From 5ace30b5c45c8901bf08ce0f5e0e3152b52b0680 Mon Sep 17 00:00:00 2001
From: job <job@openbsd.org>
Date: Sun, 30 Apr 2023 16:46:49 +0000
Subject: [PATCH] Revert disablement of the encoding cache

Without the cache, we verify CRL signatures on bytes that have been
pulled through d2i_ -> i2d_, this can cause reordering, which in turn
invalidates the signature. for example if in the original CRL revocation
entries were sorted by date instead of ascending serial number order.

There are probably multiple things we can do here, but they will need
careful consideration and planning.

OK jsing@
---
 lib/libcrypto/asn1/tasn_dec.c | 11 ++++++++---
 lib/libcrypto/asn1/tasn_enc.c | 10 +++++++++-
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/lib/libcrypto/asn1/tasn_dec.c b/lib/libcrypto/asn1/tasn_dec.c
index ac59cc7e215..8964d467c28 100644
--- a/lib/libcrypto/asn1/tasn_dec.c
+++ b/lib/libcrypto/asn1/tasn_dec.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_dec.c,v 1.85 2023/04/28 17:59:53 job Exp $ */
+/* $OpenBSD: tasn_dec.c,v 1.86 2023/04/30 16:46:49 job Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -736,7 +736,7 @@ static int
 asn1_item_d2i_sequence(ASN1_VALUE **pval, CBS *cbs, const ASN1_ITEM *it,
     int tag_number, int tag_class, int optional, int depth)
 {
-	CBS cbs_seq, cbs_seq_content;
+	CBS cbs_seq, cbs_seq_content, cbs_object;
 	int constructed, indefinite, optional_field;
 	const ASN1_TEMPLATE *errat = NULL;
 	const ASN1_TEMPLATE *seqat, *at;
@@ -878,9 +878,14 @@ asn1_item_d2i_sequence(ASN1_VALUE **pval, CBS *cbs, const ASN1_ITEM *it,
 		ASN1_template_free(pseqval, seqat);
 	}
 
-	if (!CBS_skip(cbs, CBS_offset(&cbs_seq)))
+	if (!CBS_get_bytes(cbs, &cbs_object, CBS_offset(&cbs_seq)))
 		goto err;
 
+	if (!asn1_enc_save(&aseq, &cbs_object, it)) {
+		ASN1error(ERR_R_MALLOC_FAILURE);
+		goto err;
+	}
+
 	if (asn1_cb != NULL && !asn1_cb(ASN1_OP_D2I_POST, &aseq, it, NULL)) {
 		ASN1error(ASN1_R_AUX_ERROR);
 		goto err;
diff --git a/lib/libcrypto/asn1/tasn_enc.c b/lib/libcrypto/asn1/tasn_enc.c
index 430e8e1e8ec..bbe8a2e9491 100644
--- a/lib/libcrypto/asn1/tasn_enc.c
+++ b/lib/libcrypto/asn1/tasn_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_enc.c,v 1.30 2023/04/28 17:59:53 job Exp $ */
+/* $OpenBSD: tasn_enc.c,v 1.31 2023/04/30 16:46:49 job Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -210,6 +210,14 @@ ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it,
 		/* fall through */
 
 	case ASN1_ITYPE_SEQUENCE:
+		i = asn1_enc_restore(&seqcontlen, out, pval, it);
+		/* An error occurred */
+		if (i < 0)
+			return 0;
+		/* We have a valid cached encoding... */
+		if (i > 0)
+			return seqcontlen;
+		/* Otherwise carry on */
 		seqcontlen = 0;
 		/* If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL */
 		if (tag == -1) {
-- 
2.20.1