Skip to content

Commit 5f3ab98

Browse files
smuellerDDsmuellerDD
committed
PKCS7: centralize memory management more
Signed-off-by: Stephan Mueller <smueller@chronox.de>
1 parent ff8351a commit 5f3ab98

File tree

8 files changed

+97
-70
lines changed

8 files changed

+97
-70
lines changed

‎apps/src/lc_x509_generator_print.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -271,7 +271,7 @@ int print_x509_cert(const struct lc_x509_certificate *x509)
271271
int print_pkcs7_data(const struct lc_pkcs7_message *pkcs7_msg)
272272
{
273273
struct lc_x509_certificate *cert = pkcs7_msg->certs;
274-
struct lc_pkcs7_signed_info *sinfos = pkcs7_msg->signed_infos;
274+
struct lc_pkcs7_signed_info *sinfos = pkcs7_msg->list_head_signed_infos;
275275
const char *hash_name;
276276
int ret = 0;
277277

‎asn1/api/lc_pkcs7_common.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,8 @@ struct lc_pkcs7_message {
8787
/*
8888
* Signed information
8989
*/
90-
struct lc_pkcs7_signed_info *signed_infos;
90+
struct lc_pkcs7_signed_info *curr_signed_infos;
91+
struct lc_pkcs7_signed_info *list_head_signed_infos;
9192
struct lc_pkcs7_signed_info **list_tail_signed_infos;
9293
uint8_t version; /* Version of cert (1 -> PKCS#7 or CMS; 3 -> CMS) */
9394

‎asn1/src/pkcs7_generator.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1050,13 +1050,14 @@ static inline int pkcs7_initialize_ctx(struct pkcs7_generate_context *ctx,
10501050
int ret = 0;
10511051

10521052
CKNULL(pkcs7->certs, -EINVAL);
1053-
CKNULL(pkcs7->signed_infos, -EINVAL);
1053+
CKNULL(pkcs7->list_head_signed_infos, -EINVAL);
10541054

10551055
ctx->pkcs7 = pkcs7;
10561056
ctx->current_x509 = pkcs7->certs;
1057-
ctx->current_sinfo = pkcs7->signed_infos;
1057+
ctx->current_sinfo = pkcs7->list_head_signed_infos;
10581058

1059-
for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
1059+
for (sinfo = pkcs7->list_head_signed_infos; sinfo;
1060+
sinfo = sinfo->next) {
10601061
const struct lc_hash *hash;
10611062

10621063
if (!ctx->authattr_hash) {

‎asn1/src/pkcs7_generator_set_data.c‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -108,12 +108,9 @@ LC_INTERFACE_FUNCTION(int, lc_pkcs7_set_signer, struct lc_pkcs7_message *pkcs7,
108108
CKINT(pkcs7_add_cert(pkcs7, sinfo->signer));
109109

110110
/* Now add the filled signed info to the PKCS7 */
111-
CKINT(pkcs7_sinfo_add(pkcs7, sinfo));
112-
113-
sinfo = NULL;
111+
CKINT(pkcs7_sinfo_add(pkcs7));
114112

115113
out:
116-
pkcs7_sinfo_free(pkcs7, sinfo);
117114
return ret;
118115
}
119116

‎asn1/src/pkcs7_internal.h‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@ extern "C" {
2929

3030
struct pkcs7_parse_context {
3131
struct lc_pkcs7_message *msg; /* Message being constructed */
32-
struct lc_pkcs7_signed_info *sinfo; /* SignedInfo being constructed */
33-
struct lc_pkcs7_signed_info **ppsinfo; /* linked list of signer info */
32+
//struct lc_pkcs7_signed_info *sinfo; /* SignedInfo being constructed */
33+
//struct lc_pkcs7_signed_info **ppsinfo; /* linked list of signer info */
3434
struct lc_x509_certificate *certs; /* Certificate cache */
3535
struct lc_x509_certificate **ppcerts; /* linked list of certs */
3636
const uint8_t *data; /* Start of data */
@@ -56,12 +56,10 @@ int pkcs7_find_asymmetric_key(const struct lc_x509_certificate **anchor_cert,
5656
const struct lc_asymmetric_key_id *auth0,
5757
const struct lc_asymmetric_key_id *auth1);
5858

