Bug Summary

File:src/lib/libcrypto/asn1/a_string.c
Warning:line 373, column 16
Array access (from variable 's') results in a null pointer dereference

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name a_string.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/lib/libcrypto/obj -resource-dir /usr/local/lib/clang/13.0.0 -D LIBRESSL_INTERNAL -D LIBRESSL_CRYPTO_INTERNAL -D DSO_DLFCN -D HAVE_DLFCN_H -D HAVE_FUNOPEN -D OPENSSL_NO_HW_PADLOCK -I /usr/src/lib/libcrypto -I /usr/src/lib/libcrypto/asn1 -I /usr/src/lib/libcrypto/bio -I /usr/src/lib/libcrypto/bn -I /usr/src/lib/libcrypto/bytestring -I /usr/src/lib/libcrypto/dh -I /usr/src/lib/libcrypto/dsa -I /usr/src/lib/libcrypto/ec -I /usr/src/lib/libcrypto/ecdh -I /usr/src/lib/libcrypto/ecdsa -I /usr/src/lib/libcrypto/evp -I /usr/src/lib/libcrypto/hmac -I /usr/src/lib/libcrypto/modes -I /usr/src/lib/libcrypto/ocsp -I /usr/src/lib/libcrypto/rsa -I /usr/src/lib/libcrypto/x509 -I /usr/src/lib/libcrypto/obj -D AES_ASM -D BSAES_ASM -D VPAES_ASM -D OPENSSL_IA32_SSE2 -D RSA_ASM -D OPENSSL_BN_ASM_MONT -D OPENSSL_BN_ASM_MONT5 -D OPENSSL_BN_ASM_GF2m -D MD5_ASM -D GHASH_ASM -D RC4_MD5_ASM -D SHA1_ASM -D SHA256_ASM -D SHA512_ASM -D WHIRLPOOL_ASM -D OPENSSL_CPUID_OBJ -D PIC -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/lib/libcrypto/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/lib/libcrypto/asn1/a_string.c
1/* $OpenBSD: a_string.c,v 1.4 2021/12/25 13:17:48 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59#include <stdio.h>
60#include <string.h>
61
62#include <openssl/asn1.h>
63#include <openssl/buffer.h>
64#include <openssl/err.h>
65
66#include "asn1_locl.h"
67
68ASN1_STRING *
69ASN1_STRING_new(void)
70{
71 return (ASN1_STRING_type_new(V_ASN1_OCTET_STRING4));
72}
73
74ASN1_STRING *
75ASN1_STRING_type_new(int type)
76{
77 ASN1_STRING *a;
78
79 if ((a = calloc(1, sizeof(ASN1_STRING))) == NULL((void*)0)) {
80 ASN1error(ERR_R_MALLOC_FAILURE)ERR_put_error(13,(0xfff),((1|64)),"/usr/src/lib/libcrypto/asn1/a_string.c"
,80);
81 return NULL((void*)0);
82 }
83 a->type = type;
84
85 return a;
86}
87
88void
89ASN1_STRING_free(ASN1_STRING *a)
90{
91 if (a == NULL((void*)0))
92 return;
93 if (a->data != NULL((void*)0) && !(a->flags & ASN1_STRING_FLAG_NDEF0x010))
94 freezero(a->data, a->length);
95 free(a);
96}
97
98int
99ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
100{
101 int cmp;
102
103 if (a == NULL((void*)0) || b == NULL((void*)0))
104 return -1;
105 if ((cmp = (a->length - b->length)) != 0)
106 return cmp;
107 if ((cmp = memcmp(a->data, b->data, a->length)) != 0)
108 return cmp;
109
110 return (a->type - b->type);
111}
112
113int
114ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str)
115{
116 if (str == NULL((void*)0))
117 return 0;
118 if (!ASN1_STRING_set(dst, str->data, str->length))
119 return 0;
120 dst->type = str->type;
121 dst->flags = str->flags;
122 return 1;
123}
124
125ASN1_STRING *
126ASN1_STRING_dup(const ASN1_STRING *str)
127{
128 ASN1_STRING *ret;
129
130 if (!str)
131 return NULL((void*)0);
132 ret = ASN1_STRING_new();
133 if (!ret)
134 return NULL((void*)0);
135 if (!ASN1_STRING_copy(ret, str)) {
136 ASN1_STRING_free(ret);
137 return NULL((void*)0);
138 }
139 return ret;
140}
141
142int
143ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
144{
145 const char *data = _data;
146
147 if (len < 0) {
148 if (data == NULL((void*)0))
149 return (0);
150 else
151 len = strlen(data);
