Commit 59302b60 authored by Emilia Kasper's avatar Emilia Kasper Committed by Matt Caswell
Browse files

PKCS#7: Fix NULL dereference with missing EncryptedContent. 



CVE-2015-1790

Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
parent f48b83b4

crypto/pkcs7/pk7_doit.c

+15 −1
Original line number Diff line number Diff line
@@ -432,6 +432,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert) 


    switch (i) {

    case NID_pkcs7_signed:

        /*

         * p7->d.sign->contents is a PKCS7 structure consisting of a contentType

         * field and optional content.

         * data_body is NULL if that structure has no (=detached) content

         * or if the contentType is wrong (i.e., not "data").

         */

        data_body = PKCS7_get_octet_string(p7->d.sign->contents);

        if (!PKCS7_is_detached(p7) && data_body == NULL) {

            PKCS7err(PKCS7_F_PKCS7_DATADECODE,
@@ -443,6 +449,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert) 
    case NID_pkcs7_signedAndEnveloped:

        rsk = p7->d.signed_and_enveloped->recipientinfo;

        md_sk = p7->d.signed_and_enveloped->md_algs;

        /* data_body is NULL if the optional EncryptedContent is missing. */

        data_body = p7->d.signed_and_enveloped->enc_data->enc_data;

        enc_alg = p7->d.signed_and_enveloped->enc_data->algorithm;

        evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);
@@ -455,6 +462,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert) 
    case NID_pkcs7_enveloped:

        rsk = p7->d.enveloped->recipientinfo;

        enc_alg = p7->d.enveloped->enc_data->algorithm;

        /* data_body is NULL if the optional EncryptedContent is missing. */

        data_body = p7->d.enveloped->enc_data->enc_data;

        evp_cipher = EVP_get_cipherbyobj(enc_alg->algorithm);

        if (evp_cipher == NULL) {
@@ -468,6 +476,12 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert) 
        goto err;

    }



    /* Detached content must be supplied via in_bio instead. */

    if (data_body == NULL && in_bio == NULL) {

        PKCS7err(PKCS7_F_PKCS7_DATADECODE, PKCS7_R_NO_CONTENT);

        goto err;

    }



    /* We will be checking the signature */

    if (md_sk != NULL) {

        for (i = 0; i < sk_X509_ALGOR_num(md_sk); i++) {
@@ -593,7 +607,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert) 
            BIO_push(out, etmp);

        etmp = NULL;

    }

    if (PKCS7_is_detached(p7) || (in_bio != NULL)) {

    if (in_bio != NULL) {

        bio = in_bio;

    } else {

        if (data_body->length > 0)