xref: /freebsd/crypto/openssl/crypto/asn1/tasn_dec.c (revision e4e9813eb92cd7c4d4b819a8fbed5cbd3d92f5d8)
1 /* tasn_dec.c */
2 /* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
3  * project 2000.
4  */
5 /* ====================================================================
6  * Copyright (c) 2000-2005 The OpenSSL Project.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  *
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in
17  *    the documentation and/or other materials provided with the
18  *    distribution.
19  *
20  * 3. All advertising materials mentioning features or use of this
21  *    software must display the following acknowledgment:
22  *    "This product includes software developed by the OpenSSL Project
23  *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
24  *
25  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
26  *    endorse or promote products derived from this software without
27  *    prior written permission. For written permission, please contact
28  *    licensing@OpenSSL.org.
29  *
30  * 5. Products derived from this software may not be called "OpenSSL"
31  *    nor may "OpenSSL" appear in their names without prior written
32  *    permission of the OpenSSL Project.
33  *
34  * 6. Redistributions of any form whatsoever must retain the following
35  *    acknowledgment:
36  *    "This product includes software developed by the OpenSSL Project
37  *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
38  *
39  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
40  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
41  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
42  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
43  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
44  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
45  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
46  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
47  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
48  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
49  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
50  * OF THE POSSIBILITY OF SUCH DAMAGE.
51  * ====================================================================
52  *
53  * This product includes cryptographic software written by Eric Young
54  * (eay@cryptsoft.com).  This product includes software written by Tim
55  * Hudson (tjh@cryptsoft.com).
56  *
57  */
58 
59 
60 #include <stddef.h>
61 #include <string.h>
62 #include <openssl/asn1.h>
63 #include <openssl/asn1t.h>
64 #include <openssl/objects.h>
65 #include <openssl/buffer.h>
66 #include <openssl/err.h>
67 
68 static int asn1_check_eoc(const unsigned char **in, long len);
69 static int asn1_find_end(const unsigned char **in, long len, char inf);
70 
71 static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
72 				char inf, int tag, int aclass);
73 
74 static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen);
75 
76 static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
77 				char *inf, char *cst,
78 				const unsigned char **in, long len,
79 				int exptag, int expclass, char opt,
80 				ASN1_TLC *ctx);
81 
82 static int asn1_template_ex_d2i(ASN1_VALUE **pval,
83 				const unsigned char **in, long len,
84 				const ASN1_TEMPLATE *tt, char opt,
85 				ASN1_TLC *ctx);
86 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
87 				const unsigned char **in, long len,
88 				const ASN1_TEMPLATE *tt, char opt,
89 				ASN1_TLC *ctx);
90 static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
91 				const unsigned char **in, long len,
92 				const ASN1_ITEM *it,
93 				int tag, int aclass, char opt, ASN1_TLC *ctx);
94 
95 /* Table to convert tags to bit values, used for MSTRING type */
96 static unsigned long tag2bit[32] = {
97 0,	0,	0,	B_ASN1_BIT_STRING,	/* tags  0 -  3 */
98 B_ASN1_OCTET_STRING,	0,	0,		B_ASN1_UNKNOWN,/* tags  4- 7 */
99 B_ASN1_UNKNOWN,	B_ASN1_UNKNOWN,	B_ASN1_UNKNOWN,	B_ASN1_UNKNOWN,/* tags  8-11 */
100 B_ASN1_UTF8STRING,B_ASN1_UNKNOWN,B_ASN1_UNKNOWN,B_ASN1_UNKNOWN,/* tags 12-15 */
101 B_ASN1_SEQUENCE,0,B_ASN1_NUMERICSTRING,B_ASN1_PRINTABLESTRING, /* tags 16-19 */
102 B_ASN1_T61STRING,B_ASN1_VIDEOTEXSTRING,B_ASN1_IA5STRING,       /* tags 20-22 */
103 B_ASN1_UTCTIME, B_ASN1_GENERALIZEDTIME,			       /* tags 23-24 */
104 B_ASN1_GRAPHICSTRING,B_ASN1_ISO64STRING,B_ASN1_GENERALSTRING,  /* tags 25-27 */
105 B_ASN1_UNIVERSALSTRING,B_ASN1_UNKNOWN,B_ASN1_BMPSTRING,B_ASN1_UNKNOWN, /* tags 28-31 */
106 	};
107 
108 unsigned long ASN1_tag2bit(int tag)
109 	{
110 	if ((tag < 0) || (tag > 30)) return 0;
111 	return tag2bit[tag];
112 	}
113 
114 /* Macro to initialize and invalidate the cache */
115 
116 #define asn1_tlc_clear(c)	if (c) (c)->valid = 0
117 
118 /* Decode an ASN1 item, this currently behaves just
119  * like a standard 'd2i' function. 'in' points to
120  * a buffer to read the data from, in future we will
121  * have more advanced versions that can input data
122  * a piece at a time and this will simply be a special
123  * case.
124  */
125 
126 ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
127 		const unsigned char **in, long len, const ASN1_ITEM *it)
128 	{
129 	ASN1_TLC c;
130 	ASN1_VALUE *ptmpval = NULL;
131 	if (!pval)
132 		pval = &ptmpval;
133 	asn1_tlc_clear(&c);
134 	if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
135 		return *pval;
136 	return NULL;
137 	}
138 
139 int ASN1_template_d2i(ASN1_VALUE **pval,
140 		const unsigned char **in, long len, const ASN1_TEMPLATE *tt)
141 	{
142 	ASN1_TLC c;
143 	asn1_tlc_clear(&c);
144 	return asn1_template_ex_d2i(pval, in, len, tt, 0, &c);
145 	}
146 
147 
148 /* Decode an item, taking care of IMPLICIT tagging, if any.