59-
int pkcs7_sinfo_add(struct lc_pkcs7_message *pkcs7,
60-
struct lc_pkcs7_signed_info *sinfo);
59+
int pkcs7_sinfo_add(struct lc_pkcs7_message *pkcs7);
6160
int pkcs7_sinfo_get(struct lc_pkcs7_signed_info **sinfo,
6261
struct lc_pkcs7_message *pkcs7);
63-
void pkcs7_sinfo_free(struct lc_pkcs7_message *pkcs7,
64-
struct lc_pkcs7_signed_info *sinfo);
62+
void pkcs7_sinfo_free(struct lc_pkcs7_message *pkcs7);
6563

6664
#ifdef __cplusplus
6765
}

‎asn1/src/pkcs7_memory.c‎

Lines changed: 27 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -21,49 +21,52 @@
2121
#include "lc_memory_support.h"
2222
#include "pkcs7_internal.h"
2323

24-
void pkcs7_sinfo_free(struct lc_pkcs7_message *pkcs7,
25-
struct lc_pkcs7_signed_info *sinfo)
24+
void pkcs7_sinfo_free(struct lc_pkcs7_message *pkcs7)
2625
{
27-
(void)pkcs7;
28-
if (!sinfo)
29-
return;
30-
public_key_signature_clear(&sinfo->sig);
31-
lc_free(sinfo);
26+
struct lc_pkcs7_signed_info *sinfo;
27+
28+
while (pkcs7->list_head_signed_infos) {
29+
sinfo = pkcs7->list_head_signed_infos;
30+
pkcs7->list_head_signed_infos = sinfo->next;
31+
public_key_signature_clear(&sinfo->sig);
32+
lc_free(sinfo);
33+
}
34+
35+
if (pkcs7->curr_signed_infos) {
36+
sinfo = pkcs7->curr_signed_infos;
37+
public_key_signature_clear(&sinfo->sig);
38+
lc_free(sinfo);
39+
}
3240
}
3341

34-
int pkcs7_sinfo_add(struct lc_pkcs7_message *pkcs7,
35-
struct lc_pkcs7_signed_info *sinfo)
42+
int pkcs7_sinfo_add(struct lc_pkcs7_message *pkcs7)
3643
{
37-
if (!pkcs7->signed_infos) {
38-
pkcs7->signed_infos = sinfo;
44+
if (!pkcs7->list_head_signed_infos) {
45+
pkcs7->list_head_signed_infos = pkcs7->curr_signed_infos;
3946
} else {
40-
*pkcs7->list_tail_signed_infos = sinfo;
47+
*pkcs7->list_tail_signed_infos = pkcs7->curr_signed_infos;
4148
}
4249

43-
pkcs7->list_tail_signed_infos = &sinfo->next;
50+
pkcs7->list_tail_signed_infos = &pkcs7->curr_signed_infos->next;
51+
pkcs7->curr_signed_infos = NULL;
4452

4553
return 0;
4654
}
4755

4856
int pkcs7_sinfo_get(struct lc_pkcs7_signed_info **sinfo,
4957
struct lc_pkcs7_message *pkcs7)
5058
{
51-
struct lc_pkcs7_signed_info *sinfo_tmp = NULL;
52-
int ret;
53-
54-
(void)pkcs7;
59+
int ret = 0;
5560

5661
CKNULL(sinfo, -EINVAL);
5762

58-
CKINT(lc_alloc_aligned((void **)&sinfo_tmp, 8,
59-
sizeof(struct lc_pkcs7_signed_info)));
60-
61-
/* Return the signer info */
62-
*sinfo = sinfo_tmp;
63+
if (!pkcs7->curr_signed_infos) {
64+
CKINT(lc_alloc_aligned((void **)&pkcs7->curr_signed_infos, 8,
65+
sizeof(struct lc_pkcs7_signed_info)));
66+
}
6367

