Skip to content

Commit 5c52ccb

Browse files
olszomalolszomal
committed
Improve hex key ID parsing, CID 459657, 459658
1 parent 62fa4ee commit 5c52ccb

File tree

2 files changed

+52
-48
lines changed

2 files changed

+52
-48
lines changed

‎examples/eckeygen.c‎

Lines changed: 26 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -47,21 +47,14 @@ static void error_queue(const char *name)
4747
}
4848
}
4949

50-
static int parse_hex_key_id(const char *input, unsigned char **output, size_t *size)
50+
static int hex_to_bytes(const char *hex, unsigned char *out, size_t out_len)
5151
{
52-
size_t i, len = strlen(input);
52+
size_t i;
5353

54-
if (len % 2 != 0) {
55-
return -1;
56-
}
57-
*size = len / 2;
58-
*output = OPENSSL_malloc(*size);
59-
if (!*output) {
60-
return -1;
61-
}
62-
memset(*output, 0, *size);
63-
for (i = 0; i < *size; i++) {
64-
sscanf(input + (i * 2), "%2hhx", *output + i);
54+
for (i = 0; i < out_len; i++) {
55+
if (sscanf(hex + (i * 2), "%2hhx", &out[i]) != 1) {
56+
return -1;
57+
}
6558
}
6659
return 0;
6760
}
@@ -87,7 +80,8 @@ int main(int argc, char *argv[])
8780
PKCS11_KEY *keys;
8881
unsigned int nslots, nkeys;
8982
unsigned char *key_id = NULL;
90-
size_t key_id_len = 0;
83+
size_t len, key_id_len;
84+
const char *key_id_str;
9185
int rc = 0;
9286
PKCS11_params params = {.sensitive = 1, .extractable = 0};
9387
PKCS11_EC_KGEN ec = {.curve = "P-256"};
@@ -97,23 +91,30 @@ int main(int argc, char *argv[])
9791
fprintf(stderr, "usage: %s [module] [TOKEN] [KEY-LABEL] [KEY-ID] [PIN]\n", argv[0]);
9892
return 1;
9993
}
94+
key_id_str = argv[4];
95+
len = strlen(key_id_str);
96+
CHECK_ERR(len % 2 != 0, "Invalid key ID format: odd length", 1);
97+
98+
/* key_id_str is a null-terminated string, but key_id is not */
99+
key_id_len = len / 2;
100+
key_id = OPENSSL_malloc(key_id_len);
101+
CHECK_ERR(!key_id, "Memory allocation failed for key ID", 2);
100102

101-
key_id_len = strlen(argv[4]);
102-
rc = parse_hex_key_id(argv[4], &key_id, &key_id_len);
103-
CHECK_ERR(rc < 0, "Invalid key ID format", 1);
103+
rc = hex_to_bytes(key_id_str, key_id, key_id_len);
104+
CHECK_ERR(rc != 0, "Invalid hex digit in key ID", 3);
104105

105106
ctx = PKCS11_CTX_new();
106107
error_queue("PKCS11_CTX_new");
107108

108109
/* load PKCS#11 module */
109110
rc = PKCS11_CTX_load(ctx, argv[1]);
110111
error_queue("PKCS11_CTX_load");
111-
CHECK_ERR(rc < 0, "loading PKCS#11 module failed", 2);
112+
CHECK_ERR(rc < 0, "loading PKCS#11 module failed", 4);
112113

113114
/* get information on all slots */
114115
rc = PKCS11_enumerate_slots(ctx, &slots, &nslots);
115116
error_queue("PKCS11_enumerate_slots");
116-
CHECK_ERR(rc < 0, "no slots available", 3);
117+
CHECK_ERR(rc < 0, "no slots available", 5);
117118

118119
slot = PKCS11_find_token(ctx, slots, nslots);
119120
error_queue("PKCS11_find_token");
@@ -123,7 +124,7 @@ int main(int argc, char *argv[])
123124
break;
124125
slot = PKCS11_find_next_token(ctx, slots, nslots, slot);
125126
};
126-
CHECK_ERR(!slot || !slot->token, "no token available", 4);
127+
CHECK_ERR(!slot || !slot->token, "no token available", 6);
127128