149  * If 'opt' set and tag mismatch return -1 to handle OPTIONAL
150  */
151 
152 int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
153 			const ASN1_ITEM *it,
154 			int tag, int aclass, char opt, ASN1_TLC *ctx)
155 	{
156 	const ASN1_TEMPLATE *tt, *errtt = NULL;
157 	const ASN1_COMPAT_FUNCS *cf;
158 	const ASN1_EXTERN_FUNCS *ef;
159 	const ASN1_AUX *aux = it->funcs;
160 	ASN1_aux_cb *asn1_cb;
161 	const unsigned char *p = NULL, *q;
162 	unsigned char *wp=NULL;	/* BIG FAT WARNING!  BREAKS CONST WHERE USED */
163 	unsigned char imphack = 0, oclass;
164 	char seq_eoc, seq_nolen, cst, isopt;
165 	long tmplen;
166 	int i;
167 	int otag;
168 	int ret = 0;
169 	ASN1_VALUE *pchval, **pchptr, *ptmpval;
170 	if (!pval)
171 		return 0;
172 	if (aux && aux->asn1_cb)
173 		asn1_cb = aux->asn1_cb;
174 	else asn1_cb = 0;
175 
176 	switch(it->itype)
177 		{
178 		case ASN1_ITYPE_PRIMITIVE:
179 		if (it->templates)
180 			{
181 			/* tagging or OPTIONAL is currently illegal on an item
182 			 * template because the flags can't get passed down.
183 			 * In practice this isn't a problem: we include the
184 			 * relevant flags from the item template in the
185 			 * template itself.
186 			 */
187 			if ((tag != -1) || opt)
188 				{
189 				ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
190 				ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);
191 				goto err;
192 				}
193 			return asn1_template_ex_d2i(pval, in, len,
194 					it->templates, opt, ctx);
195 		}
196 		return asn1_d2i_ex_primitive(pval, in, len, it,
197 						tag, aclass, opt, ctx);
198 		break;
199 
200 		case ASN1_ITYPE_MSTRING:
201 		p = *in;
202 		/* Just read in tag and class */
203 		ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
204 						&p, len, -1, 0, 1, ctx);
205 		if (!ret)
206 			{
207 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
208 					ERR_R_NESTED_ASN1_ERROR);
209 			goto err;
210 			}
211 
212 		/* Must be UNIVERSAL class */
213 		if (oclass != V_ASN1_UNIVERSAL)
214 			{
215 			/* If OPTIONAL, assume this is OK */
216 			if (opt) return -1;
217 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
218 					ASN1_R_MSTRING_NOT_UNIVERSAL);
219 			goto err;
220 			}
221 		/* Check tag matches bit map */
222 		if (!(ASN1_tag2bit(otag) & it->utype))
223 			{
224 			/* If OPTIONAL, assume this is OK */
225 			if (opt)
226 				return -1;
227 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
228 					ASN1_R_MSTRING_WRONG_TAG);
229 			goto err;
230 			}
231 		return asn1_d2i_ex_primitive(pval, in, len,
232 						it, otag, 0, 0, ctx);
233 
234 		case ASN1_ITYPE_EXTERN:
235 		/* Use new style d2i */
236 		ef = it->funcs;
237 		return ef->asn1_ex_d2i(pval, in, len,
238 						it, tag, aclass, opt, ctx);
239 
240 		case ASN1_ITYPE_COMPAT:
241 		/* we must resort to old style evil hackery */
242 		cf = it->funcs;
243 
244 		/* If OPTIONAL see if it is there */
245 		if (opt)
246 			{
247 			int exptag;
248 			p = *in;
249 			if (tag == -1)
250 				exptag = it->utype;
251 			else exptag = tag;
252 			/* Don't care about anything other than presence
253 			 * of expected tag */
254 
255 			ret = asn1_check_tlen(NULL, NULL, NULL, NULL, NULL,
256 					&p, len, exptag, aclass, 1, ctx);
257 			if (!ret)
258 				{
259 				ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
260 					ERR_R_NESTED_ASN1_ERROR);
261 				goto err;
262 				}
263 			if (ret == -1)
264 				return -1;
265 			}
266 
267 		/* This is the old style evil hack IMPLICIT handling:
268 		 * since the underlying code is expecting a tag and
269 		 * class other than the one present we change the
270 		 * buffer temporarily then change it back afterwards.
271 		 * This doesn't and never did work for tags > 30.
272 		 *
273 		 * Yes this is *horrible* but it is only needed for
274 		 * old style d2i which will hopefully not be around
275 		 * for much longer.
276 		 * FIXME: should copy the buffer then modify it so
277 		 * the input buffer can be const: we should *always*
278 		 * copy because the old style d2i might modify the
279 		 * buffer.
