Bring back some icky buffer allocation code so that pkey_rsa_print()

works again with the horrific API that is ASN1_bn_print().

Issue spotted by inoguchi@

1 files changed, 41 insertions, 9 deletions

diff --git a/lib/libcrypto/rsa/rsa_ameth.c b/lib/libcrypto/rsa/rsa_ameth.c
index a7e042ef2c8..255ccb4d131 100644
--- a/lib/libcrypto/rsa/rsa_ameth.c
+++ b/lib/libcrypto/rsa/rsa_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa_ameth.c,v 1.22 2019/11/01 15:13:05 jsing Exp $ */
+/* $OpenBSD: rsa_ameth.c,v 1.23 2019/11/02 14:35:48 jsing Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -401,13 +401,44 @@ rsa_pss_param_print(BIO *bp, int pss_key, RSA_PSS_PARAMS *pss, int indent)
 
 }
 
+static void
+update_buflen(const BIGNUM *b, size_t *pbuflen)
+{
+	size_t i;
+
+	if (!b)
+		return;
+	if (*pbuflen < (i = (size_t)BN_num_bytes(b)))
+		*pbuflen = i;
+}
+
 static int
 pkey_rsa_print(BIO *bp, const EVP_PKEY *pkey, int off, int priv)
 {
 	const RSA *x = pkey->pkey.rsa;
+	unsigned char *m = NULL;
 	char *str;
 	const char *s;
 	int ret = 0, mod_len = 0;
+	size_t buf_len = 0;
+
+	update_buflen(x->n, &buf_len);
+	update_buflen(x->e, &buf_len);
+
+	if (priv) {
+		update_buflen(x->d, &buf_len);
+		update_buflen(x->p, &buf_len);
+		update_buflen(x->q, &buf_len);
+		update_buflen(x->dmp1, &buf_len);
+		update_buflen(x->dmq1, &buf_len);
+		update_buflen(x->iqmp, &buf_len);
+	}
+
+	m = malloc(buf_len + 10);
+	if (m == NULL) {
+		RSAerror(ERR_R_MALLOC_FAILURE);
+		goto err;
+	}
 
 	if (x->n != NULL)
 		mod_len = BN_num_bits(x->n);
@@ -422,28 +453,29 @@ pkey_rsa_print(BIO *bp, const EVP_PKEY *pkey, int off, int priv)
 		goto err;
 	str = "Modulus:";
 	s = "Exponent:";
-	if (!ASN1_bn_print(bp, str, x->n, NULL, off))
+	if (!ASN1_bn_print(bp, str, x->n, m, off))
 		goto err;
-	if (!ASN1_bn_print(bp, s, x->e, NULL, off))
+	if (!ASN1_bn_print(bp, s, x->e, m, off))
 		goto err;
 	if (priv) {
-		if (!ASN1_bn_print(bp, "privateExponent:", x->d, NULL, off))
+		if (!ASN1_bn_print(bp, "privateExponent:", x->d, m, off))
 			goto err;
-		if (!ASN1_bn_print(bp, "prime1:", x->p, NULL, off))
+		if (!ASN1_bn_print(bp, "prime1:", x->p, m, off))
 			goto err;
-		if (!ASN1_bn_print(bp, "prime2:", x->q, NULL, off))
+		if (!ASN1_bn_print(bp, "prime2:", x->q, m, off))
 			goto err;
-		if (!ASN1_bn_print(bp, "exponent1:", x->dmp1, NULL, off))
+		if (!ASN1_bn_print(bp, "exponent1:", x->dmp1, m, off))
 			goto err;
-		if (!ASN1_bn_print(bp, "exponent2:", x->dmq1, NULL, off))
+		if (!ASN1_bn_print(bp, "exponent2:", x->dmq1, m, off))
 			goto err;
-		if (!ASN1_bn_print(bp, "coefficient:", x->iqmp, NULL, off))
+		if (!ASN1_bn_print(bp, "coefficient:", x->iqmp, m, off))
 			goto err;
 	}
 	if (pkey_is_pss(pkey) && !rsa_pss_param_print(bp, 1, x->pss, off))
 		goto err;
 	ret = 1;
  err:
+	free(m);
 	return ret;
 }