denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Use openssl_i2chunk when creating ASN.1 chunks

Browse Source 
Using the return value of i2d_* directly as input of chunk_alloc imposes
the risk of creating an invalid chunk when the return value of the i2d_*
function is -1. The openssl_i2chunk macro is meant to avoid this.

Signed-off-by: Thomas Egerer <[email protected]>
This commit is contained in:
Thomas Egerer
2026-05-06 10:46:43 +02:00
committed by Tobias Brunner
parent 4821758d46
commit 82c01b7060
2 changed files with 8 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_ed_public_key.c
+6 -9
View File
@@ -21,6 +21,7 @@
#include <openssl/x509.h> #include <openssl/x509.h>
#include "openssl_ed_public_key.h" #include "openssl_ed_public_key.h"
#include "openssl_util.h"
#include <utils/debug.h> #include <utils/debug.h>
@@ -140,7 +141,6 @@ bool openssl_ed_fingerprint(EVP_PKEY *key, cred_encoding_type_t type,
{ {
hasher_t *hasher; hasher_t *hasher;
chunk_t blob; chunk_t blob;
u_char *p;
if (lib->encoding->get_cache(lib->encoding, type, key, fp)) if (lib->encoding->get_cache(lib->encoding, type, key, fp))
{ {
@@ -153,16 +153,14 @@ bool openssl_ed_fingerprint(EVP_PKEY *key, cred_encoding_type_t type,
{ {
return FALSE; return FALSE;
} }
blob = chunk_alloca(blob.len); blob = chunk_alloc(blob.len);
if (!EVP_PKEY_get_raw_public_key(key, blob.ptr, &blob.len)) if (!EVP_PKEY_get_raw_public_key(key, blob.ptr, &blob.len))
{ {
return FALSE; return FALSE;
} }
break; break;
case KEYID_PUBKEY_INFO_SHA1: case KEYID_PUBKEY_INFO_SHA1:
blob = chunk_alloca(i2d_PUBKEY(key, NULL)); blob = openssl_i2chunk(PUBKEY, key);
p = blob.ptr;
i2d_PUBKEY(key, &p);
break; break;
default: default:
return FALSE; return FALSE;
@@ -172,9 +170,11 @@ bool openssl_ed_fingerprint(EVP_PKEY *key, cred_encoding_type_t type,
{ {
DBG1(DBG_LIB, "SHA1 not supported, fingerprinting failed"); DBG1(DBG_LIB, "SHA1 not supported, fingerprinting failed");
DESTROY_IF(hasher); DESTROY_IF(hasher);
chunk_free(&blob);
return FALSE; return FALSE;
} }
hasher->destroy(hasher); hasher->destroy(hasher);
chunk_free(&blob);
lib->encoding->cache(lib->encoding, type, key, fp); lib->encoding->cache(lib->encoding, type, key, fp);
return TRUE; return TRUE;
} }
@@ -189,11 +189,8 @@ METHOD(public_key_t, get_encoding, bool,
private_public_key_t *this, cred_encoding_type_t type, chunk_t *encoding) private_public_key_t *this, cred_encoding_type_t type, chunk_t *encoding)
{ {
bool success = TRUE; bool success = TRUE;
u_char *p;
*encoding = chunk_alloc(i2d_PUBKEY(this->key, NULL)); *encoding = openssl_i2chunk(PUBKEY, this->key);
p = encoding->ptr;
i2d_PUBKEY(this->key, &p);
if (type != PUBKEY_SPKI_ASN1_DER) if (type != PUBKEY_SPKI_ASN1_DER)
{ {
src/libstrongswan/plugins/openssl/openssl_util.c
+2 -7
View File
@@ -105,7 +105,6 @@ bool openssl_fingerprint(EVP_PKEY *key, cred_encoding_type_t type, chunk_t *fp)
{ {
hasher_t *hasher; hasher_t *hasher;
chunk_t enc; chunk_t enc;
u_char *p;
if (lib->encoding->get_cache(lib->encoding, type, key, fp)) if (lib->encoding->get_cache(lib->encoding, type, key, fp))
{ {
@@ -114,14 +113,10 @@ bool openssl_fingerprint(EVP_PKEY *key, cred_encoding_type_t type, chunk_t *fp)
switch (type) switch (type)
{ {
case KEYID_PUBKEY_SHA1: case KEYID_PUBKEY_SHA1:
enc = chunk_alloc(i2d_PublicKey(key, NULL)); enc = openssl_i2chunk(PublicKey, key);
p = enc.ptr;
i2d_PublicKey(key, &p);
break; break;
case KEYID_PUBKEY_INFO_SHA1: case KEYID_PUBKEY_INFO_SHA1:
enc = chunk_alloc(i2d_PUBKEY(key, NULL)); enc = openssl_i2chunk(PUBKEY, key);
p = enc.ptr;
i2d_PUBKEY(key, &p);
break; break;
default: default:
return FALSE; return FALSE;