1 files changed, 113 insertions, 73 deletions

diff --git a/lib/crypto/c_src/otp_test_engine.c b/lib/crypto/c_src/otp_test_engine.c
index f452fb2d0c..c3bd9dfb55 100644
--- a/lib/crypto/c_src/otp_test_engine.c
+++ b/lib/crypto/c_src/otp_test_engine.c
@@ -21,8 +21,11 @@
 #ifdef _WIN32
 #define OPENSSL_OPT_WINDLL
 #endif
+
 #include <stdio.h>
 #include <string.h>
+#include <limits.h>
+#include <stdint.h>
 
 #include <openssl/md5.h>
 #include <openssl/rsa.h>
@@ -87,13 +90,12 @@ static int test_init(ENGINE *e) {
     printf("OTP Test Engine Initializatzion!\r\n");
     
 #if defined(FAKE_RSA_IMPL)
-    if (    !RSA_meth_set_finish(test_rsa_method, test_rsa_free)
-            || !RSA_meth_set_sign(test_rsa_method, test_rsa_sign)
-            || !RSA_meth_set_verify(test_rsa_method, test_rsa_verify)
-            ) {
-        fprintf(stderr, "Setup RSA_METHOD failed\r\n");
-        return 0;
-    }
+    if (!RSA_meth_set_finish(test_rsa_method, test_rsa_free))
+        goto err;
+    if (!RSA_meth_set_sign(test_rsa_method, test_rsa_sign))
+        goto err;
+    if (!RSA_meth_set_verify(test_rsa_method, test_rsa_verify))
+        goto err;
 #endif /* if defined(FAKE_RSA_IMPL) */
 
     /* Load all digest and cipher algorithms. Needed for password protected private keys */
@@ -101,6 +103,12 @@ static int test_init(ENGINE *e) {
     OpenSSL_add_all_digests();
 
     return 111;
+
+#if defined(FAKE_RSA_IMPL)
+err:
+    fprintf(stderr, "Setup RSA_METHOD failed\r\n");
+    return 0;
+#endif
 }
 
 static void add_test_data(unsigned char *md, unsigned int len)
@@ -152,15 +160,15 @@ static int test_engine_md5_update(EVP_MD_CTX *ctx,const void *data, size_t count
 
 static int test_engine_md5_final(EVP_MD_CTX *ctx,unsigned char *md) {
 #ifdef OLD
-    int ret;
+    fprintf(stderr, "MD5 final size of EVP_MD: %lu\r\n", (unsigned long)sizeof(EVP_MD));
+    if (!MD5_Final(md, data(ctx)))
+        goto err;
 
-    fprintf(stderr, "MD5 final size of EVP_MD: %lu\r\n", sizeof(EVP_MD));
-    ret = MD5_Final(md, data(ctx));
+    add_test_data(md, MD5_DIGEST_LENGTH);
+    return 1;
 
-    if (ret > 0) {
-         add_test_data(md, MD5_DIGEST_LENGTH);
-    }
-    return ret;
+ err:
+    return 0;
 #else
     fprintf(stderr, "MD5 final\r\n");
     add_test_data(md, MD5_DIGEST_LENGTH);
@@ -190,7 +198,6 @@ static int test_digest_ids[] = {NID_md5};
 
