diff options
| author | Job Snijders <job@cvs.openbsd.org> | 2023-04-30 16:46:50 +0000 |
|---|---|---|
| committer | Job Snijders <job@cvs.openbsd.org> | 2023-04-30 16:46:50 +0000 |
| commit | caf94793036f4b190aa4977f26300a9403150832 (patch) | |
| tree | e1ace3dd2c6eebdfbb7db30e7111dd64e48201c6 /lib/libcrypto/asn1 | |
| parent | 91e93bf01a511ca5b675c9cd803007e6631ed1fb (diff) | |
Revert disablement of the encoding cache
Without the cache, we verify CRL signatures on bytes that have been
pulled through d2i_ -> i2d_, this can cause reordering, which in turn
invalidates the signature. for example if in the original CRL revocation
entries were sorted by date instead of ascending serial number order.
There are probably multiple things we can do here, but they will need
careful consideration and planning.
OK jsing@
Diffstat (limited to 'lib/libcrypto/asn1')
| -rw-r--r-- | lib/libcrypto/asn1/tasn_dec.c | 11 | ||||
| -rw-r--r-- | lib/libcrypto/asn1/tasn_enc.c | 10 |
2 files changed, 17 insertions, 4 deletions
diff --git a/lib/libcrypto/asn1/tasn_dec.c b/lib/libcrypto/asn1/tasn_dec.c index ac59cc7e215..8964d467c28 100644 --- a/lib/libcrypto/asn1/tasn_dec.c +++ b/lib/libcrypto/asn1/tasn_dec.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tasn_dec.c,v 1.85 2023/04/28 17:59:53 job Exp $ */ +/* $OpenBSD: tasn_dec.c,v 1.86 2023/04/30 16:46:49 job Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 2000. */ @@ -736,7 +736,7 @@ static int asn1_item_d2i_sequence(ASN1_VALUE **pval, CBS *cbs, const ASN1_ITEM *it, int tag_number, int tag_class, int optional, int depth) { - CBS cbs_seq, cbs_seq_content; + CBS cbs_seq, cbs_seq_content, cbs_object; int constructed, indefinite, optional_field; const ASN1_TEMPLATE *errat = NULL; const ASN1_TEMPLATE *seqat, *at; @@ -878,9 +878,14 @@ asn1_item_d2i_sequence(ASN1_VALUE **pval, CBS *cbs, const ASN1_ITEM *it, ASN1_template_free(pseqval, seqat); } - if (!CBS_skip(cbs, CBS_offset(&cbs_seq))) + if (!CBS_get_bytes(cbs, &cbs_object, CBS_offset(&cbs_seq))) goto err; + if (!asn1_enc_save(&aseq, &cbs_object, it)) { + ASN1error(ERR_R_MALLOC_FAILURE); + goto err; + } + if (asn1_cb != NULL && !asn1_cb(ASN1_OP_D2I_POST, &aseq, it, NULL)) { ASN1error(ASN1_R_AUX_ERROR); goto err; diff --git a/lib/libcrypto/asn1/tasn_enc.c b/lib/libcrypto/asn1/tasn_enc.c index 430e8e1e8ec..bbe8a2e9491 100644 --- a/lib/libcrypto/asn1/tasn_enc.c +++ b/lib/libcrypto/asn1/tasn_enc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tasn_enc.c,v 1.30 2023/04/28 17:59:53 job Exp $ */ +/* $OpenBSD: tasn_enc.c,v 1.31 2023/04/30 16:46:49 job Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 2000. */ @@ -210,6 +210,14 @@ ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it, /* fall through */ case ASN1_ITYPE_SEQUENCE: + i = asn1_enc_restore(&seqcontlen, out, pval, it); + /* An error occurred */ + if (i < 0) + return 0; + /* We have a valid cached encoding... */ + if (i > 0) + return seqcontlen; + /* Otherwise carry on */ seqcontlen = 0; /* If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL */ if (tag == -1) { |