/* openssl-bug2-20101212.c 20101212, Sampo Kellomaki ([email protected]) To: [email protected] Subject: openssl-1.0.0c bug: Decoding cert causes segv in ASN1 code
Also reproduces on openssl-0.9.8g This file is also available from http://zxid.org/openssl-bug2-20101212.c openssl-1.0.0c gcc-3.4.6 glibc-2.9 Linux 2.6 on x86 (Atom) Add to Configure perl script "debug-linux-pentium-shared","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -mcpu=pentium -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", ./Configure --prefix=/apps/openssl/1.0.0c-gcc-3.4.6-debug-xmlenc enable-rc5 enable-mdc2 shared zlib debug-linux-pentium-shared --with-zlib-include=/apps/include --with-zlib-lib=/apps/lib gcc -o bug2 -g -I/apps/openssl/1.0.0c-gcc-3.4.6-debug-xmlenc/include -L/apps/openssl/1.0.0c-gcc-3.4.6-debug-xmlenc/lib -lcrypto openssl-bug2-20101212.c; ./bug2 gdb bug2 core (gdb) bt #0 0xb7698f6c in c2i_ASN1_INTEGER (a=0x5b04c483, pp=0xbf8c6754, len=0x1) at a_int.c:186 #1 0xb76a80ee in asn1_ex_c2i (pval=0x5b04c483, cont=0xbf8c6bac "\002\002\003", len=0x1, utype=0x2, free_cont=0xbf8c679d "", it=0xb772bcd0) at tasn_dec.c:992 #2 0xb76a7e89 in asn1_d2i_ex_primitive (pval=0x5b04c483, in=0xbf8c688c, inlen=0x3, it=0xb772bcd0, tag=0x2, aclass=0x0, opt=0x0, ctx=0xbf8c6b00) at tasn_dec.c:907 #3 0xb76a6c5b in ASN1_item_ex_d2i (pval=0x5b04c483, in=0xbf8c688c, len=0x3, it=0xb772bcd0, tag=0xffffffff, aclass=0x0, opt=0x0, ctx=0xbf8c6b00) at tasn_dec.c:198 #4 0xb76a7a9d in asn1_template_noexp_d2i (val=0x5b04c483, in=0xbf8c68dc, len=0x3, tt=0xb772f640, opt=0x0, ctx=0xbf8c6b00) at tasn_dec.c:746 #5 0xb76a7636 in asn1_template_ex_d2i (val=0x5b04c483, in=0xbf8c6964, inlen=0x5c2, tt=0xb772f640, opt=0x1, ctx=0xbf8c6b00) at tasn_dec.c:575 #6 0xb76a72d5 in ASN1_item_ex_d2i (pval=0xb76910aa, in=0xbf8c69cc, len=0x5c2, it=0xb772bb3c, tag=0x10, aclass=0x0, opt=0x0, ctx=0xbf8c6b00) at tasn_dec.c:448 #7 0xb76a7a9d in asn1_template_noexp_d2i (val=0xb76910aa, in=0xbf8c6aa4, len=0x659, tt=0xb772f720, opt=0x0, ctx=0xbf8c6b00) at tasn_dec.c:746 #8 0xb76a7702 in asn1_template_ex_d2i (val=0xb76910aa, in=0xbf8c6aa4, inlen=0x659, tt=0xb772f720, opt=0x0, ctx=0xbf8c6b00) at tasn_dec.c:607 #9 0xb76a72d5 in ASN1_item_ex_d2i (pval=0xbf8c6b6c, in=0xbf8c6b70, len=0x659, it=0xb772bb70, tag=0x10, aclass=0x0, opt=0x0, ctx=0xbf8c6b00) at