug & (LDAP_DEBUG_TRACE|LDAP_DEBUG_BER)) {
+               ber_log_printf( LDAP_DEBUG_TRACE, ber->ber_debug,
+                       "ber_scanf fmt (%s) ber:\n", fmt );
+               ber_log_dump( LDAP_DEBUG_BER, ber->ber_debug, ber, 1 );
+       }
 
        for ( rc = 0; *fmt && rc != LBER_DEFAULT; fmt++ ) {
                /* When this is modified, remember to update
@@ -692,11 +805,23 @@ ber_scanf ( BerElement *ber,
                        rc = ber_get_stringa( ber, ss );
                        break;
 
+               case 'A':       /* octet string - allocate storage as needed,
+                                * but return NULL if len == 0 */
+                       ss = va_arg( ap, char ** );
+                       rc = ber_get_stringa_null( ber, ss );
+                       break;
+
                case 'b':       /* boolean */
                        i = va_arg( ap, ber_int_t * );
                        rc = ber_get_boolean( ber, i );
                        break;
 
+               case 'B':       /* bit string - allocate storage as needed */
+                       ss = va_arg( ap, char ** );
+                       l = va_arg( ap, ber_len_t * ); /* for length, in bits */
+                       rc = ber_get_bitstringa( ber, ss, l );
+                       break;
+
                case 'e':       /* enumerated */
                case 'i':       /* int */
                        i = va_arg( ap, ber_int_t * );
@@ -708,24 +833,35 @@ ber_scanf ( BerElement *ber,
                        rc = ber_peek_tag( ber, l );
                        break;
 
-               case 'n':       /* null */
-                       rc = ber_get_null( ber );
+               case 'm':       /* octet string in berval, in-place */
+                       bval = va_arg( ap, struct berval * );
+                       rc = ber_get_stringbv( ber, bval, 0 );
                        break;
 
-               case 's':       /* octet string - in a buffer */
-                       s = va_arg( ap, char * );
+               case 'M':       /* bvoffarray - must include address of
+                                * a record len, and record offset.
+                                * number of records will be returned thru
+                                * len ptr on finish. parsed in-place.
+                                */
+               {
+                       bgbvr cookie = { BvOff };
+                       cookie.ber = ber;
+                       cookie.res.ba = va_arg( ap, struct berval ** );
+                       cookie.alloc = 0;
                        l = va_arg( ap, ber_len_t * );
-                       rc = ber_get_stringb( ber, s, l );
+                       cookie.siz = *l;
+                       cookie.off = va_arg( ap, ber_len_t );
+                       rc = ber_get_stringbvl( &cookie, l );
                        break;
+               }
 
-               case 'm':       /* octet string in berval, in-place */
-                       bval = va_arg( ap, struct berval * );
-                       rc = ber_get_stringbv( ber, bval, 0 );
+               case 'n':       /* null */
+                       rc = ber_get_null( ber );
                        break;
 
                case 'o':       /* octet string in a supplied berval */
                        bval = va_arg( ap, struct berval * );
-                       rc = ber_get_stringbv( ber, bval, 1 );
+                       rc = ber_get_stringbv( ber, bval, LBER_BV_ALLOC );
                        break;
 
                case 'O':       /* octet string - allocate & include length */
@@ -733,10 +869,10 @@ ber_scanf ( BerElement *ber,
                        rc = ber_get_stringal( ber, bvp );
                        break;
 
-               case 'B':       /* bit string - allocate storage as needed */
-                       ss = va_arg( ap, char ** );
-                       l = va_arg( ap, ber_len_t * ); /* for length, in bits */
-                       rc = ber_get_bitstringa( ber, ss, l );
+               case 's':       /* octet string - in a buffer */
+                       s = va_arg( ap, char * );
+                       l = va_arg( ap, ber_len_t * );
+                       rc = ber_get_stringb( ber, s, l );
                        break;
 
