lib/x509_b64.c - master - githubmirror/gnutls

lib/x509_b64.c
521 строка13 KB
Daiki Ueno
nettle: revert workaround for base64_decode_update return values
04 мар 2026, 13:36
04 мар 2026, 13:36cea3a4e
/*
 * Copyright (C) 2000-2012 Free Software Foundation, Inc.
 * Copyright (C) 2017 Red Hat, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

/* Functions that relate to base64 encoding and decoding.
 */

#include "gnutls_int.h"
#include "errors.h"
#include "datum.h"
#include "x509_b64.h"
#include <nettle/base64.h>

#define INCR(what, size, max_len)                       \
	do {                                            \
		what += size;                           \
		if (what > max_len) {                   \
			gnutls_assert();                \
			gnutls_free(result->data);      \
			result->data = NULL;            \
			return GNUTLS_E_INTERNAL_ERROR; \
		}                                       \
	} while (0)

/* encodes data and puts the result into result (locally allocated)
 * The result_size (including the null terminator) is the return value.
 */
int _gnutls_fbase64_encode(const char *msg, const uint8_t *data,
			   size_t data_size, gnutls_datum_t *result)
{
	int tmp;
	unsigned int i;
	uint8_t tmpres[66];
	uint8_t *ptr;
	char top[80];
	char bottom[80];
	size_t size, max, bytes;
	int pos, top_len = 0, bottom_len = 0;
	unsigned raw_encoding = 0;

	if (msg == NULL || msg[0] == 0)
		raw_encoding = 1;

	if (!raw_encoding) {
		if (strlen(msg) > 50) {
			gnutls_assert();
			return GNUTLS_E_BASE64_ENCODING_ERROR;
		}

		_gnutls_str_cpy(top, sizeof(top), "-----BEGIN ");
		_gnutls_str_cat(top, sizeof(top), msg);
		_gnutls_str_cat(top, sizeof(top), "-----\n");

		_gnutls_str_cpy(bottom, sizeof(bottom), "-----END ");
		_gnutls_str_cat(bottom, sizeof(bottom), msg);
		_gnutls_str_cat(bottom, sizeof(bottom), "-----\n");

		top_len = strlen(top);
		bottom_len = strlen(bottom);
	}

	max = B64FSIZE(top_len + bottom_len, data_size);

	result->data = gnutls_malloc(max + 1);
	if (result->data == NULL) {
		gnutls_assert();
		return GNUTLS_E_MEMORY_ERROR;
	}

	bytes = 0;
	INCR(bytes, top_len, max);
	pos = top_len;

	memcpy(result->data, top, top_len);

	for (i = 0; i < data_size; i += 48) {
		if (data_size - i < 48)
			tmp = data_size - i;
		else
			tmp = 48;

		size = BASE64_ENCODE_RAW_LENGTH(tmp);
		if (sizeof(tmpres) < size)
			return gnutls_assert_val(
				GNUTLS_E_BASE64_ENCODING_ERROR);

		base64_encode_raw((void *)tmpres, tmp, &data[i]);

		INCR(bytes, size + 1, max);
		ptr = &result->data[pos];

		memcpy(ptr, tmpres, size);
		ptr += size;
		pos += size;
		if (!raw_encoding) {
			*ptr++ = '\n';
			pos++;
		} else {
			bytes--;
		}
	}

	INCR(bytes, bottom_len, max);

	memcpy(&result->data[bytes - bottom_len], bottom, bottom_len);
	result->data[bytes] = 0;
	result->size = bytes;

	return max + 1;
}

/**
 * gnutls_pem_base64_encode:
 * @msg: is a message to be put in the header (may be %NULL)
 * @data: contain the raw data
 * @result: the place where base64 data will be copied
 * @result_size: holds the size of the result
 *
 * This function will convert the given data to printable data, using
 * the base64 encoding. This is the encoding used in PEM messages.
 *
 * The output string will be null terminated, although the output size will
 * not include the terminating null.
 *
 * Returns: On success %GNUTLS_E_SUCCESS (0) is returned,
 *   %GNUTLS_E_SHORT_MEMORY_BUFFER is returned if the buffer given is
 *   not long enough, or 0 on success.
 **/
int gnutls_pem_base64_encode(const char *msg, const gnutls_datum_t *data,
			     char *result, size_t *result_size)
{
	gnutls_datum_t res;
	int ret;

	ret = _gnutls_fbase64_encode(msg, data->data, data->size, &res);
	if (ret < 0)
		return ret;

	if (result == NULL || *result_size < (unsigned)res.size) {
		gnutls_free(res.data);
		*result_size = res.size + 1;
		return GNUTLS_E_SHORT_MEMORY_BUFFER;
	} else {
		memcpy(result, res.data, res.size);
		gnutls_free(res.data);
		*result_size = res.size;
	}

