There are functions which may return error conditions that are not being checked on return, and others which are being checked but always return the same value.
This patch probably covers only a small fraction of them, but its a start. Signed-off-by: Klaus Heinrich Kiwi <[email protected]> --- usr/lib/pkcs11/common/h_extern.h | 2 +- usr/lib/pkcs11/common/loadsave.c | 35 ++++++++++++++++++++++++++--------- usr/lib/pkcs11/common/obj_mgr.c | 27 ++++++++++++++++++++++----- 3 files changed, 49 insertions(+), 15 deletions(-) diff --git a/usr/lib/pkcs11/common/h_extern.h b/usr/lib/pkcs11/common/h_extern.h index 851d0b1..c774a69 100755 --- a/usr/lib/pkcs11/common/h_extern.h +++ b/usr/lib/pkcs11/common/h_extern.h @@ -1856,7 +1856,7 @@ CK_RV object_mgr_add_to_map( SESSION * sess, OBJECT * obj, CK_OBJECT_HANDLE * handle ); -CK_RV object_mgr_add_to_shm ( OBJECT *obj ); +void object_mgr_add_to_shm ( OBJECT *obj ); CK_RV object_mgr_del_from_shm( OBJECT *obj ); CK_RV object_mgr_check_shm ( OBJECT *obj ); CK_RV object_mgr_search_shm_for_obj( TOK_OBJ_ENTRY * list, diff --git a/usr/lib/pkcs11/common/loadsave.c b/usr/lib/pkcs11/common/loadsave.c index 9cea754..5c20983 100755 --- a/usr/lib/pkcs11/common/loadsave.c +++ b/usr/lib/pkcs11/common/loadsave.c @@ -926,12 +926,12 @@ restore_private_token_object( CK_BYTE * data, goto done; } - strip_pkcs_padding( cleartxt, len, &cleartxt_len ); + rc = strip_pkcs_padding( cleartxt, len, &cleartxt_len ); // if the padding extraction didn't work it means the object was tampered with or // the key was incorrect // - if (cleartxt_len > len) { + if (rc != CKR_OK || (cleartxt_len > len) ) { st_err_log(4, __FILE__, __LINE__, __FUNCTION__); rc = CKR_FUNCTION_FAILED; goto done; @@ -953,7 +953,10 @@ restore_private_token_object( CK_BYTE * data, // check the hash // - compute_sha( ptr, obj_data_len, hash_sha ); + rc = compute_sha( ptr, obj_data_len, hash_sha ); + if (rc != CKR_OK){ + goto done; + } ptr += obj_data_len; if (memcmp(ptr, hash_sha, SHA1_HASH_SIZE) != 0) { @@ -966,7 +969,10 @@ restore_private_token_object( CK_BYTE * data, // token object... // - object_mgr_restore_obj( obj_data, pObj ); + rc = object_mgr_restore_obj( obj_data, pObj ); + if (rc != CKR_OK) { + goto done; + } rc = CKR_OK; done: @@ -1056,7 +1062,10 @@ load_masterkey_so( void ) // compare the hashes // - compute_sha( mk.key, 3 * DES_KEY_SIZE, hash_sha ); + rc = compute_sha( mk.key, 3 * DES_KEY_SIZE, hash_sha ); + if (rc != CKR_OK) { + goto done; + } if (memcmp(hash_sha, mk.sha_hash, SHA1_HASH_SIZE) != 0) { st_err_log(4, __FILE__, __LINE__, __FUNCTION__); @@ -1153,7 +1162,10 @@ load_masterkey_user( void ) // compare the hashes // - compute_sha( mk.key, 3 * DES_KEY_SIZE, hash_sha ); + rc = compute_sha( mk.key, 3 * DES_KEY_SIZE, hash_sha ); + if (rc != CKR_OK) { + goto done; + } if (memcmp(hash_sha, mk.sha_hash, SHA1_HASH_SIZE) != 0) { st_err_log(4, __FILE__, __LINE__, __FUNCTION__); @@ -1187,7 +1199,10 @@ save_masterkey_so( void ) memcpy( mk.key, master_key, 3 * DES_KEY_SIZE); - compute_sha( master_key, 3 * DES_KEY_SIZE, mk.sha_hash ); + rc = compute_sha( master_key, 3 * DES_KEY_SIZE, mk.sha_hash ); + if (rc != CKR_OK) { + goto done; + } // encrypt the key data // @@ -1270,8 +1285,10 @@ save_masterkey_user( void ) memcpy( mk.key, master_key, 3 * DES_KEY_SIZE); - compute_sha( master_key, 3 * DES_KEY_SIZE, mk.sha_hash ); - + rc = compute_sha( master_key, 3 * DES_KEY_SIZE, mk.sha_hash ); + if (rc != CKR_OK) { + goto done; + } // encrypt the key data // diff --git a/usr/lib/pkcs11/common/obj_mgr.c b/usr/lib/pkcs11/common/obj_mgr.c index a179f40..e447cf5 100755 --- a/usr/lib/pkcs11/common/obj_mgr.c +++ b/usr/lib/pkcs11/common/obj_mgr.c @@ -437,10 +437,20 @@ object_mgr_add( SESSION * sess, o->session = NULL; memcpy( &o->name, current, 8 ); - compute_next_token_obj_name( current, next ); + rc = compute_next_token_obj_name( current, next ); + if (rc != CKR_OK) { + // TODO: handle error, check if rc is a valid per spec + XProcUnLock(xproclock); + goto done; + } memcpy( &nv_token_data->next_token_object_name, next, 8 ); - save_token_object( o ); + rc = save_token_object( o ); + if (rc != CKR_OK) { + // TODO: handle error, check if rc is a valid per spec + XProcUnLock(xproclock); + goto done; + } // add the object identifier to the shared memory segment // @@ -450,7 +460,13 @@ object_mgr_add( SESSION * sess, // save_token_data has to lock the mutex itself because it's used elsewhere // - save_token_data(); + rc = save_token_data(); + if (rc != CKR_OK) { + // TODO: handle error, check if rc is a valid per spec + XProcUnLock(xproclock); + goto done; + } + } // now, store the object in the appropriate local token object list @@ -2159,9 +2175,10 @@ object_mgr_set_attribute_values( SESSION * sess, // // -CK_RV +void object_mgr_add_to_shm( OBJECT *obj ) { + // TODO: Can't this function fail? TOK_OBJ_ENTRY * entry = NULL; CK_BBOOL priv; @@ -2189,7 +2206,7 @@ object_mgr_add_to_shm( OBJECT *obj ) object_mgr_sort_publ_shm(); } - return CKR_OK; + return; } -- 1.7.2.3 ------------------------------------------------------------------------------ Lotusphere 2011 Register now for Lotusphere 2011 and learn how to connect the dots, take your collaborative environment to the next level, and enter the era of Social Business. http://p.sf.net/sfu/lotusphere-d2d _______________________________________________ Opencryptoki-tech mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/opencryptoki-tech