64-
sinfo_tmp = NULL;
68+
*sinfo = pkcs7->curr_signed_infos;
6569

6670
out:
67-
lc_free(sinfo_tmp);
6871
return ret;
6972
}

‎asn1/src/pkcs7_parser.c‎

Lines changed: 55 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ static int pkcs7_check_authattrs(struct lc_pkcs7_message *msg)
9494
struct lc_pkcs7_signed_info *sinfo;
9595
unsigned int want = 0;
9696

97-
sinfo = msg->signed_infos;
97+
sinfo = msg->list_head_signed_infos;
9898
if (!sinfo)
9999
goto inconsistent;
100100

@@ -208,15 +208,23 @@ int pkcs7_sig_note_digest_algo(void *context, size_t hdrlen, unsigned char tag,
208208
const uint8_t *value, size_t vlen)
209209
{
210210
struct pkcs7_parse_context *ctx = context;
211-
struct lc_pkcs7_signed_info *sinfo = ctx->sinfo;
212-
struct lc_public_key_signature *sig = &sinfo->sig;
211+
struct lc_pkcs7_message *pkcs7 = ctx->msg;
212+
struct lc_pkcs7_signed_info *sinfo;
213+
struct lc_public_key_signature *sig;
214+
int ret;
213215

214216
(void)hdrlen;
215217
(void)tag;
216218
(void)value;
217219
(void)vlen;
218220

219-
return lc_x509_oid_to_hash(ctx->last_oid, &sig->hash_algo);
221+
CKINT(pkcs7_sinfo_get(&sinfo, pkcs7));
222+
223+
sig = &sinfo->sig;
224+
CKINT(lc_x509_oid_to_hash(ctx->last_oid, &sig->hash_algo));
225+
226+
out:
227+
return ret;
220228
}
221229

222230
/*
@@ -226,15 +234,23 @@ int pkcs7_sig_note_pkey_algo(void *context, size_t hdrlen, unsigned char tag,
226234
const uint8_t *value, size_t vlen)
227235
{
228236
struct pkcs7_parse_context *ctx = context;
229-
struct lc_pkcs7_signed_info *sinfo = ctx->sinfo;
230-
struct lc_public_key_signature *sig = &sinfo->sig;
237+
struct lc_pkcs7_message *pkcs7 = ctx->msg;
238+
struct lc_pkcs7_signed_info *sinfo;
239+
struct lc_public_key_signature *sig;
240+
int ret;
231241

232242
(void)hdrlen;
233243
(void)tag;
234244
(void)value;
235245
(void)vlen;
236246

237-
return lc_x509_oid_to_sig_type(ctx->last_oid, &sig->pkey_algo);
247+
CKINT(pkcs7_sinfo_get(&sinfo, pkcs7));
248+
249+
sig = &sinfo->sig;
250+
CKINT(lc_x509_oid_to_sig_type(ctx->last_oid, &sig->pkey_algo));
251+
252+
out:
253+
return ret;
238254
}
239255

240256
/*
@@ -483,12 +499,16 @@ int pkcs7_sig_note_authenticated_attr(void *context, size_t hdrlen,
483499
size_t vlen)
484500
{
485501
struct pkcs7_parse_context *ctx = context;
486-
struct lc_pkcs7_signed_info *sinfo = ctx->sinfo;
502+
struct lc_pkcs7_message *pkcs7 = ctx->msg;
503+
struct lc_pkcs7_signed_info *sinfo;
487504
enum OID content_type;
505+
int ret;
488506

489507
printf_debug("AuthAttr: %02x %zu", tag, vlen);
490508
bin2print_debug(value, vlen, stdout, "");
491509

