--- libraries/liblber/decode.c 1998/08/08 22:43:15 1.1.3.1 +++ libraries/liblber/decode.c 2001/05/06 22:43:39 1.5.2.4.2.3 @@ -1,5 +1,9 @@ /* decode.c - ber input decoding routines */ /* + * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved. + * COPYING RESTRICTIONS APPLY, see COPYRIGHT file + */ +/* Portions * Copyright (c) 1990 Regents of the University of Michigan. * All rights reserved. * @@ -11,45 +15,21 @@ * is provided ``as is'' without express or implied warranty. */ +#include "portable.h" + #include -#ifdef MACOS -#include -#include -#include "macos.h" -#else /* MACOS */ -#if defined(NeXT) || defined(VMS) #include -#else /* next || vms */ -#include -#endif /* next || vms */ -#if defined(BC31) || defined(_WIN32) -#include -#else /* BC31 || _WIN32 */ -#include -#endif /* BC31 || _WIN32 */ -#include -#include -#include -#ifdef PCNFS -#include -#endif /* PCNFS */ -#endif /* MACOS */ - -#if defined( DOS ) || defined( _WIN32 ) -#include "msdos.h" -#endif /* DOS */ -#include +#include + +#include +#include + #include "lber.h" -#ifdef LDAP_DEBUG int lber_debug; -#endif - -#ifdef NEEDPROTOS -static int ber_getnint( BerElement *ber, long *num, int len ); -#endif /* NEEDPROTOS */ +static int ber_getnint LDAP_P(( BerElement *ber, long *num, int len )); /* return the tag - LBER_DEFAULT returned means trouble */ unsigned long @@ -58,7 +38,7 @@ ber_get_tag( BerElement *ber ) unsigned char xbyte; unsigned long tag; char *tagp; - int i; + unsigned int i; if ( ber_read( ber, (char *) &xbyte, 1 ) != 1 ) return( LBER_DEFAULT ); @@ -129,11 +109,17 @@ ber_skip_tag( BerElement *ber, unsigned if ( ber_read( ber, (char *) &netlen + diff, noctets ) != noctets ) return( LBER_DEFAULT ); - *len = LBER_NTOHL( netlen ); + *len = AC_NTOHL( netlen ); } else { *len = lc; } + + /* BER element should have enough data left */ + if( *len > ber->ber_end - ber->ber_ptr ) { + return LBER_DEFAULT; + } + return( tag ); } @@ -155,6 +141,7 @@ ber_getnint( BerElement *ber, long *num, { int diff, sign, i; long netnum; + char *p; /* * The tag and length have already been stripped off. We should @@ -172,14 +159,15 @@ ber_getnint( BerElement *ber, long *num, if ( ber_read( ber, ((char *) &netnum) + diff, len ) != len ) return( -1 ); - /* sign extend if necessary */ - sign = ((0x80 << ((len - 1) * 8)) & netnum); - if ( sign && len < sizeof(long) ) { - for ( i = sizeof(long) - 1; i > len - 1; i-- ) { - netnum |= (0xffL << (i * 8)); + /* sign extend if necessary */ + p = (char *) &netnum; + sign = (0x80 & *(p+diff) ); + if ( sign && len < sizeof(long) ) { + for ( i = 0; i < diff; i++ ) { + *(p+i) = (unsigned char) 0xff; } } - *num = LBER_NTOHL( netnum ); + *num = AC_NTOHL( netnum ); return( len ); } @@ -192,7 +180,7 @@ ber_get_int( BerElement *ber, long *num if ( (tag = ber_skip_tag( ber, &len )) == LBER_DEFAULT ) return( LBER_DEFAULT ); - if ( ber_getnint( ber, num, (int)len ) != len ) + if ( (unsigned long) ber_getnint( ber, num, (int)len ) != len ) return( LBER_DEFAULT ); else return( tag ); @@ -208,10 +196,11 @@ ber_get_stringb( BerElement *ber, char * if ( (tag = ber_skip_tag( ber, &datalen )) == LBER_DEFAULT ) return( LBER_DEFAULT ); - if ( datalen > (*len - 1) ) + + if ( datalen >= *len ) return( LBER_DEFAULT ); - if ( ber_read( ber, buf, datalen ) != datalen ) + if ( (unsigned long) ber_read( ber, buf, datalen ) != datalen ) return( LBER_DEFAULT ); buf[datalen] = '\0'; @@ -244,14 +233,19 @@ ber_get_stringa( BerElement *ber, char * { unsigned long datalen, tag; - if ( (tag = ber_skip_tag( ber, &datalen )) == LBER_DEFAULT ) + if ( (tag = ber_skip_tag( ber, &datalen )) == LBER_DEFAULT ) { + *buf = NULL; return( LBER_DEFAULT ); + } if ( (*buf = (char *) malloc( (size_t)datalen + 1 )) == NULL ) return( LBER_DEFAULT ); - if ( ber_read( ber, *buf, datalen ) != datalen ) + if ( (unsigned long) ber_read( ber, *buf, datalen ) != datalen ) { + free( *buf ); + *buf = NULL; return( LBER_DEFAULT ); + } (*buf)[datalen] = '\0'; #ifdef STR_TRANSLATION @@ -261,6 +255,7 @@ ber_get_stringa( BerElement *ber, char * if ( (*(ber->ber_decode_translate_proc))( buf, &datalen, 1 ) != 0 ) { free( *buf ); + *buf = NULL; return( LBER_DEFAULT ); } } @@ -274,17 +269,25 @@ ber_get_stringal( BerElement *ber, struc { unsigned long len, tag; - if ( (*bv = (struct berval *) malloc( sizeof(struct berval) )) == NULL ) + if ( (tag = ber_skip_tag( ber, &len )) == LBER_DEFAULT ) { + *bv = NULL; return( LBER_DEFAULT ); + } - if ( (tag = ber_skip_tag( ber, &len )) == LBER_DEFAULT ) + if ( (*bv = (struct berval *) malloc( sizeof(struct berval) )) == NULL ) return( LBER_DEFAULT ); - if ( ((*bv)->bv_val = (char *) malloc( (size_t)len + 1 )) == NULL ) + if ( ((*bv)->bv_val = (char *) malloc( (size_t)len + 1 )) == NULL ) { + free( *bv ); + *bv = NULL; return( LBER_DEFAULT ); + } - if ( ber_read( ber, (*bv)->bv_val, len ) != len ) + if ( (unsigned long) ber_read( ber, (*bv)->bv_val, len ) != len ) { + ber_bvfree( *bv ); + *bv = NULL; return( LBER_DEFAULT ); + } ((*bv)->bv_val)[len] = '\0'; (*bv)->bv_len = len; @@ -294,7 +297,8 @@ ber_get_stringal( BerElement *ber, struc ++len; if ( (*(ber->ber_decode_translate_proc))( &((*bv)->bv_val), &len, 1 ) != 0 ) { - free( (*bv)->bv_val ); + ber_bvfree( *bv ); + *bv = NULL; return( LBER_DEFAULT ); } (*bv)->bv_len = len - 1; @@ -310,18 +314,26 @@ ber_get_bitstringa( BerElement *ber, cha unsigned long datalen, tag; unsigned char unusedbits; - if ( (tag = ber_skip_tag( ber, &datalen )) == LBER_DEFAULT ) + if ( (tag = ber_skip_tag( ber, &datalen )) == LBER_DEFAULT ) { + *buf = NULL; return( LBER_DEFAULT ); + } --datalen; if ( (*buf = (char *) malloc( (size_t)datalen )) == NULL ) return( LBER_DEFAULT ); - if ( ber_read( ber, (char *)&unusedbits, 1 ) != 1 ) + if ( ber_read( ber, (char *)&unusedbits, 1 ) != 1 ) { + free( buf ); + *buf = NULL; return( LBER_DEFAULT ); + } - if ( ber_read( ber, *buf, datalen ) != datalen ) + if ( (unsigned long) ber_read( ber, *buf, datalen ) != datalen ) { + free( buf ); + *buf = NULL; return( LBER_DEFAULT ); + } *blen = datalen * 8 - unusedbits; return( tag ); @@ -358,6 +370,7 @@ ber_first_element( BerElement *ber, unsi { /* skip the sequence header, use the len to mark where to stop */ if ( ber_skip_tag( ber, len ) == LBER_DEFAULT ) { + *last = NULL; return( LBER_DEFAULT ); } @@ -382,33 +395,35 @@ ber_next_element( BerElement *ber, unsig /* VARARGS */ unsigned long -ber_scanf( -#if defined( MACOS ) || defined( BC31 ) || defined( _WIN32 ) - BerElement *ber, char *fmt, ... ) +ber_scanf +#if HAVE_STDARG + ( BerElement *ber, char *fmt, ... ) #else - va_alist ) + ( va_alist ) va_dcl #endif { va_list ap; -#if !defined( MACOS ) && !defined( BC31 ) && !defined( _WIN32 ) +#ifndef HAVE_STDARG BerElement *ber; char *fmt; #endif + char *fmt_reset; char *last; char *s, **ss, ***sss; struct berval ***bv, **bvp, *bval; int *i, j; - long *l, rc, tag; - unsigned long len; + long *l; + unsigned long rc, tag, len; -#if defined( MACOS ) || defined( BC31 ) || defined( _WIN32 ) +#ifdef HAVE_STDARG va_start( ap, fmt ); #else va_start( ap ); ber = va_arg( ap, BerElement * ); fmt = va_arg( ap, char * ); #endif + fmt_reset = fmt; #ifdef LDAP_DEBUG if ( lber_debug & 64 ) { @@ -418,6 +433,8 @@ va_dcl #endif for ( rc = 0; *fmt && rc != LBER_DEFAULT; fmt++ ) { + /* When this is modified, remember to update + * the error-cleanup code below accordingly. */ switch ( *fmt ) { case 'a': /* octet string - allocate storage as needed */ ss = va_arg( ap, char ** ); @@ -536,9 +553,9 @@ va_dcl break; default: -#ifndef NO_USERINTERFACE +#ifdef LDAP_LIBUI fprintf( stderr, "unknown fmt %c\n", *fmt ); -#endif /* NO_USERINTERFACE */ +#endif /* LDAP_LIBUI */ rc = LBER_DEFAULT; break; } @@ -546,6 +563,103 @@ va_dcl va_end( ap ); + if ( rc == LBER_DEFAULT ) { + /* + * Error. Reclaim malloced memory that was given to the caller. + * Set allocated pointers to NULL, "data length" outvalues to 0. + */ +#ifdef HAVE_STDARG + va_start( ap, fmt ); +#else + va_start( ap ); + (void) va_arg( ap, BerElement * ); + (void) va_arg( ap, char * ); +#endif + + for ( ; fmt_reset < fmt; fmt_reset++ ) { + switch ( *fmt_reset ) { + case 'a': /* octet string - allocate storage as needed */ + ss = va_arg( ap, char ** ); + if ( *ss ) { + free( *ss ); + *ss = NULL; + } + break; + + case 'b': /* boolean */ + case 't': /* tag of next item */ + case 'T': /* skip tag of next item */ + (void) va_arg( ap, int * ); + break; + + case 's': /* octet string - in a buffer */ + (void) va_arg( ap, char * ); + /* Fall through */ + case 'e': /* enumerated */ + case 'i': /* int */ + case 'l': /* length of next item */ + (void) va_arg( ap, long * ); + break; + + case 'o': /* octet string in a supplied berval */ + bval = va_arg( ap, struct berval * ); + if ( bval->bv_val ) { + free( bval->bv_val ); + bval->bv_val = NULL; + } + bval->bv_len = 0; + break; + + case 'O': /* octet string - allocate & include length */ + bvp = va_arg( ap, struct berval ** ); + if ( *bvp ) { + ber_bvfree( *bvp ); + *bvp = NULL; + } + break; + + case 'B': /* bit string - allocate storage as needed */ + ss = va_arg( ap, char ** ); + if ( *ss ) { + free( *ss ); + *ss = NULL; + } + *(va_arg( ap, long * )) = 0; /* for length, in bits */ + break; + + case 'v': /* sequence of strings */ + sss = va_arg( ap, char *** ); + if ( *sss ) { + for (j = 0; (*sss)[j]; j++) + free( (*sss)[j] ); + free( *sss ); + *sss = NULL; + } + break; + + case 'V': /* sequence of strings + lengths */ + bv = va_arg( ap, struct berval *** ); + if ( *bv ) { + ber_bvecfree( *bv ); + *bv = NULL; + } + break; + +#if 0 /* No action for these format characters */ + case 'n': /* null */ + case 'x': /* skip the next element - whatever it is */ + case '{': /* begin sequence */ + case '[': /* begin set */ + case '}': /* end sequence */ + case ']': /* end set */ +#endif + + } + } + + va_end( ap ); + } + return( rc ); }