152 }
153 if ((str->length < len) || (str->data == NULL((void*)0))) {
154 unsigned char *tmp;
155 tmp = realloc(str->data, len + 1);
156 if (tmp == NULL((void*)0)) {
157 ASN1error(ERR_R_MALLOC_FAILURE)ERR_put_error(13,(0xfff),((1|64)),"/usr/src/lib/libcrypto/asn1/a_string.c"
,157);
158 return (0);
159 }
160 str->data = tmp;
161 }
162 str->length = len;
163 if (data != NULL((void*)0)) {
164 memmove(str->data, data, len);
165 }
166 str->data[str->length] = '\0';
167 return (1);
168}
169
170void
171ASN1_STRING_set0(ASN1_STRING *str, void *data, int len)
172{
173 freezero(str->data, str->length);
174 str->data = data;
175 str->length = len;
176}
177
178void
179asn1_add_error(const unsigned char *address, int offset)
180{
181 ERR_asprintf_error_data("offset=%d", offset);
182}
183
184int
185ASN1_STRING_length(const ASN1_STRING *x)
186{
187 return (x->length);
188}
189
190void
191ASN1_STRING_length_set(ASN1_STRING *x, int len)
192{
193 x->length = len;
194}
195
196int
197ASN1_STRING_type(const ASN1_STRING *x)
198{
199 return (x->type);
200}
201
202unsigned char *
203ASN1_STRING_data(ASN1_STRING *x)
204{
205 return (x->data);
206}
207
208const unsigned char *
209ASN1_STRING_get0_data(const ASN1_STRING *x)
210{
211 return (x->data);
212}
213
214int
215ASN1_STRING_print(BIO *bp, const ASN1_STRING *v)
216{
217 int i, n;
218 char buf[80];
219 const char *p;
220
221 if (v == NULL((void*)0))
222 return (0);
223 n = 0;
224 p = (const char *)v->data;
225 for (i = 0; i < v->length; i++) {
226 if ((p[i] > '~') || ((p[i] < ' ') &&
227 (p[i] != '\n') && (p[i] != '\r')))
228 buf[n] = '.';
229 else
230 buf[n] = p[i];
231 n++;
232 if (n >= 80) {
233 if (BIO_write(bp, buf, n) <= 0)
234 return (0);
235 n = 0;
236 }
237 }
238 if (n > 0)
239 if (BIO_write(bp, buf, n) <= 0)
240 return (0);
241 return (1);
242}
243
244/*
245 * Utility function: convert any string type to UTF8, returns number of bytes
246 * in output string or a negative error code
247 */
248int
249ASN1_STRING_to_UTF8(unsigned char **out, const ASN1_STRING *in)
250{
251 ASN1_STRING stmp, *str = &stmp;
252 int mbflag, ret;
253
254 if (!in)
255 return -1;
256
257 if ((mbflag = asn1_tag2charwidth(in->type)) == -1)
258 return -1;
259 mbflag |= MBSTRING_FLAG0x1000;
260
261 stmp.data = NULL((void*)0);
262 stmp.length = 0;
263 ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag,
264 B_ASN1_UTF8STRING0x2000);
265 if (ret < 0)
266 return ret;
267 *out = stmp.data;
268 return stmp.length;
269}
270
271int
272i2a_ASN1_STRING(BIO *bp, const ASN1_STRING *a, int type)
273{
274 int i, n = 0;
275 static const char h[] = "0123456789ABCDEF";
276 char buf[2];
277
278 if (a == NULL((void*)0))
279 return (0);
280
281 if (a->length == 0) {
282 if (BIO_write(bp, "0", 1) != 1)
283 goto err;
284 n = 1;
285 } else {
286 for (i = 0; i < a->length; i++) {
287 if ((i != 0) && (i % 35 == 0)) {
288 if (BIO_write(bp, "\\\n", 2) != 2)
289 goto err;
290 n += 2;
291 }
292 buf[0] = h[((unsigned char)a->data[i] >> 4) & 0x0f];
293 buf[1] = h[((unsigned char)a->data[i]) & 0x0f];
294 if (BIO_write(bp, buf, 2) != 2)
295 goto err;
296 n += 2;
297 }
298 }
299 return (n);
300
301 err:
302 return (-1);
303}
304
305int
306a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size)
307{
308 int ret = 0;
309 int i, j, k, m, n, again, bufsize;
310 unsigned char *s = NULL((void*)0), *sp;
1
's' initialized to a null pointer value
→
311 unsigned char *bufp;