510+
CKINT(pkcs7_sinfo_get(&sinfo, pkcs7));
511+
492512
#pragma GCC diagnostic push
493513
#pragma GCC diagnostic ignored "-Wswitch-enum"
494514
switch (ctx->last_oid) {
@@ -565,6 +585,9 @@ int pkcs7_sig_note_authenticated_attr(void *context, size_t hdrlen,
565585
/* We permit max one item per AuthenticatedAttribute and no repeats */
566586
printf_debug("Repeated/multivalue AuthAttrs not permitted\n");
567587
return -EKEYREJECTED;
588+
589+
out:
590+
return ret;
568591
}
569592

570593
/*
@@ -575,10 +598,14 @@ int pkcs7_sig_note_set_of_authattrs(void *context, size_t hdrlen,
575598
size_t vlen)
576599
{
577600
struct pkcs7_parse_context *ctx = context;
578-
struct lc_pkcs7_signed_info *sinfo = ctx->sinfo;
601+
struct lc_pkcs7_message *pkcs7 = ctx->msg;
602+
struct lc_pkcs7_signed_info *sinfo;
603+
int ret;
579604

580605
(void)tag;
581606

607+
CKINT(pkcs7_sinfo_get(&sinfo, pkcs7));
608+
582609
if (!(sinfo->aa_set & sinfo_has_content_type) ||
583610
!(sinfo->aa_set & sinfo_has_message_digest)) {
584611
printf_debug("Missing required AuthAttr\n");
@@ -595,7 +622,8 @@ int pkcs7_sig_note_set_of_authattrs(void *context, size_t hdrlen,
595622
sinfo->authattrs = value - (hdrlen - 1);
596623
sinfo->authattrs_len = vlen + (hdrlen - 1);
597624

598-
return 0;
625+
out:
626+
return ret;
599627
}
600628

601629
/*
@@ -655,18 +683,24 @@ int pkcs7_sig_note_signature(void *context, size_t hdrlen, unsigned char tag,
655683
const uint8_t *value, size_t vlen)
656684
{
657685
struct pkcs7_parse_context *ctx = context;
686+
struct lc_pkcs7_message *pkcs7 = ctx->msg;
687+
struct lc_pkcs7_signed_info *sinfo;
688+
int ret;
658689

659690
(void)hdrlen;
660691
(void)tag;
661692

693+
CKINT(pkcs7_sinfo_get(&sinfo, pkcs7));
694+
662695
/* Do not allocate twice */
663-
if (ctx->sinfo->sig.s)
696+
if (sinfo->sig.s)
664697
return -EOVERFLOW;
665698

666-
ctx->sinfo->sig.s = value;
667-
ctx->sinfo->sig.s_size = vlen;
699+
sinfo->sig.s = value;
700+
sinfo->sig.s_size = vlen;
668701

669-
return 0;
702+
out:
703+
return ret;
670704
}
671705

672706
/*
@@ -677,19 +711,23 @@ int pkcs7_note_signed_info(void *context, size_t hdrlen, unsigned char tag,
677711
{
678712
struct pkcs7_parse_context *ctx = context;
679713
struct lc_pkcs7_message *pkcs7 = ctx->msg;
680-
struct lc_pkcs7_signed_info *sinfo = ctx->sinfo;
714+
struct lc_pkcs7_signed_info *sinfo;
681715
int ret;
682716

683717
(void)hdrlen;
684718
(void)tag;
685719
(void)value;
686720
(void)vlen;
687721

722+
CKINT(pkcs7_sinfo_get(&sinfo, pkcs7));
723+
688724
if (ctx->msg->data_type == OID_msIndirectData && !sinfo->authattrs) {
689725
printf_debug("Authenticode requires AuthAttrs\n");
690726
return -EBADMSG;
691727
}
692728