128129
printf("Found token:\n");
129130
printf("Slot manufacturer......: %s\n", slot->manufacturer);
@@ -133,27 +134,28 @@ int main(int argc, char *argv[])
133134

134135
rc = PKCS11_login(slot, 0, argv[5]);
135136
error_queue("PKCS11_login");
136-
CHECK_ERR(rc < 0, "PKCS11_login failed", 5);
137+
CHECK_ERR(rc < 0, "PKCS11_login failed", 7);
137138

138139
eckg.type = EVP_PKEY_EC;
139140
eckg.kgen.ec = &ec;
140141
eckg.token_label = argv[2];
141142
eckg.key_label = argv[3];
143+
/* key_id is a raw binary buffer of length key_id_len */
142144
eckg.key_id = (const unsigned char *)key_id;
143145
eckg.id_len = key_id_len;
144146
eckg.key_params = &params;
145147

146148
rc = PKCS11_keygen(slot->token, &eckg);
147149
error_queue("PKCS11_keygen");
148-
CHECK_ERR(rc < 0, "Failed to generate a key pair on the token", 6);
150+
CHECK_ERR(rc < 0, "Failed to generate a key pair on the token", 8);
149151

150152
printf("\nEC keys generated\n");
151153

152154
/* get private keys */
153155
rc = PKCS11_enumerate_keys(slot->token, &keys, &nkeys);
154156
error_queue("PKCS11_enumerate_keys");
155-
CHECK_ERR(rc < 0, "PKCS11_enumerate_keys failed", 7);
156-
CHECK_ERR(nkeys == 0, "No private keys found", 8);
157+
CHECK_ERR(rc < 0, "PKCS11_enumerate_keys failed", 9);
158+
CHECK_ERR(nkeys == 0, "No private keys found", 10);
157159
list_keys("Private keys", keys, nkeys);
158160

159161
end:

‎examples/rsakeygen.c‎

Lines changed: 26 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -47,21 +47,14 @@ static void error_queue(const char *name)
4747
}
4848
}
4949

50-
static int parse_hex_key_id(const char *input, unsigned char **output, size_t *size)
50+
static int hex_to_bytes(const char *hex, unsigned char *out, size_t out_len)
5151
{
52-
size_t i, len = strlen(input);
52+
size_t i;
5353

54-
if (len % 2 != 0) {
55-
return -1;
56-
}
57-
*size = len / 2;
58-
*output = OPENSSL_malloc(*size);
59-
if (!*output) {
60-
return -1;
61-
}
62-
memset(*output, 0, *size);
63-
for (i = 0; i < *size; i++) {
64-
sscanf(input + (i * 2), "%2hhx", *output + i);
54+
for (i = 0; i < out_len; i++) {
55+
if (sscanf(hex + (i * 2), "%2hhx", &out[i]) != 1) {
56+
return -1;
57+
}
6558
}
6659
return 0;
6760
}
@@ -87,7 +80,8 @@ int main(int argc, char *argv[])
8780
PKCS11_KEY *keys;
8881
unsigned int nslots, nkeys;
8982
unsigned char *key_id = NULL;
90-
size_t key_id_len = 0;
83+
const char *key_id_str;
84+
size_t len, key_id_len;
9185
int rc = 0;
9286
PKCS11_params params = {.sensitive = 1, .extractable = 0};
9387
PKCS11_RSA_KGEN rsa = {.bits = 2048};
@@ -97,23 +91,30 @@ int main(int argc, char *argv[])
9791
fprintf(stderr, "usage: %s [module] [TOKEN] [KEY-LABEL] [KEY-ID] [PIN]\n", argv[0]);
9892
return 1;
9993
}
94+
key_id_str = argv[4];
95+
len = strlen(key_id_str);
96+
CHECK_ERR(len % 2 != 0, "Invalid key ID format: odd length", 1);
97+
98+
/* key_id_str is a null-terminated string, but key_id is not */
99+
key_id_len = len / 2;
100+
key_id = OPENSSL_malloc(key_id_len);
101+
CHECK_ERR(!key_id, "Memory allocation failed for key ID", 2);
100102