280 		 */
281 
282 		if (tag != -1)
283 			{
284 			wp = *(unsigned char **)in;
285 			imphack = *wp;
286 			if (p == NULL)
287 				{
288 				ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
289 					ERR_R_NESTED_ASN1_ERROR);
290 				goto err;
291 				}
292 			*wp = (unsigned char)((*p & V_ASN1_CONSTRUCTED)
293 								| it->utype);
294 			}
295 
296 		ptmpval = cf->asn1_d2i(pval, in, len);
297 
298 		if (tag != -1)
299 			*wp = imphack;
300 
301 		if (ptmpval)
302 			return 1;
303 
304 		ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
305 		goto err;
306 
307 
308 		case ASN1_ITYPE_CHOICE:
309 		if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it))
310 				goto auxerr;
311 
312 		/* Allocate structure */
313 		if (!*pval && !ASN1_item_ex_new(pval, it))
314 			{
315 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
316 						ERR_R_NESTED_ASN1_ERROR);
317 			goto err;
318 			}
319 		/* CHOICE type, try each possibility in turn */
320 		pchval = NULL;
321 		p = *in;
322 		for (i = 0, tt=it->templates; i < it->tcount; i++, tt++)
323 			{
324 			pchptr = asn1_get_field_ptr(pval, tt);
325 			/* We mark field as OPTIONAL so its absence
326 			 * can be recognised.
327 			 */
328 			ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx);
329 			/* If field not present, try the next one */
330 			if (ret == -1)
331 				continue;
332 			/* If positive return, read OK, break loop */
333 			if (ret > 0)
334 				break;
335 			/* Otherwise must be an ASN1 parsing error */
336 			errtt = tt;
337 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
338 						ERR_R_NESTED_ASN1_ERROR);
339 			goto err;
340 			}
341 
342 		/* Did we fall off the end without reading anything? */
343 		if (i == it->tcount)
344 			{
345 			/* If OPTIONAL, this is OK */
346 			if (opt)
347 				{
348 				/* Free and zero it */
349 				ASN1_item_ex_free(pval, it);
350 				return -1;
351 				}
352 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
353 					ASN1_R_NO_MATCHING_CHOICE_TYPE);
354 			goto err;
355 			}
356 
357 		asn1_set_choice_selector(pval, i, it);
358 		*in = p;
359 		if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it))
360 				goto auxerr;
361 		return 1;
362 
363 		case ASN1_ITYPE_NDEF_SEQUENCE:
364 		case ASN1_ITYPE_SEQUENCE:
365 		p = *in;
366 		tmplen = len;
367 
368 		/* If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL */
369 		if (tag == -1)
370 			{
371 			tag = V_ASN1_SEQUENCE;
372 			aclass = V_ASN1_UNIVERSAL;
373 			}
374 		/* Get SEQUENCE length and update len, p */
375 		ret = asn1_check_tlen(&len, NULL, NULL, &seq_eoc, &cst,
376 					&p, len, tag, aclass, opt, ctx);
377 		if (!ret)
378 			{
379 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
380 					ERR_R_NESTED_ASN1_ERROR);
381 			goto err;
382 			}
383 		else if (ret == -1)
384 			return -1;
385 		if (aux && (aux->flags & ASN1_AFLG_BROKEN))
386 			{
387 			len = tmplen - (p - *in);
388 			seq_nolen = 1;
389 			}
390 		/* If indefinite we don't do a length check */
391 		else seq_nolen = seq_eoc;
392 		if (!cst)
393 			{
394 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
395 				ASN1_R_SEQUENCE_NOT_CONSTRUCTED);
396 			goto err;
397 			}
398 
399 		if (!*pval && !ASN1_item_ex_new(pval, it))
400 			{
401 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
402 				ERR_R_NESTED_ASN1_ERROR);
403 			goto err;
404 			}
405 
406 		if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it))
407 				goto auxerr;
408 
409 		/* Get each field entry */
410 		for (i = 0, tt = it->templates; i < it->tcount; i++, tt++)
411 			{
412 			const ASN1_TEMPLATE *seqtt;
413 			ASN1_VALUE **pseqval;
414 			seqtt = asn1_do_adb(pval, tt, 1);
415 			if (!seqtt)
416 				goto err;
417 			pseqval = asn1_get_field_ptr(pval, seqtt);
418 			/* Have we ran out of data? */
419 			if (!len)
420 				break;
421 			q = p;
422 			if (asn1_check_eoc(&p, len))
423 				{
424 				if (!seq_eoc)
425 					{
426 					ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
427 							ASN1_R_UNEXPECTED_EOC);
428 					goto err;
429 					}
430 				len -= p - q;
431 				seq_eoc = 0;
432 				q = p;
433 				break;
434 				}
435 			/* This determines the OPTIONAL flag value. The field
436 			 * cannot be omitted if it is the last of a SEQUENCE
437 			 * and there is still data to be read. This isn't
438 			 * strictly necessary but it increases efficiency in
439 			 * some cases.
440 			 */
441 			if (i == (it->tcount - 1))
442 				isopt = 0;
443 			else isopt = (char)(seqtt->flags & ASN1_TFLG_OPTIONAL);
444 			/* attempt to read in field, allowing each to be
445 			 * OPTIONAL */
446 
447 			ret = asn1_template_ex_d2i(pseqval, &p, len,
448 							seqtt, isopt, ctx);
449 			if (!ret)
450 				{
451 				errtt = seqtt;
452 				goto err;
453 				}
454 			else if (ret == -1)
455 				{
456 				/* OPTIONAL component absent.
457 				 * Free and zero the field.
