Improved error handling and fixed minor bugs

Makefile.am

@@ -15,7 +15,7 @@ TEST_APP 	    = apps/xmlsec1$(EXEEXT)
 DEFAULT_CRYPTO	= @XMLSEC_DEFAULT_CRYPTO@
 
 bin_SCRIPTS 	= xmlsec1-config
-pkgconfig_DATA 	= xmlsec1.pc @XMLSEC_CRYPTO_PC_FILES_LIST@
+pkgconfig_DATA 	= @XMLSEC_PC_FILE@ @XMLSEC_CRYPTO_PC_FILES_LIST@
 pkgconfigdir 	= $(libdir)/pkgconfig
 confexecdir	= $(libdir)
 confexec_DATA 	= xmlsec1Conf.sh
@@ -58,14 +58,18 @@ EXTRA_DIST = \
 	xmlsecConf.sh.in \
 	xmlsec.spec.in \
 	xmlsec1Conf.sh \
-	xmlsec1.pc @XMLSEC_CRYPTO_PC_FILES_LIST@ \
+	@XMLSEC_PC_FILE@ @XMLSEC_CRYPTO_PC_FILES_LIST@ \
 	xmlsec1-config \
 	xmlsec1.spec \
 	xmlsec1.m4 \
 	$(NULL)
 
 EXTRA_CLEAN = \
-	examples \
+	examples/sign1 examples/sign2 examples/sign3 \
+	examples/verify1 examples/verify2 examples/verify3 examples/verify4 \
+	examples/encrypt1 examples/encrypt2 examples/encrypt3 \
+	examples/decrypt1 examples/decrypt2 examples/decrypt3 \
+	examples/xmldsigverify \
 	$(NULL)
 
 ABS_SRCDIR=@abs_srcdir@
@@ -99,6 +103,8 @@ docs-clean:
 docs-man:
 	@(cd man && $(MAKE) docs)
 
+if XMLSEC_APPS
+
 check: check-all check-info
 
 check-all: $(TEST_APP)
@@ -185,6 +191,15 @@ memcheck-crypto-%: $(TEST_APP)
 perfcheck: $(TEST_APP)
 	@(export PERF_TEST=10 && $(MAKE) check)
 
+else
+
+check:
+	@echo "Error: the test suite requires the xmlsec command line tool." 1>&2
+	@echo "Reconfigure with --enable-apps to build it and run the tests." 1>&2
+	@exit 1
+
+endif
+
 dist-hook:
 
 cleantar:

apps/cmdline.c

@@ -361,16 +361,27 @@ xmlSecAppCmdLineParamRead(xmlSecAppCmdLineParamPtr param, const char** argv, int
 static time_t
 xmlSecAppGetGmtTime(struct tm* timeptr) {
     time_t t1, t2;
+    struct tm* tmGmt;
 
     if(timeptr == NULL) {
         return(0);
     }
 
     /* t1 is gmt time "mapped" to localtime as-is */
     t1 = mktime(timeptr);
+    if(t1 == (time_t)-1) {
+        return((time_t)-1);
+    }
 
     /* t2 is "mapped" gmt time converted to gmt */
-    t2 = mktime(gmtime(&t1));
+    tmGmt = gmtime(&t1);
+    if(tmGmt == NULL) {
+        return((time_t)-1);
+    }
+    t2 = mktime(tmGmt);
+    if(t2 == (time_t)-1) {
+        return((time_t)-1);
+    }
 
     /* shift t1 back by the (t2 - t1) delta */
     return(t1 - (t2 - t1));
@@ -403,6 +414,25 @@ xmlSecAppCmdLineTimeParamRead(const char* str, time_t* t, int is_gmt_time) {
         return(-1);
     }
 
+    /* reject impossible dates (e.g. 2024-02-30); mktime() would
+     * silently normalize them to a date in the next month */
+    {
+        static const int daysInMonth[] = {31, 28, 31, 30, 31, 30,
+                                          31, 31, 30, 31, 30, 31};
+        int isLeap;
+        int maxDay;
+
+        isLeap = (((tm.tm_year % 4) == 0) && ((tm.tm_year % 100) != 0))
+                     || ((tm.tm_year % 400) == 0);
+        maxDay = daysInMonth[tm.tm_mon - 1];
+        if((tm.tm_mon == 2) && isLeap) {
+            maxDay = 29;
+        }
+        if(tm.tm_mday > maxDay) {
+            return(-1);
+        }
+    }
+
     tm.tm_year -= 1900; /* tm relative format year */
     tm.tm_mon  -= 1; /* tm relative format month */
 
