openssl/crypto/encode_decode/decoder_lib.c, branch openssl-3.3.1

Copyright year updates

2023-09-07T08:59:15Z

Reviewed-by: Richard Levitte Release: yes

Always add a suitable error if we fail to decode

2023-08-01T18:08:28Z

We're always supposed to add the fallback "unsupported" error if we don't have anything better. However in some cases this wasn't happening because we were incorrectly setting "flag_construct_called" - even though the construct function had failed. Reviewed-by: Tim Hudson Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/21603)

Optimise PKEY decoders

2023-07-16T22:12:06Z

The most expensive part of using a PKEY decoder is the OSSL_DECODER_CTX_new_for_pkey() call. This builds up all of the decoder chains, which is a complex and time consuming operation. However, if no new providers have been loaded/unloaded since the last time it was called we can expect the same results for the same parameters. Note that this operation takes place *before* we event parse the data for decoding so it is not dependent on the parsed data at all. We introduce a cache for OSSL_DECODER_CTX objects. If we have been called with the same parameters then we just duplicate an existing OSSL_DECODER_CTX. This should be significantly faster than creating a new one every time. Partially addressed the issue in #15199 Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/21426)

Stop raising ERR_R_MALLOC_FAILURE in most places

2022-10-05T12:02:03Z

Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz Reviewed-by: Hugo Landau (Merged from https://github.com/openssl/openssl/pull/19301)

Fix another decoder mem leak on an error path

2022-06-02T09:31:12Z

If pushing the decoder onto a stack fails then we should free the ref we just created. Found due to the error report here: https://github.com/openssl/openssl/pull/18355#issuecomment-1138205688 Reviewed-by: Richard Levitte Reviewed-by: Shane Lontis Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/18411)

Fix a decoder mem leak on an error path

2022-06-02T09:31:12Z

If an error condition occurs then the the decoder that was up-refed in ossl_decoder_instance_new can be leaked. Found due to the error report here: https://github.com/openssl/openssl/pull/18355#issuecomment-1138205688 Reviewed-by: Tomas Mraz Reviewed-by: Shane Lontis (Merged from https://github.com/openssl/openssl/pull/18410)

Update copyright year

2022-05-03T12:34:51Z

Reviewed-by: Tomas Mraz Release: yes

str[n]casecmp => OPENSSL_strncasecmp

2022-04-22T09:34:41Z

Reviewed-by: Tim Hudson Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/18069)

Decoder resolution performance optimizations

2022-03-23T08:19:07Z

This refactors decoder functionality to reduce calls to OSSL_DECODER_is_a / EVP_KEYMGMT_is_a, which are substantial bottlenecks in the performance of repeated decode operations (see #15199). Reviewed-by: Matt Caswell Reviewed-by: Richard Levitte Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/17921)

Move e_os.h to include/internal

2022-02-05T04:31:09Z

Including e_os.h with a path from a header file doesn't work well on certain exotic platform. It simply fails to build. Since we don't seem to be able to stop ourselves, the better move is to move e_os.h to an include directory that's part of the inclusion path given to the compiler. Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/17641)