458 				 */
459 				ASN1_template_free(pseqval, seqtt);
460 				continue;
461 				}
462 			/* Update length */
463 			len -= p - q;
464 			}
465 
466 		/* Check for EOC if expecting one */
467 		if (seq_eoc && !asn1_check_eoc(&p, len))
468 			{
469 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_MISSING_EOC);
470 			goto err;
471 			}
472 		/* Check all data read */
473 		if (!seq_nolen && len)
474 			{
475 			ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
476 					ASN1_R_SEQUENCE_LENGTH_MISMATCH);
477 			goto err;
478 			}
479 
480 		/* If we get here we've got no more data in the SEQUENCE,
481 		 * however we may not have read all fields so check all
482 		 * remaining are OPTIONAL and clear any that are.
483 		 */
484 		for (; i < it->tcount; tt++, i++)
485 			{
486 			const ASN1_TEMPLATE *seqtt;
487 			seqtt = asn1_do_adb(pval, tt, 1);
488 			if (!seqtt)
489 				goto err;
490 			if (seqtt->flags & ASN1_TFLG_OPTIONAL)
491 				{
492 				ASN1_VALUE **pseqval;
493 				pseqval = asn1_get_field_ptr(pval, seqtt);
494 				ASN1_template_free(pseqval, seqtt);
495 				}
496 			else
497 				{
498 				errtt = seqtt;
499 				ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
500 							ASN1_R_FIELD_MISSING);
501 				goto err;
502 				}
503 			}
504 		/* Save encoding */
505 		if (!asn1_enc_save(pval, *in, p - *in, it))
506 			goto auxerr;
507 		*in = p;
508 		if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it))
509 				goto auxerr;
510 		return 1;
511 
512 		default:
513 		return 0;
514 		}
515 	auxerr:
516 	ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_AUX_ERROR);
517 	err:
518 	ASN1_item_ex_free(pval, it);
519 	if (errtt)
520 		ERR_add_error_data(4, "Field=", errtt->field_name,
521 					", Type=", it->sname);
522 	else
523 		ERR_add_error_data(2, "Type=", it->sname);
524 	return 0;
525 	}
526 
527 /* Templates are handled with two separate functions.
528  * One handles any EXPLICIT tag and the other handles the rest.
529  */
530 
531 static int asn1_template_ex_d2i(ASN1_VALUE **val,
532 				const unsigned char **in, long inlen,
533 				const ASN1_TEMPLATE *tt, char opt,
534 							ASN1_TLC *ctx)
535 	{
536 	int flags, aclass;
537 	int ret;
538 	long len;
539 	const unsigned char *p, *q;
540 	char exp_eoc;
541 	if (!val)
542 		return 0;
543 	flags = tt->flags;
544 	aclass = flags & ASN1_TFLG_TAG_CLASS;
545 
546 	p = *in;
547 
548 	/* Check if EXPLICIT tag expected */
549 	if (flags & ASN1_TFLG_EXPTAG)
550 		{
551 		char cst;
552 		/* Need to work out amount of data available to the inner
553 		 * content and where it starts: so read in EXPLICIT header to
554 		 * get the info.
555 		 */
556 		ret = asn1_check_tlen(&len, NULL, NULL, &exp_eoc, &cst,
557 					&p, inlen, tt->tag, aclass, opt, ctx);
558 		q = p;
559 		if (!ret)
560 			{
561 			ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
562 					ERR_R_NESTED_ASN1_ERROR);
563 			return 0;
564 			}
565 		else if (ret == -1)
566 			return -1;
567 		if (!cst)
568 			{
569 			ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
570 					ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED);
571 			return 0;
572 			}
573 		/* We've found the field so it can't be OPTIONAL now */
574 		ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx);
575 		if (!ret)
576 			{
577 			ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
578 					ERR_R_NESTED_ASN1_ERROR);
579 			return 0;
580 			}
581 		/* We read the field in OK so update length */
582 		len -= p - q;
583 		if (exp_eoc)
584 			{
585 			/* If NDEF we must have an EOC here */
586 			if (!asn1_check_eoc(&p, len))
587 				{
588 				ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
589 						ASN1_R_MISSING_EOC);
590 				goto err;
591 				}
592 			}
593 		else
594 			{
595 			/* Otherwise we must hit the EXPLICIT tag end or its
596 			 * an error */
597 			if (len)
598 				{
599 				ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
600 					ASN1_R_EXPLICIT_LENGTH_MISMATCH);
601 				goto err;
602 				}
603 			}
604 		}
605 		else
606 			return asn1_template_noexp_d2i(val, in, inlen,
607 								tt, opt, ctx);
608 
609 	*in = p;
610 	return 1;
611 
612 	err:
613 	ASN1_template_free(val, tt);
614 	*val = NULL;
615 	return 0;
616 	}
617 
618 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
619 				const unsigned char **in, long len,
620 				const ASN1_TEMPLATE *tt, char opt,
621 				ASN1_TLC *ctx)
622 	{
623 	int flags, aclass;
624 	int ret;
625 	const unsigned char *p, *q;
626 	if (!val)
627 		return 0;
628 	flags = tt->flags;
629 	aclass = flags & ASN1_TFLG_TAG_CLASS;
630 
631 	p = *in;
632 	q = p;
633 
634 	if (flags & ASN1_TFLG_SK_MASK)
635 		{
636 		/* SET OF, SEQUENCE OF */
637 		int sktag, skaclass;
638 		char sk_eoc;
639 		/* First work out expected inner tag value */
640 		if (flags & ASN1_TFLG_IMPTAG)
641 			{
642 			sktag = tt->tag;
643 			skaclass = aclass;
644 			}
645 		else
646 			{
647 			skaclass = V_ASN1_UNIVERSAL;
648 			if (flags & ASN1_TFLG_SET_OF)
649 				sktag = V_ASN1_SET;
650 			else
651 				sktag = V_ASN1_SEQUENCE;
652 			}
653 		/* Get the tag */
654 		ret = asn1_check_tlen(&len, NULL, NULL, &sk_eoc, NULL,
655 					&p, len, sktag, skaclass, opt, ctx);
656 		if (!ret)
657 			{
658 			ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
659 						ERR_R_NESTED_ASN1_ERROR);
660 			return 0;
661 			}
662 		else if (ret == -1)
663 			return -1;
664 		if (!*val)
665 			*val = (ASN1_VALUE *)sk_new_null();