@@ -411,5 +441,11 @@ xmlSecAppCmdLineTimeParamRead(const char* str, time_t* t, int is_gmt_time) {
     } else {
         (*t) = mktime(&tm);
     }
+    /* mktime()/XMLSEC_MKGMTIME() returns -1 for out-of-range dates;
+     * the parsed year is always >= 1900 so -1 cannot be a valid
+     * result here */
+    if(*t == (time_t)-1) {
+        return(-1);
+    }
     return(0);
 }

apps/crypto.c

@@ -131,6 +131,7 @@ xmlSecAppCryptoSimpleKeysMngrKeyAndCertsLoad(xmlSecKeysMngrPtr mngr,
     files += strlen(files) + 1;
     if(files[0] != '\0') {
         fprintf(stderr, "Error: X509 support is disabled\n");
+        xmlSecKeyDestroy(key);
         return(-1);
     }
 #endif /* XMLSEC_NO_X509 */

apps/xmlsec.c

@@ -1011,7 +1011,6 @@ xmlSecKeysMngrPtr gKeysMngr = NULL;
 int repeats = 1;
 int print_debug = 0;
 int print_verbose_debug = 0;
-int block_network_io = 0;
 clock_t total_time = 0;
 const char* xmlsec_crypto = NULL;
 const char* tmp = NULL;
@@ -2371,29 +2370,6 @@ xmlSecAppInputMatchCallback(char const* filename) {
         }
     }
 
-    if(block_network_io != 0) {
-        static const xmlChar http[] = "http://";
-        static const xmlChar https[] = "https://";
-        static const xmlChar ftp[] = "ftp://";
-        if(xmlStrncasecmp(BAD_CAST filename, http, xmlStrlen(http)) == 0) {
-            if(print_verbose_debug != 0) {
-                fprintf(stderr, "Debug: blocking access to \"%s\"\n", filename);
-            }
-            return(1);
-        }
-        if(xmlStrncasecmp(BAD_CAST filename, https, xmlStrlen(https)) == 0) {
-            if(print_verbose_debug != 0) {
-                fprintf(stderr, "Debug: blocking access to \"%s\"\n", filename);
-            }
-            return(1);
-        }
-        if(xmlStrncasecmp(BAD_CAST filename, ftp, xmlStrlen(ftp)) == 0) {
-            if(print_verbose_debug != 0) {
-                fprintf(stderr, "Debug: blocking access to \"%s\"\n", filename);
-            }
-            return(1);
-        }
-    }
     return(0);
 }
 

autogen.sh

@@ -1,11 +1,11 @@
 #!/bin/sh
 # Run this to generate all the initial makefiles, etc.
 
-srcdir=`dirname $0`
+srcdir=`dirname "$0"`
 test -z "$srcdir" && srcdir=.
 
 THEDIR=`pwd`
-cd $srcdir
+cd "$srcdir"
 DIE=0
 
 (autoconf --version) < /dev/null > /dev/null 2>&1 || {
@@ -82,18 +82,18 @@ automake --gnu --add-missing
 echo "Running autoconf..."
 autoconf
 echo "Running autoreconf..."
-autoreconf -i
+autoreconf -fi || exit 1
 
-cd $THEDIR
+cd "$THEDIR"
 
-if test x$OBJ_DIR != x; then
+if test x"$OBJ_DIR" != x; then
     mkdir -p "$OBJ_DIR"
     cd "$OBJ_DIR"
 fi
 
 conf_flags="--enable-maintainer-mode" #--enable-iso-c
 echo Running configure $conf_flags "$@" ...
-$srcdir/configure $conf_flags "$@"
+$srcdir/configure $conf_flags "$@" || exit 1
 
 echo
 echo "Now type 'make' to compile xmlsec."