101-
key_id_len = strlen(argv[4]);
102-
rc = parse_hex_key_id(argv[4], &key_id, &key_id_len);
103-
CHECK_ERR(rc < 0, "Invalid key ID format", 1);
103+
rc = hex_to_bytes(key_id_str, key_id, key_id_len);
104+
CHECK_ERR(rc != 0, "Invalid hex digit in key ID", 3);
104105

105106
ctx = PKCS11_CTX_new();
106107
error_queue("PKCS11_CTX_new");
107108

108109
/* load PKCS#11 module */
109110
rc = PKCS11_CTX_load(ctx, argv[1]);
110111
error_queue("PKCS11_CTX_load");
111-
CHECK_ERR(rc < 0, "loading PKCS#11 module failed", 2);
112+
CHECK_ERR(rc < 0, "loading PKCS#11 module failed", 4);
112113

113114
/* get information on all slots */
114115
rc = PKCS11_enumerate_slots(ctx, &slots, &nslots);
115116
error_queue("PKCS11_enumerate_slots");
116-
CHECK_ERR(rc < 0, "no slots available", 3);
117+
CHECK_ERR(rc < 0, "no slots available", 5);
117118

118119
slot = PKCS11_find_token(ctx, slots, nslots);
119120
error_queue("PKCS11_find_token");
@@ -123,7 +124,7 @@ int main(int argc, char *argv[])
123124
break;
124125
slot = PKCS11_find_next_token(ctx, slots, nslots, slot);
125126
};
126-
CHECK_ERR(!slot || !slot->token, "no token available", 4);
127+
CHECK_ERR(!slot || !slot->token, "no token available", 6);
127128

128129
printf("Found token:\n");
129130
printf("Slot manufacturer......: %s\n", slot->manufacturer);
@@ -133,27 +134,28 @@ int main(int argc, char *argv[])
133134

134135
rc = PKCS11_login(slot, 0, argv[5]);
135136
error_queue("PKCS11_login");
136-
CHECK_ERR(rc < 0, "PKCS11_login failed", 5);
137+
CHECK_ERR(rc < 0, "PKCS11_login failed", 7);
137138

138139
rsakg.type = EVP_PKEY_RSA;
139140
rsakg.kgen.rsa = &rsa;
140141
rsakg.token_label = argv[2];
141142
rsakg.key_label = argv[3];
143+
/* key_id is a raw binary buffer of length key_id_len */
142144
rsakg.key_id = (const unsigned char *)key_id;
143145
rsakg.id_len = key_id_len;
144146
rsakg.key_params = &params;
145147

146148
rc = PKCS11_keygen(slot->token, &rsakg);
147149
error_queue("PKCS11_keygen");
148-
CHECK_ERR(rc < 0, "Failed to generate a key pair on the token", 6);
150+
CHECK_ERR(rc < 0, "Failed to generate a key pair on the token", 8);
149151

150152
printf("\nRSA keys generated\n");
151153

152154
/* get private keys */
153155
rc = PKCS11_enumerate_keys(slot->token, &keys, &nkeys);
154156
error_queue("PKCS11_enumerate_keys");
155-
CHECK_ERR(rc < 0, "PKCS11_enumerate_keys failed", 7);
156-
CHECK_ERR(nkeys == 0, "No private keys found", 8);
157+
CHECK_ERR(rc < 0, "PKCS11_enumerate_keys failed", 9);
158+
CHECK_ERR(nkeys == 0, "No private keys found", 10);
157159
list_keys("Private keys", keys, nkeys);
158160

159161
end:

0 commit comments

Comments
 (0)