666 		else
667 			{
668 			/* We've got a valid STACK: free up any items present */
669 			STACK *sktmp = (STACK *)*val;
670 			ASN1_VALUE *vtmp;
671 			while(sk_num(sktmp) > 0)
672 				{
673 				vtmp = (ASN1_VALUE *)sk_pop(sktmp);
674 				ASN1_item_ex_free(&vtmp,
675 						ASN1_ITEM_ptr(tt->item));
676 				}
677 			}
678 
679 		if (!*val)
680 			{
681 			ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
682 						ERR_R_MALLOC_FAILURE);
683 			goto err;
684 			}
685 
686 		/* Read as many items as we can */
687 		while(len > 0)
688 			{
689 			ASN1_VALUE *skfield;
690 			q = p;
691 			/* See if EOC found */
692 			if (asn1_check_eoc(&p, len))
693 				{
694 				if (!sk_eoc)
695 					{
696 					ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
697 							ASN1_R_UNEXPECTED_EOC);
698 					goto err;
699 					}
700 				len -= p - q;
701 				sk_eoc = 0;
702 				break;
703 				}
704 			skfield = NULL;
705 			if (!ASN1_item_ex_d2i(&skfield, &p, len,
706 						ASN1_ITEM_ptr(tt->item),
707 						-1, 0, 0, ctx))
708 				{
709 				ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
710 					ERR_R_NESTED_ASN1_ERROR);
711 				goto err;
712 				}
713 			len -= p - q;
714 			if (!sk_push((STACK *)*val, (char *)skfield))
715 				{
716 				ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
717 						ERR_R_MALLOC_FAILURE);
718 				goto err;
719 				}
720 			}
721 		if (sk_eoc)
722 			{
723 			ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ASN1_R_MISSING_EOC);
724 			goto err;
725 			}
726 		}
727 	else if (flags & ASN1_TFLG_IMPTAG)
728 		{
729 		/* IMPLICIT tagging */
730 		ret = ASN1_item_ex_d2i(val, &p, len,
731 			ASN1_ITEM_ptr(tt->item), tt->tag, aclass, opt, ctx);
732 		if (!ret)
733 			{
734 			ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
735 						ERR_R_NESTED_ASN1_ERROR);
736 			goto err;
737 			}
738 		else if (ret == -1)
739 			return -1;
740 		}
741 	else
742 		{
743 		/* Nothing special */
744 		ret = ASN1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
745 							-1, 0, opt, ctx);
746 		if (!ret)
747 			{
748 			ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
749 					ERR_R_NESTED_ASN1_ERROR);
750 			goto err;
751 			}
752 		else if (ret == -1)
753 			return -1;
754 		}
755 
756 	*in = p;
757 	return 1;
758 
759 	err:
760 	ASN1_template_free(val, tt);
761 	*val = NULL;
762 	return 0;
763 	}
764 
765 static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
766 				const unsigned char **in, long inlen,
767 				const ASN1_ITEM *it,
768 				int tag, int aclass, char opt, ASN1_TLC *ctx)
769 	{
770 	int ret = 0, utype;
771 	long plen;
772 	char cst, inf, free_cont = 0;
773 	const unsigned char *p;
774 	BUF_MEM buf;
775 	const unsigned char *cont = NULL;
776 	long len;
777 	if (!pval)
778 		{
779 		ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_ILLEGAL_NULL);
780 		return 0; /* Should never happen */
781 		}
782 
783 	if (it->itype == ASN1_ITYPE_MSTRING)
784 		{
785 		utype = tag;
786 		tag = -1;
787 		}
788 	else
789 		utype = it->utype;
790 
791 	if (utype == V_ASN1_ANY)
792 		{
793 		/* If type is ANY need to figure out type from tag */
794 		unsigned char oclass;
795 		if (tag >= 0)
796 			{
797 			ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
798 					ASN1_R_ILLEGAL_TAGGED_ANY);
799 			return 0;
800 			}
801 		if (opt)
802 			{
803 			ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
804 					ASN1_R_ILLEGAL_OPTIONAL_ANY);
805 			return 0;
806 			}
807 		p = *in;
808 		ret = asn1_check_tlen(NULL, &utype, &oclass, NULL, NULL,
809 					&p, inlen, -1, 0, 0, ctx);
810 		if (!ret)
811 			{
812 			ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
813 					ERR_R_NESTED_ASN1_ERROR);
814 			return 0;
815 			}
816 		if (oclass != V_ASN1_UNIVERSAL)
817 			utype = V_ASN1_OTHER;
818 		}
819 	if (tag == -1)
820 		{
821 		tag = utype;
822 		aclass = V_ASN1_UNIVERSAL;
823 		}
824 	p = *in;
825 	/* Check header */
826 	ret = asn1_check_tlen(&plen, NULL, NULL, &inf, &cst,
827 				&p, inlen, tag, aclass, opt, ctx);
828 	if (!ret)
829 		{
830 		ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);
831 		return 0;
832 		}
833 	else if (ret == -1)
834 		return -1;
835 	/* SEQUENCE, SET and "OTHER" are left in encoded form */
836 	if ((utype == V_ASN1_SEQUENCE)
837 		|| (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER))
838 		{
839 		/* Clear context cache for type OTHER because the auto clear
840 		 * when we have a exact match wont work
841 		 */
842 		if (utype == V_ASN1_OTHER)
843 			{
844 			asn1_tlc_clear(ctx);
845 			}
846 		/* SEQUENCE and SET must be constructed */
847 		else if (!cst)
848 			{
849 			ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
850 				ASN1_R_TYPE_NOT_CONSTRUCTED);
851 			return 0;
852 			}
853 
854 		cont = *in;
855 		/* If indefinite length constructed find the real end */
856 		if (inf)
857 			{
858 			if (!asn1_find_end(&p, plen, inf))
859 				 goto err;
860 			len = p - cont;
861 			}
862 		else
863 			{
864 			len = p - cont + plen;
865 			p += plen;
866 			buf.data = NULL;
867 			}
868 		}
869 	else if (cst)
870 		{
871 		buf.length = 0;
872 		buf.max = 0;
873 		buf.data = NULL;
874 		/* Should really check the internal tags are correct but
875 		 * some things may get this wrong. The relevant specs
876 		 * say that constructed string types should be OCTET STRINGs
877 		 * internally irrespective of the type. So instead just check
878 		 * for UNIVERSAL class and ignore the tag.