 static int test_engine_digest_selector(ENGINE *e, const EVP_MD **digest,
         const int **nids, int nid) {
-    int ok = 1;
     if (!digest) {
         *nids = test_digest_ids;
         fprintf(stderr, "Digest is empty! Nid:%d\r\n", nid);
@@ -201,64 +208,82 @@ static int test_engine_digest_selector(ENGINE *e, const EVP_MD **digest,
 #ifdef OLD
         *digest = &test_engine_md5_method;
 #else
-        EVP_MD *md = EVP_MD_meth_new(NID_md5, NID_undef);
-        if (!md ||
-            !EVP_MD_meth_set_result_size(md, MD5_DIGEST_LENGTH) ||
-            !EVP_MD_meth_set_flags(md, 0) ||
-            !EVP_MD_meth_set_init(md,  test_engine_md5_init) ||
-            !EVP_MD_meth_set_update(md,  test_engine_md5_update) ||
-            !EVP_MD_meth_set_final(md,  test_engine_md5_final) ||
-            !EVP_MD_meth_set_copy(md,  NULL) ||
-            !EVP_MD_meth_set_cleanup(md,  NULL) ||
-            !EVP_MD_meth_set_input_blocksize(md, MD5_CBLOCK) ||
-            !EVP_MD_meth_set_app_datasize(md, sizeof(EVP_MD *) + sizeof(MD5_CTX)) ||
-            !EVP_MD_meth_set_ctrl(md, NULL))
-            {
-                ok = 0;
-                *digest = NULL;
-            } else
-            {
-                *digest = md;
-            }
+        EVP_MD *md;
+
+        if ((md = EVP_MD_meth_new(NID_md5, NID_undef)) == NULL)
+            goto err;
+        if (EVP_MD_meth_set_result_size(md, MD5_DIGEST_LENGTH) != 1)
+            goto err;
+        if (EVP_MD_meth_set_flags(md, 0) != 1)
+            goto err;
+        if (EVP_MD_meth_set_init(md, test_engine_md5_init) != 1)
+            goto err;
+        if (EVP_MD_meth_set_update(md, test_engine_md5_update) != 1)
+            goto err;
+        if (EVP_MD_meth_set_final(md, test_engine_md5_final) != 1)
+            goto err;
+        if (EVP_MD_meth_set_copy(md, NULL) != 1)
+            goto err;
+        if (EVP_MD_meth_set_cleanup(md, NULL) != 1)
+            goto err;
+        if (EVP_MD_meth_set_input_blocksize(md, MD5_CBLOCK) != 1)
+            goto err;
+        if (EVP_MD_meth_set_app_datasize(md, sizeof(EVP_MD *) + sizeof(MD5_CTX)) != 1)
+            goto err;
+        if (EVP_MD_meth_set_ctrl(md, NULL) != 1)
+            goto err;
+
+        *digest = md;
 #endif
     }
     else {
-        ok = 0;
-        *digest = NULL;
+        goto err;
     }
     
-    return ok;
+    return 1;
+
+ err:
+    *digest = NULL;
+    return 0;
 }
 
 static int bind_helper(ENGINE * e, const char *id)
 {
 #if defined(FAKE_RSA_IMPL)
-    test_rsa_method = RSA_meth_new("OTP test RSA method", 0);
-    if (test_rsa_method == NULL) {
+    if ((test_rsa_method = RSA_meth_new("OTP test RSA method", 0)) == NULL) {
         fprintf(stderr, "RSA_meth_new failed\r\n");
-        return 0;
+        goto err;
     }
 #endif /* if defined(FAKE_RSA_IMPL) */
 
-    if (!ENGINE_set_id(e, test_engine_id)
-        || !ENGINE_set_name(e, test_engine_name)
-        || !ENGINE_set_init_function(e, test_init)
-        || !ENGINE_set_digests(e, &test_engine_digest_selector)
-        /* For testing of key storage in an Engine: */
-        || !ENGINE_set_load_privkey_function(e, &test_privkey_load)
-        || !ENGINE_set_load_pubkey_function(e, &test_pubkey_load)
-        )
-        return 0;
+    if (!ENGINE_set_id(e, test_engine_id))
+        goto err;
+    if (!ENGINE_set_name(e, test_engine_name))
+        goto err;
+    if (!ENGINE_set_init_function(e, test_init))
+        goto err;
+    if (!ENGINE_set_digests(e, &test_engine_digest_selector))
+        goto err;
+    /* For testing of key storage in an Engine: */
+    if (!ENGINE_set_load_privkey_function(e, &test_privkey_load))
+        goto err;
+    if (!ENGINE_set_load_pubkey_function(e, &test_pubkey_load))
+        goto err;
 
 #if defined(FAKE_RSA_IMPL)
-    if ( !ENGINE_set_RSA(e, test_rsa_method) ) {
-        RSA_meth_free(test_rsa_method);
-        test_rsa_method = NULL;
-        return 0;
-    }
+    if (!ENGINE_set_RSA(e, test_rsa_method))
+        goto err;
 #endif /* if defined(FAKE_RSA_IMPL) */
 
     return 1;
+
+ err:
+#if defined(FAKE_RSA_IMPL)
+    if (test_rsa_method)
+        RSA_meth_free(test_rsa_method);
+    test_rsa_method = NULL;
+#endif
+    return 0;
 }
 
