cryptCreateSignatureEx segfaults on ASN.1 objects; what am I doing wrong?

I'm using cryptAddCertExtension to add extensions to CRYPT_FORMAT_CMS, by
setting properties of a  CRYPT_CERTTYPE_CMS_ATTRIBUTES certificate and
feeding that as the last parameter to cryptCreateSignatureEx.  However,
cryptCreateSignatureEx segfaults if I populate the certificate extension
with ASN.1 data.

From the certs.c test code, I pulled

    const char *extensionData = "\x0C\x04Test";

    ...

    status = cryptSetAttribute( CRYPT_UNUSED,
       CRYPT_OPTION_CERT_SIGNUNRECOGNISEDATTRIBUTES, TRUE );
    status = cryptAddCertExtension( signatureAttributes, "1.2.3.4.5",
CRYPT_UNUSED, extensionData, 6 );  //Commenting this out prevents seg-fault


I changed TRUE to CRYPT_UNUSED;  I couldn't get it to work with any other
value.  This runs fine and is accepted as a parameter to
cryptCreateSignatureEx.  However, cryptCreateSignatureEx to find the
signature size segfaults.  (If I comment out the size-finding one and use a
hardcoded size, the real cryptCreateSignatureEx segfaults.)  Here's what the
invocation looks like:

    status = cryptCreateSignatureEx( NULL, 0, &signatureMaxLength,
      CRYPT_FORMAT_CMS, privKeyContext, hashContext, signatureAttributes );
//segfault occurs here

    signature = malloc( signatureMaxLength );
    if (!signature) {
      MYDBGL(DCRITICAL,"malloc failed!");
    }

    status = cryptCreateSignatureEx( signature, signatureMaxLength,
     &signatureLength, CRYPT_FORMAT_CMS, privKeyContext, hashContext,
     signatureAttributes ); //or else segfault here

I tried exporting the certificate myself manually but hit a permissions
problem.  Below is the gdb backtrace for the size-finding invocation of
cryptCreateSignatureEx.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7d086c0 (LWP 3220)]
0x080de869 in writeAttribute (stream=0xbfb6fd94,
attributeListPtrPtr=0xbfb6fc98, wrapperTagSet=1, complianceLevel=2) at
cert/ext_wr.c:588
588 if( ( attributeInfoPtr->typeInfoFlags & FL_ATTR_CRITICAL ) || \
Current language:  auto; currently c
(gdb) bt
#0  0x080de869 in writeAttribute (stream=0xbfb6fd94,
attributeListPtrPtr=0xbfb6fc98, wrapperTagSet=1, complianceLevel=2) at
cert/ext_wr.c:588
#1  0x080dede0 in writeCmsAttributes (stream=0xbfb6fd94,
attributeListPtr=0x825fa08, type=CRYPT_CERTTYPE_CMS_ATTRIBUTES,
attributeSize=109, complianceLevel=2) at cert/ext_wr.c:741
#2  0x080defe8 in writeAttributes (stream=0xbfb6fd94,
attributePtr=0x825fa08, type=CRYPT_CERTTYPE_CMS_ATTRIBUTES,
attributeSize=109) at cert/ext_wr.c:806
#3  0x080e735d in writeCmsAttributes (stream=0xbfb6fd94,
attributeInfoPtr=0x825f918, issuerCertInfoPtr=0x0, iIssuerCryptContext=-101)
at cert/write.c:1254
#4  0x08053d0c in exportCertData (certInfoPtr=0x825f918,
certFormat=CRYPT_ICERTFORMAT_DATA, certData=0x0, certDataMaxLength=0,
certDataLength=0xbfb6ff5c) at cryptcrt.c:390
#5  0x08054ca0 in certificateMessageFunction (objectInfoPtr=0x825f918,
message=MESSAGE_CRT_EXPORT, messageDataPtr=0xbfb6ff58, messageValue=10) at
cryptcrt.c:890
#6  0x08115e54 in dispatchMessage (localObjectHandle=709,
messageQueueData=0xbfb6fedc, objectInfoPtr=0x823fc5c, aclPtr=0x0) at
kernel/sendmsg.c:1171
#7  0x08116f48 in krnlSendMessage (objectHandle=709,
message=IMESSAGE_CRT_EXPORT, messageDataPtr=0xbfb6ff58, messageValue=10) at
kernel/sendmsg.c:1531
#8  0x0806031a in hashCmsAttributes (cmsAttributeInfo=0xbfb7030c,
iAttributeHash=387, lengthCheckOnly=1) at mechs/sign_cms.c:395
#9  0x08060805 in createCmsAttributes (cmsAttributeInfo=0xbfb7030c,
iCmsHashContext=0xbfb70080, hashAlgo=CRYPT_ALGO_SHA1, lengthCheckOnly=1) at
mechs/sign_cms.c:487
#10 0x08060ca3 in createSignatureCMS (signature=0x0, sigMaxLength=0,
signatureLength=0xbfb7064c, signContext=691, iHashContext=870,
useDefaultAuthAttr=0, iAuthAttr=709, iTspSession=-101,
    formatType=CRYPT_FORMAT_CMS) at mechs/sign_cms.c:591
#11 0x0805f166 in iCryptCreateSignature (signature=0x0,
signatureMaxLength=0, signatureLength=0xbfb7064c,
formatType=CRYPT_FORMAT_CMS, iSignContext=691, iHashContext=870,
    sigParams=0xbfb705e4) at mechs/sign.c:704
#12 0x0805e937 in cryptCreateSignatureEx (signature=0x0,
signatureMaxLength=0, signatureLength=0xbfb7064c,
formatType=CRYPT_FORMAT_CMS, signContext=691, hashContext=870,
extraData=709)
    at mechs/sign.c:420
#13 0x0804d59e in doCreateExtendedSignature (data=0x0, data_size_to_use=-1)
at client1.cpp:678
#14 0x0804db86 in main (argc=1, argv=0xbfb70974) at client1.cpp:194

The same result occurs when I use an ASN.1 object that I built at runtime
using the asn1c compiler (that object encodes and decodes fine using some
test routines).  I'm using cryptlib 3.3.3 on Linux.  What could I be doing
wrong?

Thanks,

Paul
------
www.cs.utsa.edu/~tparker

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.