	return 0;
}

/**
 * gnutls_pem_base64_encode2:
 * @header: is a message to be put in the encoded header (may be %NULL)
 * @data: contains the raw data
 * @result: will hold the newly allocated encoded data
 *
 * This function will convert the given data to printable data, using
 * the base64 encoding.  This is the encoding used in PEM messages.
 * This function will allocate the required memory to hold the encoded
 * data.
 *
 * You should use gnutls_free() to free the returned data.
 *
 * Note, that prior to GnuTLS 3.4.0 this function was available
 * under the name gnutls_pem_base64_encode_alloc(). There is
 * compatibility macro pointing to this function.
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 *   an error code is returned.
 *
 * Since: 3.4.0
 **/
int gnutls_pem_base64_encode2(const char *header, const gnutls_datum_t *data,
			      gnutls_datum_t *result)
{
	int ret;

	if (result == NULL)
		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

	ret = _gnutls_fbase64_encode(header, data->data, data->size, result);
	if (ret < 0)
		return gnutls_assert_val(ret);

	return 0;
}

/* copies data to result but removes newlines and <CR>
 * returns the size of the data copied.
 *
 * It will fail with GNUTLS_E_BASE64_DECODING_ERROR if the
 * end-result is the empty string.
 */
inline static int cpydata(const uint8_t *data, int data_size,
			  gnutls_datum_t *result)
{
	int i, j;

	result->data = gnutls_malloc(data_size + 1);
	if (result->data == NULL)
		return GNUTLS_E_MEMORY_ERROR;

	for (j = i = 0; i < data_size; i++) {
		if (data[i] == '\n' || data[i] == '\r' || data[i] == ' ' ||
		    data[i] == '\t')
			continue;
		else if (data[i] == '-')
			break;
		result->data[j] = data[i];
		j++;
	}

	result->size = j;
	result->data[j] = 0;

	if (j == 0) {
		gnutls_free(result->data);
		return gnutls_assert_val(GNUTLS_E_BASE64_DECODING_ERROR);
	}

	return j;
}

/* decodes data and puts the result into result (locally allocated).
 * Note that encodings of zero-length strings are being rejected
 * with GNUTLS_E_BASE64_DECODING_ERROR.
 *
 * The result_size is the return value.
 */
int _gnutls_base64_decode(const uint8_t *data, size_t data_size,
			  gnutls_datum_t *result)
{
	int ret;
	size_t size;
	gnutls_datum_t pdata;
	struct base64_decode_ctx ctx;

	if (data_size == 0) {
		result->data = (unsigned char *)gnutls_strdup("");
		if (result->data == NULL)
			return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
		result->size = 0;
		return 0;
	}

	ret = cpydata(data, data_size, &pdata);
	if (ret < 0) {
		gnutls_assert();
		return ret;
	}

	base64_decode_init(&ctx);

	size = BASE64_DECODE_LENGTH(pdata.size);
	if (size == 0) {
		ret = gnutls_assert_val(GNUTLS_E_BASE64_DECODING_ERROR);
		goto cleanup;
	}

	result->data = gnutls_malloc(size);
	if (result->data == NULL) {
		ret = gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
		goto cleanup;
	}

	ret = base64_decode_update(&ctx, &size, result->data, pdata.size,
				   (void *)pdata.data);
	if (ret == 0 || size == 0) {
		gnutls_assert();
		ret = GNUTLS_E_BASE64_DECODING_ERROR;
		goto fail;
	}

	ret = base64_decode_final(&ctx);
	if (ret != 1) {
		ret = gnutls_assert_val(GNUTLS_E_BASE64_DECODING_ERROR);
		goto fail;
	}

	result->size = size;

	ret = size;
	goto cleanup;

fail:
	gnutls_free(result->data);

cleanup:
	gnutls_free(pdata.data);
	return ret;
}

/* Searches the given string for ONE PEM encoded certificate, and
 * stores it in the result.
 *
 * The result_size (always non-zero) is the return value,
 * or a negative error code.
 */
#define ENDSTR "-----"
int _gnutls_fbase64_decode(const char *header, const uint8_t *data,
			   size_t data_size, gnutls_datum_t *result)
{
	int ret;
	static const char top[] = "-----BEGIN ";
	static const char bottom[] = "-----END ";
	uint8_t *rdata, *kdata;
	int rdata_size;
	char pem_header[128];

	_gnutls_str_cpy(pem_header, sizeof(pem_header), top);
	if (header != NULL)
		_gnutls_str_cat(pem_header, sizeof(pem_header), header);

	rdata = memmem(data, data_size, pem_header, strlen(pem_header));
	if (rdata == NULL) {
		gnutls_assert();
		_gnutls_hard_log("Could not find '%s'\n", pem_header);
		return GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR;
	}

	data_size -= MEMSUB(rdata, data);

	if (data_size < 4 + strlen(bottom)) {
		gnutls_assert();
		return GNUTLS_E_BASE64_DECODING_ERROR;
	}

	kdata = memmem(rdata + 1, data_size - 1, ENDSTR, sizeof(ENDSTR) - 1);
	/* allow CR as well.
	 */
	if (kdata == NULL) {
		gnutls_assert();
		_gnutls_hard_log("Could not find '%s'\n", ENDSTR);
		return GNUTLS_E_BASE64_DECODING_ERROR;
	}
	data_size -= strlen(ENDSTR);
	data_size -= MEMSUB(kdata, rdata);

	rdata = kdata + strlen(ENDSTR);