729+
CKINT(pkcs7_sinfo_get(&sinfo, pkcs7));
730+
693731
/* Generate cert issuer + serial number key ID */
694732
if (!ctx->expect_skid) {
695733
CKINT(asymmetric_key_generate_id(
@@ -708,10 +746,7 @@ int pkcs7_note_signed_info(void *context, size_t hdrlen, unsigned char tag,
708746
sinfo->index = ++ctx->sinfo_index;
709747

710748
/* Now add the filled signed info to the PKCS7 */
711-
CKINT(pkcs7_sinfo_add(pkcs7, sinfo));
712-
713-
CKINT(pkcs7_sinfo_get(&ctx->sinfo, pkcs7));
714-
749+
CKINT(pkcs7_sinfo_add(pkcs7));
715750

716751
out:
717752
return ret;
@@ -741,7 +776,6 @@ LC_INTERFACE_FUNCTION(void, lc_pkcs7_message_clear,
741776
struct lc_pkcs7_message *pkcs7)
742777
{
743778
struct lc_x509_certificate *cert;
744-
struct lc_pkcs7_signed_info *sinfo;
745779

746780
if (pkcs7) {
747781
while (pkcs7->certs) {
@@ -755,11 +789,7 @@ LC_INTERFACE_FUNCTION(void, lc_pkcs7_message_clear,
755789
pkcs7->crl = cert->next;
756790
lc_x509_cert_clear(cert);
757791
}
758-
while (pkcs7->signed_infos) {
759-
sinfo = pkcs7->signed_infos;
760-
pkcs7->signed_infos = sinfo->next;
761-
pkcs7_sinfo_free(pkcs7, sinfo);
762-
}
792+
pkcs7_sinfo_free(pkcs7);
763793

764794
lc_memset_secure(pkcs7, 0, sizeof(struct lc_pkcs7_message));
765795
}
@@ -777,13 +807,10 @@ LC_INTERFACE_FUNCTION(int, lc_pkcs7_message_parse,
777807

778808
lc_memset_secure(pkcs7, 0, sizeof(struct lc_pkcs7_message));
779809

780-
CKINT(pkcs7_sinfo_get(&ctx.sinfo, pkcs7));
781-
782810
ctx.msg = pkcs7;
783811

784812
ctx.data = data;
785813
ctx.ppcerts = &ctx.certs;
786-
ctx.ppsinfo = &ctx.msg->signed_infos;
787814

788815
/* Attempt to decode the signature */
789816
CKINT(asn1_ber_decoder(&pkcs7_decoder, &ctx, data, datalen));
@@ -799,7 +826,6 @@ LC_INTERFACE_FUNCTION(int, lc_pkcs7_message_parse,
799826
lc_free(cert);
800827
}
801828

802-
pkcs7_sinfo_free(pkcs7, ctx.sinfo);
803829
if (ret)
804830
lc_pkcs7_message_clear(ctx.msg);
805831

‎asn1/src/pkcs7_verify.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -438,7 +438,7 @@ LC_INTERFACE_FUNCTION(int, lc_pkcs7_get_digest, struct lc_pkcs7_message *pkcs7,
438438
size_t *message_digest_len,
439439
const struct lc_hash **hash_algo)
440440
{
441-
struct lc_pkcs7_signed_info *sinfo = pkcs7->signed_infos;
441+
struct lc_pkcs7_signed_info *sinfo = pkcs7->list_head_signed_infos;
442442
int ret;
443443

444444
CKNULL(message_digest, -EBADMSG);
@@ -485,7 +485,8 @@ LC_INTERFACE_FUNCTION(int, lc_pkcs7_verify, struct lc_pkcs7_message *pkcs7,
485485
return -ENODATA;
486486
}
487487

488-
for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) {
488+
for (sinfo = pkcs7->list_head_signed_infos; sinfo;
489+
sinfo = sinfo->next) {
489490
ret = pkcs7_verify_one(pkcs7, trust_store, sinfo, verify_rules);
490491
switch (ret) {
491492
case -ENOKEY:

0 commit comments

Comments
 (0)