879 		 */
880 		if (!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL))
881 			goto err;
882 		len = buf.length;
883 		/* Append a final null to string */
884 		if (!BUF_MEM_grow_clean(&buf, len + 1))
885 			{
886 			ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
887 						ERR_R_MALLOC_FAILURE);
888 			return 0;
889 			}
890 		buf.data[len] = 0;
891 		cont = (const unsigned char *)buf.data;
892 		free_cont = 1;
893 		}
894 	else
895 		{
896 		cont = p;
897 		len = plen;
898 		p += plen;
899 		}
900 
901 	/* We now have content length and type: translate into a structure */
902 	if (!asn1_ex_c2i(pval, cont, len, utype, &free_cont, it))
903 		goto err;
904 
905 	*in = p;
906 	ret = 1;
907 	err:
908 	if (free_cont && buf.data) OPENSSL_free(buf.data);
909 	return ret;
910 	}
911 
912 /* Translate ASN1 content octets into a structure */
913 
914 int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
915 			int utype, char *free_cont, const ASN1_ITEM *it)
916 	{
917 	ASN1_VALUE **opval = NULL;
918 	ASN1_STRING *stmp;
919 	ASN1_TYPE *typ = NULL;
920 	int ret = 0;
921 	const ASN1_PRIMITIVE_FUNCS *pf;
922 	ASN1_INTEGER **tint;
923 	pf = it->funcs;
924 
925 	if (pf && pf->prim_c2i)
926 		return pf->prim_c2i(pval, cont, len, utype, free_cont, it);
927 	/* If ANY type clear type and set pointer to internal value */
928 	if (it->utype == V_ASN1_ANY)
929 		{
930 		if (!*pval)
931 			{
932 			typ = ASN1_TYPE_new();
933 			if (typ == NULL)
934 				goto err;
935 			*pval = (ASN1_VALUE *)typ;
936 			}
937 		else
938 			typ = (ASN1_TYPE *)*pval;
939 
940 		if (utype != typ->type)
941 			ASN1_TYPE_set(typ, utype, NULL);
942 		opval = pval;
943 		pval = (ASN1_VALUE **)&typ->value.ptr;
944 		}
945 	switch(utype)
946 		{
947 		case V_ASN1_OBJECT:
948 		if (!c2i_ASN1_OBJECT((ASN1_OBJECT **)pval, &cont, len))
949 			goto err;
950 		break;
951 
952 		case V_ASN1_NULL:
953 		if (len)
954 			{
955 			ASN1err(ASN1_F_ASN1_EX_C2I,
956 						ASN1_R_NULL_IS_WRONG_LENGTH);
957 			goto err;
958 			}
959 		*pval = (ASN1_VALUE *)1;
960 		break;
961 
962 		case V_ASN1_BOOLEAN:
963 		if (len != 1)
964 			{
965 			ASN1err(ASN1_F_ASN1_EX_C2I,
966 						ASN1_R_BOOLEAN_IS_WRONG_LENGTH);
967 			goto err;
968 			}
969 		else
970 			{
971 			ASN1_BOOLEAN *tbool;
972 			tbool = (ASN1_BOOLEAN *)pval;
973 			*tbool = *cont;
974 			}
975 		break;
976 
977 		case V_ASN1_BIT_STRING:
978 		if (!c2i_ASN1_BIT_STRING((ASN1_BIT_STRING **)pval, &cont, len))
979 			goto err;
980 		break;
981 
982 		case V_ASN1_INTEGER:
983 		case V_ASN1_NEG_INTEGER:
984 		case V_ASN1_ENUMERATED:
985 		case V_ASN1_NEG_ENUMERATED:
986 		tint = (ASN1_INTEGER **)pval;
987 		if (!c2i_ASN1_INTEGER(tint, &cont, len))
988 			goto err;
989 		/* Fixup type to match the expected form */
990 		(*tint)->type = utype | ((*tint)->type & V_ASN1_NEG);
991 		break;
992 
993 		case V_ASN1_OCTET_STRING:
994 		case V_ASN1_NUMERICSTRING:
995 		case V_ASN1_PRINTABLESTRING:
996 		case V_ASN1_T61STRING:
997 		case V_ASN1_VIDEOTEXSTRING:
998 		case V_ASN1_IA5STRING:
999 		case V_ASN1_UTCTIME:
1000 		case V_ASN1_GENERALIZEDTIME:
1001 		case V_ASN1_GRAPHICSTRING:
1002 		case V_ASN1_VISIBLESTRING:
1003 		case V_ASN1_GENERALSTRING:
1004 		case V_ASN1_UNIVERSALSTRING:
