lib: Fix certificate DER encoding and key buffers

i2d_X509() allocated buf->data via OPENSSL_malloc(), but callers free
it with freebuf() which uses free(). Fix by allocating with malloc()
and encoding directly into the buffer. Also replaces MSGBUFSZ with
CRYPT_KEY_BUFSZ (4096) for key material buffers and removes leftover
debug logging.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

4 files changed, 37 insertions, 37 deletions

diff --git a/src/lib/crypt/openssl.c b/src/lib/crypt/openssl.c
index f94fb327..5916e3cb 100644
--- a/src/lib/crypt/openssl.c
+++ b/src/lib/crypt/openssl.c
@@ -629,7 +629,7 @@ ssize_t openssl_pkp_create(const char *  algo,
 
                 return (ssize_t) raw.len;
         } else { /* DER encode standard algorithms */
-                pos = pk; /* i2d_PUBKEY increments the pointer, don't use pk! */
+                pos = pk; /* i2d_PUBKEY increments the ptr, don't use pk! */
                 len = i2d_PUBKEY(*pkp, &pos);
                 if (len < 0)
                         goto fail_pubkey;
@@ -666,7 +666,7 @@ static ssize_t __openssl_kem_encap(EVP_PKEY * pub,
 
         /* Get required lengths */
         ret = EVP_PKEY_encapsulate(ctx, NULL, &ct_len, NULL, &secret_len);
-        if (ret != 1 || ct_len > MSGBUFSZ)
+        if (ret != 1 || ct_len > CRYPT_KEY_BUFSZ)
                 goto fail_encap;
 
         /* Allocate buffer for secret */
@@ -1283,24 +1283,14 @@ int openssl_load_privkey_file(const char * path,
 {
         FILE *     fp;
         EVP_PKEY * pkey;
-        unsigned long err;
-        char       errbuf[256];
 
         fp = fopen(path, "r");
-        if (fp == NULL) {
-                fprintf(stderr, "Failed to open %s\n", path);
+        if (fp == NULL)
                 goto fail_file;
-        }
 
         pkey = PEM_read_PrivateKey(fp, NULL, NULL, "");
-        if (pkey == NULL) {
-                err = ERR_get_error();
-                ERR_error_string_n(err, errbuf, sizeof(errbuf));
-                fprintf(stderr,
-                        "OpenSSL error loading privkey from %s: %s\n",
-                        path, errbuf);
+        if (pkey == NULL)
                 goto fail_key;
-        }
 
         fclose(fp);
 
@@ -1442,7 +1432,7 @@ int openssl_load_pubkey_raw_file(const char * path,
                                  buffer_t *   buf)
 {
         FILE *        fp;
-        uint8_t       tmp_buf[MSGBUFSZ];
+        uint8_t       tmp_buf[CRYPT_KEY_BUFSZ];
         size_t        bytes_read;
         const char *  algo;
 
@@ -1453,7 +1443,7 @@ int openssl_load_pubkey_raw_file(const char * path,
         if (fp == NULL)
                 goto fail_file;
 
-        bytes_read = fread(tmp_buf, 1, MSGBUFSZ, fp);
+        bytes_read = fread(tmp_buf, 1, CRYPT_KEY_BUFSZ, fp);
         if (bytes_read == 0)
                 goto fail_read;
 
@@ -1658,25 +1648,33 @@ int openssl_crt_str(const void * crt,
 int openssl_crt_der(const void * crt,
                     buffer_t *   buf)
 {
-        int len;
+        uint8_t * p;
+        int       len;
 
         assert(crt != NULL);
         assert(buf != NULL);
 
-        len = i2d_X509((X509 *) crt, &buf->data);
+        /* Get the size by encoding to NULL */
+        len = i2d_X509((X509 *) crt, NULL);
         if (len < 0)
-                goto fail_der;
+                goto fail_len;
 
+        buf->data = malloc((size_t) len);
+        if (buf->data == NULL)
+                goto fail_malloc;
+
+        p = buf->data; /* i2d_X509 increments p */
+        i2d_X509((X509 *) crt, &p);
         buf->len = (size_t) len;
 
         return 0;
 
- fail_der:
+ fail_malloc:
+ fail_len:
         clrbuf(*buf);
         return -1;
 }
 
-
 void * openssl_auth_create_store(void)
 {
         return X509_STORE_new();
diff --git a/src/lib/protobuf.c b/src/lib/protobuf.c
index 77f06032..28b3aab2 100644
--- a/src/lib/protobuf.c
+++ b/src/lib/protobuf.c
@@ -161,6 +161,8 @@ struct name_info name_info_msg_to_s(const name_info_msg_t * msg)
         assert(msg != NULL);
         assert(strlen(msg->name) <= NAME_SIZE);
 
