Merge NSS_3_14_2_RTM.

mozilla/security/nss/lib/pkcs7/certread.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "cert.h"
 #include "secpkcs7.h"
 #include "base64.h"
 #include "secitem.h"
 #include "secder.h"
 #include "secasn1.h"
@@ skipping 127 matching lines @@
 
     PORT_Free(der.data);
     return cert;
 }
 
 static const char NS_CERT_HEADER[]  = "-----BEGIN CERTIFICATE-----";
 static const char NS_CERT_TRAILER[] = "-----END CERTIFICATE-----";
 #define NS_CERT_HEADER_LEN  ((sizeof NS_CERT_HEADER) - 1)
 #define NS_CERT_TRAILER_LEN ((sizeof NS_CERT_TRAILER) - 1)
 
-static const char CERTIFICATE_TYPE_STRING[] = "certificate";
-#define CERTIFICATE_TYPE_LEN (sizeof(CERTIFICATE_TYPE_STRING)-1)
-
 /*
  * read an old style ascii or binary certificate chain
  */
 SECStatus
 CERT_DecodeCertPackage(char *certbuf,
                        int certlen,
                        CERTImportCertificateFunc f,
                        void *arg)
 {
     unsigned char *cp;
     unsigned char *bincert = NULL;
     char *         ascCert = NULL;
     SECStatus      rv;
     
     if ( certbuf == NULL ) {
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        return(SECFailure);
+    }
+    /*
+     * Make sure certlen is long enough to handle the longest possible
+     * reference in the code below:
+     * 0x30 0x84 l1 l2 l3 l4  +
+     *                       tag 9 o1 o2 o3 o4 o5 o6 o7 o8 o9
+     *   6 + 11 = 17. 17 bytes is clearly too small to code any kind of
+     *  certificate (a 128 bit ECC certificate contains at least an 8 byte
+     * key and a 16 byte signature, plus coding overhead). Typically a cert
+     * is much larger. So it's safe to require certlen to be at least 17
+     * bytes.
+     */
+    if (certlen < 17) {
+        PORT_SetError(SEC_ERROR_INPUT_LEN);
         return(SECFailure);
     }
     
     cp = (unsigned char *)certbuf;
 
     /* is a DER encoded certificate of some type? */
     if ( ( *cp  & 0x1f ) == SEC_ASN1_SEQUENCE ) {
         SECItem certitem;
         SECItem *pcertitem = &certitem;
         int seqLen, seqLenLen;
@@ skipping 11 matching lines @@
                 break;
               case 3:
                 seqLen = ((unsigned long)cp[1]<<16) | (cp[2]<<8) | cp[3];
                 break;
               case 2:
                 seqLen = (cp[1]<<8) | cp[2];
                 break;
               case 1:
                 seqLen = cp[1];
                 break;
-              default:
+              case 0:
                 /* indefinite length */
                 seqLen = 0;
+                break;
+              default:
+                goto notder;
             }
             cp += ( seqLenLen + 1 );
 
         } else {
             seqLenLen = 0;
             seqLen = *cp;
             cp++;
         }
 
         /* check entire length if definite length */
         if ( seqLen || seqLenLen ) {
             if ( certlen != ( seqLen + seqLenLen + 2 ) ) {
                 if (certlen > ( seqLen + seqLenLen + 2 ))
                     PORT_SetError(SEC_ERROR_EXTRA_INPUT);
                 else 
                     PORT_SetError(SEC_ERROR_INPUT_LEN);
                 goto notder;
             }
         }
         
-        /* check the type string */
-        /* netscape wrapped DER cert */
-        if ( ( cp[0] == SEC_ASN1_OCTET_STRING ) &&
-            ( cp[1] == CERTIFICATE_TYPE_LEN ) &&
-            ( PORT_Strcmp((char *)&cp[2], CERTIFICATE_TYPE_STRING) ) ) {
-            
-            cp += ( CERTIFICATE_TYPE_LEN + 2 );
-
-            /* it had better be a certificate by now!! */
-            certitem.data = cp;
-            certitem.len = certlen - ( cp - (unsigned char *)certbuf );
-            
-            rv = (* f)(arg, &pcertitem, 1);
-            
-            return(rv);
-        } else if ( cp[0] == SEC_ASN1_OBJECT_ID ) {
+        /* check the type oid */
+        if ( cp[0] == SEC_ASN1_OBJECT_ID ) {
             SECOidData *oiddata;
             SECItem oiditem;
             /* XXX - assume DER encoding of OID len!! */
             oiditem.len = cp[1];
+            /* if we add an oid below that is longer than 9 bytes, then we
+             * need to change the certlen check at the top of the function
+             * to prevent a buffer overflow
+             */
+            if ( oiditem.len > 9 ) {
+                PORT_SetError(SEC_ERROR_UNRECOGNIZED_OID);
+                return(SECFailure);
+            }
             oiditem.data = (unsigned char *)&cp[2];
             oiddata = SECOID_FindOID(&oiditem);
             if ( oiddata == NULL ) {
                 return(SECFailure);
             }
 
             certitem.data = (unsigned char*)certbuf;
             certitem.len = certlen;
             
             switch ( oiddata->offset ) {
@@ skipping 165 matching lines @@
     if ( rv == SECSuccess ) {
         cert = CERT_NewTempCertificate(CERT_GetDefaultCertDB(),
                                        &collectArgs.cert, NULL, 
                                        PR_FALSE, PR_TRUE);
     }
     
     PORT_FreeArena(collectArgs.arena, PR_FALSE);
     
     return(cert);
 }