1005 		case V_ASN1_BMPSTRING:
1006 		case V_ASN1_UTF8STRING:
1007 		case V_ASN1_OTHER:
1008 		case V_ASN1_SET:
1009 		case V_ASN1_SEQUENCE:
1010 		default:
1011 		/* All based on ASN1_STRING and handled the same */
1012 		if (!*pval)
1013 			{
1014 			stmp = ASN1_STRING_type_new(utype);
1015 			if (!stmp)
1016 				{
1017 				ASN1err(ASN1_F_ASN1_EX_C2I,
1018 							ERR_R_MALLOC_FAILURE);
1019 				goto err;
1020 				}
1021 			*pval = (ASN1_VALUE *)stmp;
1022 			}
1023 		else
1024 			{
1025 			stmp = (ASN1_STRING *)*pval;
1026 			stmp->type = utype;
1027 			}
1028 		/* If we've already allocated a buffer use it */
1029 		if (*free_cont)
1030 			{
1031 			if (stmp->data)
1032 				OPENSSL_free(stmp->data);
1033 			stmp->data = (unsigned char *)cont; /* UGLY CAST! RL */
1034 			stmp->length = len;
1035 			*free_cont = 0;
1036 			}
1037 		else
1038 			{
1039 			if (!ASN1_STRING_set(stmp, cont, len))
1040 				{
1041 				ASN1err(ASN1_F_ASN1_EX_C2I,
1042 							ERR_R_MALLOC_FAILURE);
1043 				ASN1_STRING_free(stmp);
1044 				*pval = NULL;
1045 				goto err;
1046 				}
1047 			}
1048 		break;
1049 		}
1050 	/* If ASN1_ANY and NULL type fix up value */
1051 	if (typ && (utype == V_ASN1_NULL))
1052 		 typ->value.ptr = NULL;
1053 
1054 	ret = 1;
1055 	err:
1056 	if (!ret)
1057 		{
1058 		ASN1_TYPE_free(typ);
1059 		if (opval)
1060 			*opval = NULL;
1061 		}
1062 	return ret;
1063 	}
1064 
1065 
1066 /* This function finds the end of an ASN1 structure when passed its maximum
1067  * length, whether it is indefinite length and a pointer to the content.
1068  * This is more efficient than calling asn1_collect because it does not
1069  * recurse on each indefinite length header.
1070  */
1071 
1072 static int asn1_find_end(const unsigned char **in, long len, char inf)
1073 	{
1074 	int expected_eoc;
1075 	long plen;
1076 	const unsigned char *p = *in, *q;
1077 	/* If not indefinite length constructed just add length */
1078 	if (inf == 0)
1079 		{
1080 		*in += len;
1081 		return 1;
1082 		}
1083 	expected_eoc = 1;
1084 	/* Indefinite length constructed form. Find the end when enough EOCs
1085 	 * are found. If more indefinite length constructed headers
1086 	 * are encountered increment the expected eoc count otherwise just
1087 	 * skip to the end of the data.
1088 	 */
1089 	while (len > 0)
1090 		{
1091 		if(asn1_check_eoc(&p, len))
1092 			{
1093 			expected_eoc--;
1094 			if (expected_eoc == 0)
1095 				break;
1096 			len -= 2;
1097 			continue;
1098 			}
1099 		q = p;
1100 		/* Just read in a header: only care about the length */
1101 		if(!asn1_check_tlen(&plen, NULL, NULL, &inf, NULL, &p, len,
1102 				-1, 0, 0, NULL))
1103 			{
1104 			ASN1err(ASN1_F_ASN1_FIND_END, ERR_R_NESTED_ASN1_ERROR);
1105 			return 0;
1106 			}
1107 		if (inf)
1108 			expected_eoc++;
1109 		else
1110 			p += plen;
1111 		len -= p - q;
1112 		}
1113 	if (expected_eoc)
1114 		{
1115 		ASN1err(ASN1_F_ASN1_FIND_END, ASN1_R_MISSING_EOC);
1116 		return 0;
1117 		}
1118 	*in = p;
1119 	return 1;
1120 	}
1121 /* This function collects the asn1 data from a constructred string
1122  * type into a buffer. The values of 'in' and 'len' should refer
1123  * to the contents of the constructed type and 'inf' should be set
1124  * if it is indefinite length.
