ladybird/Userland/Libraries/LibCrypto/ASN1/ASN1.cpp
Ben Wiederhake 0ca41d2813 LibCrypto: Don't crash in ASN1::parse_utc_time on missing 'Z'
The underlying reason is an unconditional call to consume(), even if
there is no reason to expect that the string continues.

This crash was discovered by OSS-Fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42354
This bug exists since the code was first written in April 2021:
13abbc5ea8
2022-12-31 23:21:17 +01:00

191 lines
5.4 KiB
C++

/*
* Copyright (c) 2021, the SerenityOS developers.
*
* SPDX-License-Identifier: BSD-2-Clause
*/
#include <AK/GenericLexer.h>
#include <LibCrypto/ASN1/ASN1.h>
namespace Crypto::ASN1 {
DeprecatedString kind_name(Kind kind)
{
switch (kind) {
case Kind::Eol:
return "EndOfList";
case Kind::Boolean:
return "Boolean";
case Kind::Integer:
return "Integer";
case Kind::BitString:
return "BitString";
case Kind::OctetString:
return "OctetString";
case Kind::Null:
return "Null";
case Kind::ObjectIdentifier:
return "ObjectIdentifier";
case Kind::IA5String:
return "IA5String";
case Kind::PrintableString:
return "PrintableString";
case Kind::Utf8String:
return "UTF8String";
case Kind::UTCTime:
return "UTCTime";
case Kind::GeneralizedTime:
return "GeneralizedTime";
case Kind::Sequence:
return "Sequence";
case Kind::Set:
return "Set";
}
return "InvalidKind";
}
DeprecatedString class_name(Class class_)
{
switch (class_) {
case Class::Application:
return "Application";
case Class::Context:
return "Context";
case Class::Private:
return "Private";
case Class::Universal:
return "Universal";
}
return "InvalidClass";
}
DeprecatedString type_name(Type type)
{
switch (type) {
case Type::Constructed:
return "Constructed";
case Type::Primitive:
return "Primitive";
}
return "InvalidType";
}
Optional<Core::DateTime> parse_utc_time(StringView time)
{
// YYMMDDhhmm[ss]Z or YYMMDDhhmm[ss](+|-)hhmm
GenericLexer lexer(time);
auto year_in_century = lexer.consume(2).to_uint();
auto month = lexer.consume(2).to_uint();
auto day = lexer.consume(2).to_uint();
auto hour = lexer.consume(2).to_uint();
auto minute = lexer.consume(2).to_uint();
Optional<unsigned> seconds, offset_hours, offset_minutes;
[[maybe_unused]] bool negative_offset = false;
if (lexer.next_is(is_any_of("0123456789"sv))) {
seconds = lexer.consume(2).to_uint();
if (!seconds.has_value()) {
return {};
}
}
if (lexer.next_is('Z')) {
lexer.consume();
} else if (lexer.next_is(is_any_of("+-"sv))) {
negative_offset = lexer.consume() == '-';
offset_hours = lexer.consume(2).to_uint();
offset_minutes = lexer.consume(2).to_uint();
if (!offset_hours.has_value() || !offset_minutes.has_value()) {
return {};
}
} else {
return {};
}
if (!year_in_century.has_value() || !month.has_value() || !day.has_value() || !hour.has_value() || !minute.has_value()) {
return {};
}
// RFC5280 section 4.1.2.5.1.
auto full_year = year_in_century.value();
full_year += (full_year < 50) ? 2000 : 1900;
auto full_seconds = seconds.value_or(0);
// FIXME: Handle offsets!
if (offset_hours.has_value() || offset_minutes.has_value())
dbgln("FIXME: Implement UTCTime with offset!");
return Core::DateTime::create(full_year, month.value(), day.value(), hour.value(), minute.value(), full_seconds);
}
Optional<Core::DateTime> parse_generalized_time(StringView time)
{
// YYYYMMDDhh[mm[ss[.fff]]] or YYYYMMDDhh[mm[ss[.fff]]]Z or YYYYMMDDhh[mm[ss[.fff]]](+|-)hhmm
GenericLexer lexer(time);
auto year = lexer.consume(4).to_uint();
auto month = lexer.consume(2).to_uint();
auto day = lexer.consume(2).to_uint();
auto hour = lexer.consume(2).to_uint();
Optional<unsigned> minute, seconds, milliseconds, offset_hours, offset_minutes;
[[maybe_unused]] bool negative_offset = false;
if (!lexer.is_eof()) {
if (lexer.consume_specific('Z'))
goto done_parsing;
if (!lexer.next_is(is_any_of("+-"sv))) {
minute = lexer.consume(2).to_uint();
if (!minute.has_value()) {
return {};
}
if (lexer.consume_specific('Z'))
goto done_parsing;
}
if (!lexer.next_is(is_any_of("+-"sv))) {
seconds = lexer.consume(2).to_uint();
if (!seconds.has_value()) {
return {};
}
if (lexer.consume_specific('Z'))
goto done_parsing;
}
if (lexer.consume_specific('.')) {
milliseconds = lexer.consume(3).to_uint();
if (!milliseconds.has_value()) {
return {};
}
if (lexer.consume_specific('Z'))
goto done_parsing;
}
if (lexer.next_is(is_any_of("+-"sv))) {
negative_offset = lexer.consume() == '-';
offset_hours = lexer.consume(2).to_uint();
offset_minutes = lexer.consume(2).to_uint();
if (!offset_hours.has_value() || !offset_minutes.has_value()) {
return {};
}
} else {
lexer.consume();
}
}
done_parsing:;
if (!year.has_value() || !month.has_value() || !day.has_value() || !hour.has_value()) {
return {};
}
// FIXME: Handle offsets!
if (offset_hours.has_value() || offset_minutes.has_value())
dbgln("FIXME: Implement GeneralizedTime with offset!");
// Unceremoniously drop the milliseconds on the floor.
return Core::DateTime::create(year.value(), month.value(), day.value(), hour.value(), minute.value_or(0), seconds.value_or(0));
}
}