1 /*
2  * Copyright 2000-2017 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the OpenSSL license (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <stdio.h>
11 #include "internal/cryptlib.h"
12 #include <openssl/asn1t.h>
13 
14 #if !(OPENSSL_API_COMPAT < 0x10200000L)
15 NON_EMPTY_TRANSLATION_UNIT
16 #else
17 
18 #define COPY_SIZE(a, b) (sizeof(a) < sizeof(b) ? sizeof(a) : sizeof(b))
19 
20 /*
21  * Custom primitive type for long handling. This converts between an
22  * ASN1_INTEGER and a long directly.
23  */
24 
25 static int long_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
26 static void long_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
27 
28 static int long_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype,
29                     const ASN1_ITEM *it);
30 static int long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
31                     int utype, char *free_cont, const ASN1_ITEM *it);
32 static int long_print(BIO *out, ASN1_VALUE **pval, const ASN1_ITEM *it,
33                       int indent, const ASN1_PCTX *pctx);
34 
35 static ASN1_PRIMITIVE_FUNCS long_pf = {
36     NULL, 0,
37     long_new,
38     long_free,
39     long_free,                  /* Clear should set to initial value */
40     long_c2i,
41     long_i2c,
42     long_print
43 };
44 
45 ASN1_ITEM_start(LONG)
46         ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &long_pf, ASN1_LONG_UNDEF, "LONG"
47 ASN1_ITEM_end(LONG)
48 
49 ASN1_ITEM_start(ZLONG)
50         ASN1_ITYPE_PRIMITIVE, V_ASN1_INTEGER, NULL, 0, &long_pf, 0, "ZLONG"
51 ASN1_ITEM_end(ZLONG)
52 
53 static int long_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
54 {
55     memcpy(pval, &it->size, COPY_SIZE(*pval, it->size));
56     return 1;
57 }
58 
59 static void long_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
60 {
61     memcpy(pval, &it->size, COPY_SIZE(*pval, it->size));
62 }
63 
64 /*
65  * Originally BN_num_bits_word was called to perform this operation, but
66  * trouble is that there is no guarantee that sizeof(long) equals to
67  * sizeof(BN_ULONG). BN_ULONG is a configurable type that can be as wide
68  * as long, but also double or half...
69  */
70 static int num_bits_ulong(unsigned long value)
71 {
72     size_t i;
73     unsigned long ret = 0;
74 
75     /*
76      * It is argued that *on average* constant counter loop performs
77      * not worse [if not better] than one with conditional break or
78      * mask-n-table-lookup-style, because of branch misprediction
79      * penalties.
80      */
81     for (i = 0; i < sizeof(value) * 8; i++) {
82         ret += (value != 0);
83         value >>= 1;
84     }
85 
86     return (int)ret;
87 }
88 
89 static int long_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype,
90                     const ASN1_ITEM *it)
91 {
92     long ltmp;
93     unsigned long utmp, sign;
94     int clen, pad, i;
95 
96     memcpy(&ltmp, pval, COPY_SIZE(*pval, ltmp));
97     if (ltmp == it->size)
98         return -1;
99     /*
100      * Convert the long to positive: we subtract one if negative so we can
101      * cleanly handle the padding if only the MSB of the leading octet is
102      * set.
103      */
104     if (ltmp < 0) {
105         sign = 0xff;
106         utmp = 0 - (unsigned long)ltmp - 1;
107     } else {
108         sign = 0;
109         utmp = ltmp;
110     }
111     clen = num_bits_ulong(utmp);
112     /* If MSB of leading octet set we need to pad */
113     if (!(clen & 0x7))
114         pad = 1;
115     else
116         pad = 0;
117 
118     /* Convert number of bits to number of octets */
119     clen = (clen + 7) >> 3;
120 
121     if (cont != NULL) {
122         if (pad)
123             *cont++ = (unsigned char)sign;
124         for (i = clen - 1; i >= 0; i--) {
125             cont[i] = (unsigned char)(utmp ^ sign);
126             utmp >>= 8;
127         }
128     }
129     return clen + pad;
130 }
131 
132 static int long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
133                     int utype, char *free_cont, const ASN1_ITEM *it)
134 {
135     int i;
136     long ltmp;
137     unsigned long utmp = 0, sign = 0x100;
138 
139     if (len > 1) {
140         /*
141          * Check possible pad byte.  Worst case, we're skipping past actual
142          * content, but since that's only with 0x00 and 0xff and we set neg
143          * accordingly, the result will be correct in the end anyway.
144          */
145         switch (cont[0]) {
146         case 0xff:
147             cont++;
148             len--;
149             sign = 0xff;
150             break;
151         case 0:
152             cont++;
153             len--;
154             sign = 0;
155             break;
156         }
157     }
158     if (len > (int)sizeof(long)) {
159         ASN1err(ASN1_F_LONG_C2I, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG);
160         return 0;
161     }
162 
163     if (sign == 0x100) {
164         /* Is it negative? */
165         if (len && (cont[0] & 0x80))
166             sign = 0xff;
167         else
168             sign = 0;
169     } else if (((sign ^ cont[0]) & 0x80) == 0) { /* same sign bit? */
170         ASN1err(ASN1_F_LONG_C2I, ASN1_R_ILLEGAL_PADDING);
171         return 0;
172     }
173     utmp = 0;
174     for (i = 0; i < len; i++) {
175         utmp <<= 8;
176         utmp |= cont[i] ^ sign;
177     }
178     ltmp = (long)utmp;
179     if (ltmp < 0) {
180         ASN1err(ASN1_F_LONG_C2I, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG);
181         return 0;
182     }
183     if (sign)
184         ltmp = -ltmp - 1;
185     if (ltmp == it->size) {
186         ASN1err(ASN1_F_LONG_C2I, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG);
187         return 0;
188     }
189     memcpy(pval, &ltmp, COPY_SIZE(*pval, ltmp));
190     return 1;
191 }
192 
193 static int long_print(BIO *out, ASN1_VALUE **pval, const ASN1_ITEM *it,
194                       int indent, const ASN1_PCTX *pctx)
195 {
196     long l;
197 
198     memcpy(&l, pval, COPY_SIZE(*pval, l));
199     return BIO_printf(out, "%ld\n", l);
200 }
201 #endif
202