1125  */
1126 
1127 static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
1128 				char inf, int tag, int aclass)
1129 	{
1130 	const unsigned char *p, *q;
1131 	long plen;
1132 	char cst, ininf;
1133 	p = *in;
1134 	inf &= 1;
1135 	/* If no buffer and not indefinite length constructed just pass over
1136 	 * the encoded data */
1137 	if (!buf && !inf)
1138 		{
1139 		*in += len;
1140 		return 1;
1141 		}
1142 	while(len > 0)
1143 		{
1144 		q = p;
1145 		/* Check for EOC */
1146 		if (asn1_check_eoc(&p, len))
1147 			{
1148 			/* EOC is illegal outside indefinite length
1149 			 * constructed form */
1150 			if (!inf)
1151 				{
1152 				ASN1err(ASN1_F_ASN1_COLLECT,
1153 					ASN1_R_UNEXPECTED_EOC);
1154 				return 0;
1155 				}
1156 			inf = 0;
1157 			break;
1158 			}
1159 
1160 		if (!asn1_check_tlen(&plen, NULL, NULL, &ininf, &cst, &p,
1161 					len, tag, aclass, 0, NULL))
1162 			{
1163 			ASN1err(ASN1_F_ASN1_COLLECT, ERR_R_NESTED_ASN1_ERROR);
1164 			return 0;
1165 			}
1166 
1167 		/* If indefinite length constructed update max length */
1168 		if (cst)
1169 			{
1170 #ifdef OPENSSL_ALLOW_NESTED_ASN1_STRINGS
1171 			if (!asn1_collect(buf, &p, plen, ininf, tag, aclass))
1172 				return 0;
1173 #else
1174 			ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_NESTED_ASN1_STRING);
1175 			return 0;
1176 #endif
1177 			}
1178 		else if (plen && !collect_data(buf, &p, plen))
1179 			return 0;
1180 		len -= p - q;
1181 		}
1182 	if (inf)
1183 		{
1184 		ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_MISSING_EOC);
1185 		return 0;
1186 		}
1187 	*in = p;
1188 	return 1;
1189 	}
1190 
1191 static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen)
1192 	{
1193 	int len;
1194 	if (buf)
1195 		{
1196 		len = buf->length;
1197 		if (!BUF_MEM_grow_clean(buf, len + plen))
1198 			{
1199 			ASN1err(ASN1_F_COLLECT_DATA, ERR_R_MALLOC_FAILURE);
1200 			return 0;
1201 			}
1202 		memcpy(buf->data + len, *p, plen);
1203 		}
1204 	*p += plen;
1205 	return 1;
1206 	}
1207 
1208 /* Check for ASN1 EOC and swallow it if found */
1209 
1210 static int asn1_check_eoc(const unsigned char **in, long len)
1211 	{
1212 	const unsigned char *p;
1213 	if (len < 2) return 0;
1214 	p = *in;
1215 	if (!p[0] && !p[1])
1216 		{
1217 		*in += 2;
1218 		return 1;
1219 		}
1220 	return 0;
1221 	}
1222 
1223 /* Check an ASN1 tag and length: a bit like ASN1_get_object
1224  * but it sets the length for indefinite length constructed
1225  * form, we don't know the exact length but we can set an
1226  * upper bound to the amount of data available minus the
1227  * header length just read.
1228  */
1229 
1230 static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
1231 				char *inf, char *cst,
1232 				const unsigned char **in, long len,
1233 				int exptag, int expclass, char opt,
1234 				ASN1_TLC *ctx)
1235 	{
1236 	int i;
1237 	int ptag, pclass;
1238 	long plen;
1239 	const unsigned char *p, *q;
1240 	p = *in;
1241 	q = p;
1242 
1243 	if (ctx && ctx->valid)
1244 		{
1245 		i = ctx->ret;
1246 		plen = ctx->plen;
1247 		pclass = ctx->pclass;
1248 		ptag = ctx->ptag;
1249 		p += ctx->hdrlen;
1250 		}
1251 	else
1252 		{
1253 		i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
1254 		if (ctx)
1255 			{
1256 			ctx->ret = i;
1257 			ctx->plen = plen;
1258 			ctx->pclass = pclass;
1259 			ctx->ptag = ptag;
1260 			ctx->hdrlen = p - q;
1261 			ctx->valid = 1;
1262 			/* If definite length, and no error, length +
1263 			 * header can't exceed total amount of data available.
1264 			 */
1265 			if (!(i & 0x81) && ((plen + ctx->hdrlen) > len))
1266 				{
1267 				ASN1err(ASN1_F_ASN1_CHECK_TLEN,
1268 							ASN1_R_TOO_LONG);
1269 				asn1_tlc_clear(ctx);
1270 				return 0;
1271 				}
1272 			}
1273 		}
1274 
1275 	if (i & 0x80)
1276 		{
1277 		ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_BAD_OBJECT_HEADER);
1278 		asn1_tlc_clear(ctx);
1279 		return 0;
1280 		}
1281 	if (exptag >= 0)
1282 		{
1283 		if ((exptag != ptag) || (expclass != pclass))
1284 			{
1285 			/* If type is OPTIONAL, not an error:
1286 			 * indicate missing type.
1287 			 */
1288 			if (opt) return -1;
1289 			asn1_tlc_clear(ctx);
1290 			ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_WRONG_TAG);
1291 			return 0;
1292 			}
1293 		/* We have a tag and class match:
1294 		 * assume we are going to do something with it */
1295 		asn1_tlc_clear(ctx);
1296 		}
1297 
1298 	if (i & 1)
1299 		plen = len - (p - q);
1300 
1301 	if (inf)
1302 		*inf = i & 1;
1303 
1304 	if (cst)
1305 		*cst = i & V_ASN1_CONSTRUCTED;
1306 
1307 	if (olen)
1308 		*olen = plen;
1309 
1310 	if (oclass)
1311 		*oclass = pclass;
1312 
1313 	if (otag)
1314 		*otag = ptag;
1315 
1316 	*in = p;
1317 	return 1;
1318 	}
1319