312 int first = 1;
313 size_t num = 0, slen = 0;
314
315 bufsize = BIO_gets(bp, buf, size);
316 for (;;) {
2
←
Loop condition is true. Entering loop body
→
21
←
Loop condition is true. Entering loop body
→
317 if (bufsize < 1) {
3
←
Assuming 'bufsize' is >= 1
→
4
←
Taking false branch
→
22
←
Assuming 'bufsize' is >= 1
→
23
←
Taking false branch
→
318 if (first)
319 break;
320 else
321 goto err_sl;
322 }
323 first = 0;
324
325 i = bufsize;
326 if (buf[i-1] == '\n')
5
←
Assuming the condition is false
→
6
←
Taking false branch
→
24
←
Assuming the condition is false
→
25
←
Taking false branch
→
327 buf[--i] = '\0';
328 if (i
6.1
'i' is not equal to 0
25.1
'i' is not equal to 0
 == 0)
7
←
Taking false branch
→
26
←
Taking false branch
→
329 goto err_sl;
330 if (buf[i-1] == '\r')
8
←
Assuming the condition is false
→
9
←
Taking false branch
→
27
←
Assuming the condition is false
→
28
←
Taking false branch
→
331 buf[--i] = '\0';
332 if (i
9.1
'i' is not equal to 0
28.1
'i' is not equal to 0
 == 0)
10
←
Taking false branch
→
29
←
Taking false branch
→
333 goto err_sl;
334 if (buf[i - 1] == '\\') {
11
←
Assuming the condition is true
→
12
←
Taking true branch
→
30
←
Assuming the condition is false
→
31
←
Taking false branch
→
335 i--;
336 again = 1;
337 } else
338 again = 0;
339 buf[i] = '\0';
340 if (i < 2)
13
←
Assuming 'i' is >= 2
→
14
←
Taking false branch
→
32
←
Assuming 'i' is >= 2
→
33
←
Taking false branch
→
341 goto err_sl;
342
343 bufp = (unsigned char *)buf;
344
345 k = 0;
346 if (i % 2 != 0) {
15
←
Assuming the condition is false
→
16
←
Taking false branch
→
34
←
Assuming the condition is false
→
35
←
Taking false branch
→
347 ASN1error(ASN1_R_ODD_NUMBER_OF_CHARS)ERR_put_error(13,(0xfff),(145),"/usr/src/lib/libcrypto/asn1/a_string.c"
,347);
348 goto err;
349 }
350 i /= 2;
351 if (num + i > slen) {
17
←
Assuming the condition is false
→
18
←
Taking false branch
→
36
←
Assuming the condition is false
→
37
←
Taking false branch
→
352 sp = realloc(s, num + i);
353 if (sp == NULL((void*)0)) {
354 ASN1error(ERR_R_MALLOC_FAILURE)ERR_put_error(13,(0xfff),((1|64)),"/usr/src/lib/libcrypto/asn1/a_string.c"
,354);
355 goto err;
356 }
357 s = sp;
358 slen = num + i;
359 }
360 for (j = 0; j
18.1
'j' is >= 'i'
 < i; j++, k += 2) {
19
←
Loop condition is false. Execution continues on line 377
→
38
←
Assuming 'j' is < 'i'
→
39
←
Loop condition is true. Entering loop body
→
361 for (n = 0; n < 2; n++) {
40
←
Loop condition is true. Entering loop body
→
362 m = bufp[k + n];
363 if ((m >= '0') && (m <= '9'))
41
←
Assuming the condition is true
→
42
←
Assuming the condition is true
→
43
←
Taking true branch
→
364 m -= '0';
365 else if ((m >= 'a') && (m <= 'f'))
366 m = m - 'a' + 10;
367 else if ((m >= 'A') && (m <= 'F'))
368 m = m - 'A' + 10;
369 else {
370 ASN1error(ASN1_R_NON_HEX_CHARACTERS)ERR_put_error(13,(0xfff),(141),"/usr/src/lib/libcrypto/asn1/a_string.c"
,370);
371 goto err;
372 }
373 s[num + j] <<= 4;
44
←
Array access (from variable 's') results in a null pointer dereference
374 s[num + j] |= m;
375 }
376 }
377 num += i;
378 if (again
19.1
'again' is 1
)
20
←
Taking true branch
→
379 bufsize = BIO_gets(bp, buf, size);
380 else
381 break;
382 }
383 bs->length = num;
384 bs->data = s;
385 return (1);
386
387 err_sl:
388 ASN1error(ASN1_R_SHORT_LINE)ERR_put_error(13,(0xfff),(150),"/usr/src/lib/libcrypto/asn1/a_string.c"
,388);
389 err:
390 free(s);
391 return (ret);
392}