mirror of
https://github.com/openssl/openssl.git
synced 2024-12-15 06:01:37 +08:00
d63b3e7959
OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical numeric text form. For gigantic sub-identifiers, this would take a very long time, the time complexity being O(n^2) where n is the size of that sub-identifier. To mitigate this, a restriction on the size that OBJ_obj2txt() will translate to canonical numeric text form is added, based on RFC 2578 (STD 58), which says this: > 3.5. OBJECT IDENTIFIER values > > An OBJECT IDENTIFIER value is an ordered list of non-negative numbers. > For the SMIv2, each number in the list is referred to as a sub-identifier, > there are at most 128 sub-identifiers in a value, and each sub-identifier > has a maximum value of 2^32-1 (4294967295 decimal). Fixes otc/security#96 Fixes CVE-2023-2650 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> |
||
---|---|---|
.. | ||
build.info | ||
o_names.c | ||
obj_compat.h | ||
obj_dat.c | ||
obj_dat.h | ||
obj_dat.pl | ||
obj_err.c | ||
obj_lib.c | ||
obj_local.h | ||
obj_mac.num | ||
obj_xref.c | ||
obj_xref.h | ||
obj_xref.txt | ||
objects.pl | ||
objects.txt | ||
objxref.pl | ||
README.md |
objects.txt syntax
To cover all the naming hacks that were previously in objects.h
needed some
kind of hacks in objects.txt
.
The basic syntax for adding an object is as follows:
1 2 3 4 : shortName : Long Name
If Long Name contains only word characters and hyphen-minus
(0x2D) or full stop (0x2E) then Long Name is used as basis
for the base name in C. Otherwise, the shortName is used.
The base name (let's call it 'base') will then be used to
create the C macros SN_base, LN_base, NID_base and OBJ_base.
Note that if the base name contains spaces, dashes or periods,
those will be converted to underscore.
Then there are some extra commands:
!Alias foo 1 2 3 4
This just makes a name foo for an OID. The C macro
OBJ_foo will be created as a result.
!Cname foo
This makes sure that the name foo will be used as base name
in C.
!module foo
1 2 3 4 : shortName : Long Name
!global
The !module command was meant to define a kind of modularity.
What it does is to make sure the module name is prepended
to the base name. !global turns this off. This construction
is not recursive.
Lines starting with #
are treated as comments, as well as any line starting
with ! and not matching the commands above.