	/* position is now after the ---BEGIN--- headers */

	kdata = memmem(rdata, data_size, bottom, strlen(bottom));
	if (kdata == NULL) {
		gnutls_assert();
		return GNUTLS_E_BASE64_DECODING_ERROR;
	}

	/* position of kdata is before the ----END--- footer 
	 */
	rdata_size = MEMSUB(kdata, rdata);

	if (rdata_size < 4) {
		gnutls_assert();
		return GNUTLS_E_BASE64_DECODING_ERROR;
	}

	if ((ret = _gnutls_base64_decode(rdata, rdata_size, result)) < 0) {
		gnutls_assert();
		return GNUTLS_E_BASE64_DECODING_ERROR;
	}

	return ret;
}

/**
 * gnutls_pem_base64_decode:
 * @header: A null terminated string with the PEM header (eg. CERTIFICATE)
 * @b64_data: contain the encoded data
 * @result: the place where decoded data will be copied
 * @result_size: holds the size of the result
 *
 * This function will decode the given encoded data.  If the header
 * given is non %NULL this function will search for "-----BEGIN header"
 * and decode only this part.  Otherwise it will decode the first PEM
 * packet found.
 *
 * Returns: On success %GNUTLS_E_SUCCESS (0) is returned,
 *   %GNUTLS_E_SHORT_MEMORY_BUFFER is returned if the buffer given is
 *   not long enough, or 0 on success.
 **/
int gnutls_pem_base64_decode(const char *header, const gnutls_datum_t *b64_data,
			     unsigned char *result, size_t *result_size)
{
	gnutls_datum_t res;
	int ret;

	ret = _gnutls_fbase64_decode(header, b64_data->data, b64_data->size,
				     &res);
	if (ret < 0)
		return gnutls_assert_val(ret);

	if (result == NULL || *result_size < (unsigned)res.size) {
		gnutls_free(res.data);
		*result_size = res.size;
		return GNUTLS_E_SHORT_MEMORY_BUFFER;
	} else {
		memcpy(result, res.data, res.size);
		gnutls_free(res.data);
		*result_size = res.size;
	}

	return 0;
}

/**
 * gnutls_pem_base64_decode2:
 * @header: The PEM header (eg. CERTIFICATE)
 * @b64_data: contains the encoded data
 * @result: the location of decoded data
 *
 * This function will decode the given encoded data. The decoded data
 * will be allocated, and stored into result.  If the header given is
 * non null this function will search for "-----BEGIN header" and
 * decode only this part. Otherwise it will decode the first PEM
 * packet found.
 *
 * You should use gnutls_free() to free the returned data.
 *
 * Note, that prior to GnuTLS 3.4.0 this function was available
 * under the name gnutls_pem_base64_decode_alloc(). There is
 * compatibility macro pointing to this function.
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 *   an error code is returned.
 *
 * Since: 3.4.0
 **/
int gnutls_pem_base64_decode2(const char *header,
			      const gnutls_datum_t *b64_data,
			      gnutls_datum_t *result)
{
	int ret;

	if (result == NULL)
		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

	ret = _gnutls_fbase64_decode(header, b64_data->data, b64_data->size,
				     result);
	if (ret < 0)
		return gnutls_assert_val(ret);

	return 0;
}

/**
 * gnutls_base64_decode2:
 * @base64: contains the encoded data
 * @result: the location of decoded data
 *
 * This function will decode the given base64 encoded data. The decoded data
 * will be allocated, and stored into result.
 *
 * You should use gnutls_free() to free the returned data.
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 *   an error code is returned.
 *
 * Since: 3.6.0
 **/
int gnutls_base64_decode2(const gnutls_datum_t *base64, gnutls_datum_t *result)
{
	int ret;

	ret = _gnutls_base64_decode(base64->data, base64->size, result);
	if (ret < 0) {
		return gnutls_assert_val(ret);
	}

	return 0;
}

/**
 * gnutls_base64_encode2:
 * @data: contains the raw data
 * @result: will hold the newly allocated encoded data
 *
 * This function will convert the given data to printable data, using
 * the base64 encoding. This function will allocate the required
 * memory to hold the encoded data.
 *
 * You should use gnutls_free() to free the returned data.
 *
 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 *   an error code is returned.
 *
 * Since: 3.6.0
 **/
int gnutls_base64_encode2(const gnutls_datum_t *data, gnutls_datum_t *result)
{
	int ret;

	if (result == NULL)
		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

	ret = _gnutls_fbase64_encode(NULL, data->data, data->size, result);
	if (ret < 0)
		return gnutls_assert_val(ret);

	return 0;
}