 IMPLEMENT_DYNAMIC_CHECK_FN();
@@ -304,7 +329,7 @@ EVP_PKEY* test_key_load(ENGINE *eng, const char *id, UI_METHOD *ui_method, void
         fprintf(stderr, "Contents of file \"%s\":\r\n",id);
         f = fopen(id, "r");
         { /* Print the contents of the key file */
-            char c;
+            int c;
             while (!feof(f)) {
                 switch (c=fgetc(f)) {
                 case '\n':
@@ -324,23 +349,28 @@ EVP_PKEY* test_key_load(ENGINE *eng, const char *id, UI_METHOD *ui_method, void
 
 int pem_passwd_cb_fun(char *buf, int size, int rwflag, void *password) 
 { 
-    int i;
+    size_t i;
+
+    if (size < 0)
+        return 0;
 
     fprintf(stderr, "In pem_passwd_cb_fun\r\n");
     if (!password)
         return 0;
 
     i = strlen(password);
-    if (i < size) {
-        /* whole pwd (incl terminating 0) fits */
-        fprintf(stderr, "Got FULL pwd %d(%d) chars\r\n", i, size);
-        memcpy(buf, (char*)password, i+1);
-        return i+1;
-    } else {
-        fprintf(stderr, "Got TO LONG pwd %d(%d) chars\r\n", i, size);
-        /* meaningless with a truncated password */
-        return 0;
-    }
+    if (i >= (size_t)size || i > INT_MAX - 1)
+        goto err;
+
+    /* whole pwd (incl terminating 0) fits */
+    fprintf(stderr, "Got FULL pwd %zu(%d) chars\r\n", i, size);
+    memcpy(buf, (char*)password, i+1);
+    return (int)i+1;
+
+ err:
+    fprintf(stderr, "Got TO LONG pwd %zu(%d) chars\r\n", i, size);
+    /* meaningless with a truncated password */
+    return 0;
 }
 
 #endif
@@ -349,7 +379,7 @@ int pem_passwd_cb_fun(char *buf, int size, int rwflag, void *password)
 /* RSA sign. This returns a fixed string so the test case can test that it was called
    instead of the cryptolib default RSA sign */
 
-unsigned char fake_flag[] = {255,3,124,180,35,10,180,151,101,247,62,59,80,122,220,
+static unsigned char fake_flag[] = {255,3,124,180,35,10,180,151,101,247,62,59,80,122,220,
                              142,24,180,191,34,51,150,112,27,43,142,195,60,245,213,80,179};
 
 int test_rsa_sign(int dtype, 
@@ -360,11 +390,10 @@ int test_rsa_sign(int dtype,
                   /* The key */
                   const RSA *rsa)
 {
-    int slen;
     fprintf(stderr, "test_rsa_sign (dtype=%i) called m_len=%u *siglen=%u\r\n", dtype, m_len, *siglen);
     if (!sigret) {
         fprintf(stderr, "sigret = NULL\r\n");
-        return -1;
+        goto err;
     }
 
     /* {int i;
@@ -376,14 +405,20 @@ int test_rsa_sign(int dtype,
 
     if ((sizeof(fake_flag) == m_len)
         && memcmp(m,fake_flag,m_len) == 0) {
+        int slen;
+
         printf("To be faked\r\n");
         /* To be faked */
-        slen = RSA_size(rsa);
-        add_test_data(sigret, slen); /* The signature is 0,1,2...255,0,1... */
-        *siglen = slen; /* Must set this. Why? */
+        if ((slen = RSA_size(rsa)) < 0)
+            goto err;
+        add_test_data(sigret, (unsigned int)slen); /* The signature is 0,1,2...255,0,1... */
+        *siglen = (unsigned int)slen; /* Must set this. Why? */
         return 1; /* 1 = success */
     }
     return 0;
+
+ err:
+    return -1;
 }
 
 int test_rsa_verify(int dtype, 
@@ -398,8 +433,13 @@ int test_rsa_verify(int dtype,
 
     if ((sizeof(fake_flag) == m_len)
         && memcmp(m,fake_flag,m_len) == 0) {
+        int size;
+
+        if ((size = RSA_size(rsa)) < 0)
+            return 0;
+
         printf("To be faked\r\n");
-        return (siglen ==  RSA_size(rsa)) 
+        return (siglen == (unsigned int)size)
             && chk_test_data(sigret, siglen);
     }
     return 0;