tasn_dec.c:448 #10 0xb76a6af4 in ASN1_item_d2i (pval=0xbf8c6b6c, in=0xbf8c6b70, len=0x65d, it=0xb772bb70) at tasn_dec.c:136 #11 0xb76a0443 in d2i_X509 (a=0xbf8c6b6c, in=0xbf8c6b70, len=0x65d) at x_x509.c:141 #12 0x080488f1 in mk_test_cert (buflen=0x1000, buf=0xbf8c6ba0 "") at openssl-bug2-20101212.c:192 #13 0x0804894c in main () at openssl-bug2-20101212.c:203 (gdb) p a $1 = (ASN1_INTEGER **) 0x5b04c483 (gdb) p *a Cannot access memory at address 0x5b04c483 The bad value originates in stack frame #6 as pseqval in tasn_dec.c:418 Note: the cert in cert_b64 may itself be corrupt, but even if it is corrupt it should not cause the ASN1 code to seg fault. Just return an error. --Sampo P.S. I have also seen memory freeseg faults with 1.0.0c that do not occur in 0.9.8g. Perhaps the 1.0.0 series is not entirely stable yet. I'll send you a bug report if I manage to distill one in small reproducible program like this one. */ #include <stdio.h> #include <string.h> #include <openssl/err.h> #include <openssl/evp.h> #include <openssl/md5.h> #include <openssl/hmac.h> #include <openssl/rand.h> #include <openssl/x509.h> #include <openssl/x509v3.h> #include <openssl/rsa.h> #include <openssl/pem.h> const char cert_b64[] = "MIIGWTCCBcKgAwIBAgIDAJEBMA0GCSqGSIb3DQEBBQUAMIIBEjELMAkGA1UEBhMC\n\ RVMxEjAQBgNVBAgTCUJhcmNlbG9uYTESMBAGA1UEBxMJQmFyY2Vsb25hMSkwJwYD\n\ VQQKEyBJUFMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgcy5sLjEuMCwGA1UEChQl\n\ Z2VuZXJhbEBpcHNjYS5jb20gQy5JLkYuICBCLUI2MjIxMDY5NTEuMCwGA1UECxMl\n\ aXBzQ0EgQ0xBU0VBMSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEuMCwGA1UEAxMl\n\ aXBzQ0EgQ0xBU0VBMSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEgMB4GCSqGSIb3\n\ DQEJARYRZ2VuZXJhbEBpcHNjYS5jb20wHhcNMDYwNDI2MTUzNjU0WhcNMDgwNDI1\n\ MTUzNjU0WjCBljELMAkGA1UEBhMCUFQxDzANBgNVBAgTBkxpc2JvYTEPMA0GA1UE\n\ BxMGTGlzYm9hMRMwEQYDVQQKEwpTeW1sYWJzIFNBMRQwEgYDVQQLEwtJVCBTZXJ2\n\ aWNlczEYMBYGA1UEAxMPaWRwLnN5bWRlbW8uY29tMSAwHgYJKoZIhvcNAQkBFhFm\n\ ZWxpeEBzeW1sYWJzLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA06ux\n\ x5ZjAl06CZcSMVtjoaS2sCbrBq/whwWnuVgbD6gAM9EO9qDDEs9eB5n4lHGY8S94\n\ iFTWuZy9jdxL5wNgr2Zk8NxytyaznQgAddKLCSqPZh7Dd+U3Z5hoGtLelJoq2Yi8\n\ Sopfj3m6TKOzURgg/Ad/0/cuF9TyCpQprBcpsAECAwEAAaOCAzQwggMwMAkGA1Ud\n\ EwQCMAAwEQYJYIZIAYb4QgEBBAQDAgZAMAsGA1UdDwQEAwID+DATBgNVHSUEDDAK\n\ BggrBgEFBQcDATAdBgNVHQ4EFgQUbChmdTnQyOFzW59+dakqD/KXpy4wHwYDVR0j\n\ BBgwFoAUDgdg1DnJG1tdkHsjyNI0nUqaRjkwHAYDVR0RBBUwE4ERZmVsaXhAc3lt\n\ bGFicy5jb20wHAYDVR0SBBUwE4ERZ2VuZXJhbEBpcHNjYS5jb20wcgYJYIZIAYb4\n\ QgENBGUWY09yZ2FuaXphdGlvbiBJbmZvcm1hdGlvbiBOT1QgVkFMSURBVEVELiBD\n\ TEFTRUExIFNlcnZlciBDZXJ0aWZpY2F0ZSBpc3N1ZWQgYnkgaHR0cHM6Ly93d3cu\n\ aXBzY2EuY29tLzAvBglghkgBhvhCAQIEIhYgaHR0cHM6Ly93d3cuaXBzY2EuY29t\n\ L2lwc2NhMjAwMi8wQwYJYIZIAYb4QgEEBDYWNGh0dHBzOi8vd3d3Lmlwc2NhLmNv\n\ bS9pcHNjYTIwMDIvaXBzY2EyMDAyQ0xBU0VBMS5jcmwwRgYJYIZIAYb4QgEDBDkW\n\ N2h0dHBzOi8vd3d3Lmlwc2NhLmNvbS9pcHNjYTIwMDIvcmV2b2NhdGlvbkNMQVNF\n\ QTEuaHRtbD8wQwYJYIZIAYb4QgEHBDYWNGh0dHBzOi8vd3d3Lmlwc2NhLmNvbS9p\n\ cHNjYTIwMDIvcmVuZXdhbENMQVNFQTEuaHRtbD8wQQYJYIZIAYb4QgEIBDQWMmh0\n\ dHBzOi8vd3d3Lmlwc2NhLmNvbS9pcHNjYTIwMDIvcG9saWN5Q0xBU0VBMS5odG1s\n\ MIGDBgNVHR8EfDB6MDmgN6A1hjNodHRwOi8vd3d3Lmlwc2NhLmNvbS9pcHNjYTIw\n\ MDIvaXBzY2EyMDAyQ0xBU0VBMS5jcmwwPaA7oDmGN2h0dHA6Ly93d3diYWNrLmlw\n\ c2NhLmNvbS9pcHNjYTIwMDIvaXBzY2EyMDAyQ0xBU0VBMS5jcmwwMgYIKwYBBQUH\n\ AQEEJjAkMCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5pcHNjYS5jb20vMA0GCSqG\n\ SIb3DQEBBQUAA4GBACan4TGRFHayR38xPkMabzwz9VmCbm0uwPxkUhSB8DQ8gNWi\n\ jkSenPpwpvomvNfp4G0WJdavd7KnZBbMbnKx1qTMgge/ftBnuqcrn6w90jnSC4RK\n\ aHftQ+r2gFYiVX4HEa6NU5AgpiQjme0Vh3Hzs228lVllgsFqv6YbdIyTYIUe\n"; const char pkey_b64[] = "MIICXQIBAAKBgQDTq7HHlmMCXToJlxIxW2OhpLawJusGr/CHBae5WBsPqAAz0Q72\n\ oMMSz14HmfiUcZjxL3iIVNa5nL2N3EvnA2CvZmTw3HK3JrOdCAB10osJKo9mHsN3\n\ 5TdnmGga0t6UmirZiLxKil+PebpMo7NRGCD8B3/T9y4X1PIKlCmsFymwAQIDAQAB\n\ AoGBAJmGWKW4sAtQ7v1xs2JVNMhTHaZaM/FfvwdP1L0b6FTMt4jdwwqiw5prCXpd\n\ 9OxGEHYuxi+rySpLQzkXZX4i9wYupMSgPfrrBwmVCNi+6Ej74srVE3+xawkdPjrr\n\ YQu4H+KORWAtegm4h0EVed6hI9tG4vgkL0Jrh36gZl7t12yBAkEA+g8JsdyFT6e5\n\ Ts4F0IiteomtT6LlbLV+YSISrrJnoebmJX+fr0pJVyg5SoYOot2ZPRcWaUyOaXka\n\ p0DFvPpfKQJBANizKg+iQJHUqYEm5xiRxFnMv7xXJVemuWagoLfNpvKfmXqydZDe\n\ PL1OEW1Yn8DJ3NBix0ZBaIfuM+zA66wQ3RkCQQDRmFEz9/b1sUwttZpCFI30K/pM\n\ yekrmWT43apzK66ZkgROYg7iyo12tIxw3rTd5ohPIE70q+qilZO1pSEZKXMhAkBG\n\ +zDs3A3gdtNrDa4m+yBg9dNcQwNlWaRjPHxImKF12ddxPGGMKW+l5puIwL3bbYPZ\n\ 8nEpzyUJWXpCs9K+kuuJAkAm0b523XnsJmsipA+ZDdyqrUjKDo6WH3f9zmIJdNc0\n\ /GeJEXxqIwfcj2lZLp/iIRvG7ICjN/rdWoNImF3HVBRS\n"; #define XX 255 /* illegal base64 char */ #define Eq 254 /* padding */ #define INVALID XX unsigned char std_index_64[256] = { XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,62, Eq,62,XX,63, /* `+' ',' '-' `/' */ 52,53,54,55, 56,57,58,59, 60,61,XX,XX, XX,Eq,XX,XX, /* `=' */ XX, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,10, 11,12,13,14, 15,16,17,18, 19,20,21,22, 23,24,25,XX, XX,XX,XX,63, /* `_' */ XX,26,27,28, 29,30,31,32, 33,34,35,36, 37,38,39,40, 41,42,43,44, 45,46,47,48, 49,50,51,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX, XX,XX,XX,XX }; char* unbase64_raw(const char* p, const char* lim, char* r, const unsigned char* index_64) { int i; unsigned char c[4]; unsigned char uc; while (p < lim) { i = 0; do { uc = index_64[(int)*p++]; if (uc != INVALID) c[i++] = uc; if (p == lim) { if (i < 4) { /*if (i) ERR("Premature end of base64 data. (incomplete base64 input) i=%d", i);*/ if (i < 2) return r; if (i == 2) c[2] = Eq; c[3] = Eq; } break; } } while (i < 4); if (c[0] == Eq || c[1] == Eq) { fprintf(stderr, "Premature end of base64 data. (incomplete base64 input) c0(%x)", c[0]); break; } *r++ = (c[0] << 2) | ((c[1] & 0x30) >> 4); if (c[2] == Eq) break; *r++ = ((c[1] & 0x0f) << 4) | ((c[2] & 0x3c) >> 2); if (c[3] == Eq) break; *r++ = ((c[2] & 0x03) << 6) | c[3]; } return r; } int report_openssl_error(const char* logkey) { char buf[256]; unsigned long err; const char* file; const char* data; int flags, line, n_err = 0; buf[0] = 0; while ((err = ERR_get_error_line_data((const char**)&file,&line,(const char**)&data, &flags))) { ERR_error_string_n(err, buf, sizeof(buf)); buf[sizeof(buf)-1] = 0; fprintf(stderr, "%s: OpenSSL error(%lu) %s (%s:%d): %s %x", logkey, err, buf, file?file:"", line, (data && (flags & ERR_TXT_STRING)) ? data : "?", flags); } return n_err; } int mk_test_cert(int buflen, char* buf) { char* p; char* q; X509* sign_cert; q = unbase64_raw(cert_b64, cert_b64+sizeof(cert_b64)-1, p=buf, std_index_64); if (!d2i_X509(&sign_cert, &p, q-p) || !sign_cert) { report_openssl_error("DER decoding of X509 certificate"); return 0; } return 1; } int main(int argc, char** argv) { int x; char buf[4096]; OpenSSL_add_all_algorithms(); x = mk_test_cert(sizeof(buf), buf); if (x) printf("%s", buf); return x?0:1; } /* EOF */ ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
