Check trailing data when parsing ASN.1.

crypto/rsa_private_key_openssl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "crypto/rsa_private_key.h"
 
 #include <openssl/bio.h>
 #include <openssl/bn.h>
 #include <openssl/evp.h>
 #include <openssl/pkcs12.h>
 #include <openssl/rsa.h>
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "crypto/openssl_util.h"
 #include "crypto/scoped_openssl_types.h"
 
 namespace crypto {
 
 namespace {
 
+typedef ScopedOpenSSL<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>::Type
+    ScopedPKCS8_PRIV_KEY_INFO;
+
 // Function pointer definition, for injecting the required key export function
 // into ExportKey, below. The supplied function should export EVP_PKEY into
 // the supplied BIO, returning 1 on success or 0 on failure.
 typedef int (ExportFunction)(BIO*, EVP_PKEY*);
 
 // Helper to export |key| into |output| via the specified ExportFunction.
 bool ExportKey(EVP_PKEY* key,
                ExportFunction export_fn,
                std::vector<uint8>* output) {
   if (!key)
@@ skipping 37 matching lines @@
   return result.release();
 }
 
 // static
 RSAPrivateKey* RSAPrivateKey::CreateFromPrivateKeyInfo(
     const std::vector<uint8>& input) {
   if (input.empty())
     return NULL;
 
   OpenSSLErrStackTracer err_tracer(FROM_HERE);
-  // BIO_new_mem_buf is not const aware, but it does not modify the buffer.
-  char* data = reinterpret_cast<char*>(const_cast<uint8*>(&input[0]));
-  ScopedBIO bio(BIO_new_mem_buf(data, input.size()));
-  if (!bio.get())
-    return NULL;
 
   // Importing is a little more involved than exporting, as we must first
   // PKCS#8 decode the input, and then import the EVP_PKEY from Private Key
   // Info structure returned.
-  ScopedOpenSSL<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>::Type p8inf(
-      d2i_PKCS8_PRIV_KEY_INFO_bio(bio.get(), NULL));
+  //
+  // TODO(davidben): This should check that |ptr| advanced to the end of |input|
+  // to ensure there is no trailing data.
+  const uint8_t* ptr = &input[0];
+  ScopedPKCS8_PRIV_KEY_INFO p8inf(
+      d2i_PKCS8_PRIV_KEY_INFO(nullptr, &ptr, input.size()));
   if (!p8inf.get())
     return NULL;
 
   scoped_ptr<RSAPrivateKey> result(new RSAPrivateKey);
   result->key_ = EVP_PKCS82PKEY(p8inf.get());
   if (!result->key_)
     return NULL;
 
   return result.release();
 }
@@ skipping 30 matching lines @@
 
 bool RSAPrivateKey::ExportPrivateKey(std::vector<uint8>* output) const {
   return ExportKey(key_, i2d_PKCS8PrivateKeyInfo_bio, output);
 }
 
 bool RSAPrivateKey::ExportPublicKey(std::vector<uint8>* output) const {
   return ExportKey(key_, i2d_PUBKEY_bio, output);
 }
 
 }  // namespace crypto