                case 't':       /* tag of next item */
@@ -754,7 +890,7 @@ ber_scanf ( BerElement *ber,
                        bgbvr cookie = { ChArray };
                        cookie.ber = ber;
                        cookie.res.c = va_arg( ap, char *** );
-                       cookie.alloc = 1;
+                       cookie.alloc = LBER_BV_ALLOC;
                        rc = ber_get_stringbvl( &cookie, NULL );
                        break;
                }
@@ -764,7 +900,7 @@ ber_scanf ( BerElement *ber,
                        bgbvr cookie = { BvVec };
                        cookie.ber = ber;
                        cookie.res.bv = va_arg( ap, struct berval *** );
-                       cookie.alloc = 1;
+                       cookie.alloc = LBER_BV_ALLOC;
                        rc = ber_get_stringbvl( &cookie, NULL );
                        break;
                }
@@ -774,28 +910,11 @@ ber_scanf ( BerElement *ber,
                        bgbvr cookie = { BvArray };
                        cookie.ber = ber;
                        cookie.res.ba = va_arg( ap, struct berval ** );
-                       cookie.alloc = 1;
+                       cookie.alloc = LBER_BV_ALLOC;
                        rc = ber_get_stringbvl( &cookie, NULL );
                        break;
                }
 
-               case 'M':       /* bvoffarray - must include address of
-                                * a record len, and record offset.
-                                * number of records will be returned thru
-                                * len ptr on finish. parsed in-place.
-                                */
-               {
-                       bgbvr cookie = { BvOff };
-                       cookie.ber = ber;
-                       cookie.res.ba = va_arg( ap, struct berval ** );
-                       cookie.alloc = 0;
-                       l = va_arg( ap, ber_len_t * );
-                       cookie.siz = *l;
-                       cookie.off = va_arg( ap, ber_len_t );
-                       rc = ber_get_stringbvl( &cookie, l );
-                       break;
-               }
-
                case 'x':       /* skip the next element - whatever it is */
                        if ( (rc = ber_skip_tag( ber, &len )) == LBER_DEFAULT )
                                break;
@@ -845,6 +964,7 @@ ber_scanf ( BerElement *ber,
                        } break;
 
                case 'a':       /* octet string - allocate storage as needed */
+               case 'A':
                        ss = va_arg( ap, char ** );
                        if ( *ss ) {
                                LBER_FREE( *ss );
@@ -858,20 +978,10 @@ ber_scanf ( BerElement *ber,
                        (void) va_arg( ap, int * );
                        break;
 
-               case 's':       /* octet string - in a buffer */
-                       (void) va_arg( ap, char * );
-                       (void) va_arg( ap, ber_len_t * );
-                       break;
-
                case 'l':       /* length of next item */
                        (void) va_arg( ap, ber_len_t * );
                        break;
 
-               case 't':       /* tag of next item */
-               case 'T':       /* skip tag of next item */
-                       (void) va_arg( ap, ber_tag_t * );
-                       break;
-
                case 'o':       /* octet string in a supplied berval */
                        bval = va_arg( ap, struct berval * );
                        if ( bval->bv_val != NULL ) {
@@ -889,6 +999,16 @@ ber_scanf ( BerElement *ber,
                        }
                        break;
 
+               case 's':       /* octet string - in a buffer */
+                       (void) va_arg( ap, char * );
+                       (void) va_arg( ap, ber_len_t * );
+                       break;
+
+               case 't':       /* tag of next item */
+               case 'T':       /* skip tag of next item */
+                       (void) va_arg( ap, ber_tag_t * );
+                       break;
+
                case 'B':       /* bit string - allocate storage as needed */
                        ss = va_arg( ap, char ** );
                        if ( *ss ) {
@@ -898,12 +1018,12 @@ ber_scanf ( BerElement *ber,
                        *(va_arg( ap, ber_len_t * )) = 0; /* for length, in bits */
                        break;
 
-               case 'v':       /* sequence of strings */
-               case 'V':       /* sequence of strings + lengths */
-               case 'W':       /* BerVarray */
                case 'm':       /* berval in-place */
                case 'M':       /* BVoff array in-place */
                case 'n':       /* null */
+               case 'v':       /* sequence of strings */
+               case 'V':       /* sequence of strings + lengths */
+               case 'W':       /* BerVarray */
                case 'x':       /* skip the next element - whatever it is */
                case '{':       /* begin sequence */
                case '[':       /* begin set */