+        memset(&s, 0, sizeof(s));
+
         strcpy(s.name, msg->name);
         strcpy(s.s.key, msg->skey);
         strcpy(s.s.crt, msg->scrt);
diff --git a/src/lib/tests/kex_test.c b/src/lib/tests/kex_test.c
index ced760fe..6a4f802e 100644
--- a/src/lib/tests/kex_test.c
+++ b/src/lib/tests/kex_test.c
@@ -106,7 +106,7 @@ static int test_kex_dh_pkp_create_destroy(void)
 {
         struct sec_config kex;
         void *         pkp;
-        uint8_t        buf[MSGBUFSZ];
+        uint8_t        buf[CRYPT_KEY_BUFSZ];
 
         TEST_START();
 
@@ -134,7 +134,7 @@ static int test_kex_get_algo_from_pk(const char * algo)
         void *            pkp;
         buffer_t          pk;
         ssize_t           len;
-        uint8_t           buf[MSGBUFSZ];
+        uint8_t           buf[CRYPT_KEY_BUFSZ];
         char              extracted_algo[256];
 
         TEST_START("(%s)", algo);
@@ -204,8 +204,8 @@ static int test_kex_dhe_derive(const char * algo)
         buffer_t          pk1;
         buffer_t          pk2;
         ssize_t           len;
-        uint8_t           buf1[MSGBUFSZ];
-        uint8_t           buf2[MSGBUFSZ];
+        uint8_t           buf1[CRYPT_KEY_BUFSZ];
+        uint8_t           buf2[CRYPT_KEY_BUFSZ];
         uint8_t           s1[SYMMKEYSZ];
         uint8_t           s2[SYMMKEYSZ];
 
@@ -317,7 +317,7 @@ static int test_kex_dhe_corrupted_pubkey(const char * algo)
         void *            pkp;
         buffer_t          pk;
         ssize_t           len;
-        uint8_t           buf[MSGBUFSZ];
+        uint8_t           buf[CRYPT_KEY_BUFSZ];
         uint8_t           s[SYMMKEYSZ];
 
         TEST_START("(%s)", algo);
@@ -363,8 +363,8 @@ static int test_kex_dhe_wrong_algo(void)
         void *            pkp2;
         buffer_t          pk2;
         ssize_t           len;
-        uint8_t           buf1[MSGBUFSZ];
-        uint8_t           buf2[MSGBUFSZ];
+        uint8_t           buf1[CRYPT_KEY_BUFSZ];
+        uint8_t           buf2[CRYPT_KEY_BUFSZ];
         uint8_t           s[SYMMKEYSZ];
         const char *      algo1 = "X25519";
         const char *      algo2 = "X448";
diff --git a/src/lib/tests/kex_test_ml_kem.c b/src/lib/tests/kex_test_ml_kem.c
index 3bb9ae7c..7761c3dc 100644
--- a/src/lib/tests/kex_test_ml_kem.c
+++ b/src/lib/tests/kex_test_ml_kem.c
@@ -197,8 +197,8 @@ static int test_kex_kem(const char * algo)
         buffer_t          ct;
         ssize_t           len;
         ssize_t           ct_len;
-        uint8_t           buf1[MSGBUFSZ];
-        uint8_t           buf2[MSGBUFSZ];
+        uint8_t           buf1[CRYPT_KEY_BUFSZ];
+        uint8_t           buf2[CRYPT_KEY_BUFSZ];
         uint8_t           s1[SYMMKEYSZ];
         uint8_t           s2[SYMMKEYSZ];
         int               kdf;
@@ -262,8 +262,8 @@ static int test_kex_kem_corrupted_ciphertext(const char * algo)
         buffer_t          ct;
         ssize_t           len;
         ssize_t           ct_len;
-        uint8_t           buf1[MSGBUFSZ];
-        uint8_t           buf2[MSGBUFSZ];
+        uint8_t           buf1[CRYPT_KEY_BUFSZ];
+        uint8_t           buf2[CRYPT_KEY_BUFSZ];
         uint8_t           s1[SYMMKEYSZ];
         uint8_t           s2[SYMMKEYSZ];
         int               kdf;
@@ -334,9 +334,9 @@ static int test_kex_kem_wrong_keypair(const char * algo)
         buffer_t          ct;
         ssize_t           len;
         ssize_t           ct_len;
-        uint8_t           buf1[MSGBUFSZ];
-        uint8_t           buf2[MSGBUFSZ];
-        uint8_t           buf3[MSGBUFSZ];
+        uint8_t           buf1[CRYPT_KEY_BUFSZ];
+        uint8_t           buf2[CRYPT_KEY_BUFSZ];
+        uint8_t           buf3[CRYPT_KEY_BUFSZ];
         uint8_t           s1[SYMMKEYSZ];
         uint8_t           s2[SYMMKEYSZ];
 
@@ -402,8 +402,8 @@ static int test_kex_kem_truncated_ciphertext(const char * algo)
         buffer_t          ct;
         ssize_t           len;
         ssize_t           ct_len;
-        uint8_t           buf1[MSGBUFSZ];
-        uint8_t           buf2[MSGBUFSZ];
+        uint8_t           buf1[CRYPT_KEY_BUFSZ];
+        uint8_t           buf2[CRYPT_KEY_BUFSZ];
         uint8_t           s1[SYMMKEYSZ];
         uint8_t           s2[SYMMKEYSZ];