oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

asn1: Template CHOICE element 0 bug

Browse Source 
While we no longer have a decoder CHOICE element 0 bug, we did still
have one encode and copy and free that was leading to a memory leak (and
_save trashing) prior to the fix for

    asn1: Fix 1-byte leaks in der_copy_octet_string()

This commit fixes that.
This commit is contained in:
Nicolas Williams
2022-11-30 11:22:22 -06:00
parent 50eb3bc245
commit f0feaab938
2 changed files with 92 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
lib/asn1/check-gen.c
View File

@@ -655,6 +655,12 @@ test_cert(void)
size_t i;
int ret;
memset(&c, 0, sizeof(c));
ret = copy_Certificate(&c, &c2);
if (ret)
return ret;
free_Certificate(&c2);
for (i = 0; i < sizeof(certs)/sizeof(certs[0]); i++) {
ret = decode_Certificate((unsigned char *)certs[i].cert,
@@ -1114,6 +1120,57 @@ test_decorated(void)
return 0;
}
static int
test_extensible_choice(void)
{
PA_FX_FAST_REQUEST r, r2;
size_t len, size;
void *ptr;
int ret;
memset(&r, 0, sizeof(r));
ret = copy_PA_FX_FAST_REQUEST(&r, &r2);
if (ret)
return ret;
free_PA_FX_FAST_REQUEST(&r2);
r.element = 0;
r.u.asn1_ellipsis.data = "hello";
r.u.asn1_ellipsis.length = sizeof("hello") - 1;
ret = copy_PA_FX_FAST_REQUEST(&r, &r2);
if (ret)
errx(1, "Out of memory");
if (r2.element != 0)
errx(1, "Extensible CHOICE copy failure to set discriminant to 0");
if (r2.u.asn1_ellipsis.length != r.u.asn1_ellipsis.length)
errx(1, "Extensible CHOICE copy failure to copy extension");
if (memcmp(r.u.asn1_ellipsis.data, r2.u.asn1_ellipsis.data,
r.u.asn1_ellipsis.length) != 0)
errx(1, "Extensible CHOICE copy failure to copy extension (2)");
free_PA_FX_FAST_REQUEST(&r2);
ASN1_MALLOC_ENCODE(PA_FX_FAST_REQUEST, ptr, len, &r, &size, ret);
if (ret || len != size)
errx(1, "Extensible CHOICE encoding failure");
ret = decode_PA_FX_FAST_REQUEST(ptr, len, &r2, &size);
if (ret || len != size)
errx(1, "Extensible CHOICE decoding failure");
if (r2.element != 0)
errx(1, "Extensible CHOICE decode failure to set discriminant to 0");
if (r2.u.asn1_ellipsis.length != r.u.asn1_ellipsis.length)
errx(1, "Extensible CHOICE decode failure to copy extension");
if (memcmp(r.u.asn1_ellipsis.data, r2.u.asn1_ellipsis.data,
r.u.asn1_ellipsis.length) != 0)
errx(1, "Extensible CHOICE decode failure to copy extension (2)");
free_PA_FX_FAST_REQUEST(&r2);
free(ptr);
return 0;
}
static int
test_decorated_choice(void)
{
@@ -2674,6 +2731,8 @@ main(int argc, char **argv)
DO_ONE(test_default);
DO_ONE(test_extensible_choice);
DO_ONE(test_decorated_choice);
DO_ONE(test_decorated);