[openssl-commits] [openssl] master update

Rich Salz rsalz at openssl.org
Mon Apr 4 19:05:29 UTC 2016


The branch master has been updated
       via  f6c006ea76304a52cf9212695525e1bcc6cf6c22 (commit)
       via  c5137473bdc7bcf7c43b4bd5d28827f8ddd70490 (commit)
       via  97458daade31c32ea8816b7e065e3bda3be588fa (commit)
       via  0517538d1a39bc5eb664928a6c40b4a0afad01da (commit)
      from  6c13488c4e75ef839bc07a3ce428289aef4bd267 (commit)


- Log -----------------------------------------------------------------
commit f6c006ea76304a52cf9212695525e1bcc6cf6c22
Author: FdaSilvaYY <fdasilvayy at gmail.com>
Date:   Sun Apr 3 23:37:58 2016 +0200

    Fix a possible leak on NETSCAPE_SPKI_verify failure.
    
    Reviewed-by: Stephen Henson <steve at openssl.org>
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit c5137473bdc7bcf7c43b4bd5d28827f8ddd70490
Author: FdaSilvaYY <fdasilvayy at gmail.com>
Date:   Sun Apr 3 23:37:32 2016 +0200

    Use X509_REQ_get0_pubkey
    
    Reviewed-by: Stephen Henson <steve at openssl.org>
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 97458daade31c32ea8816b7e065e3bda3be588fa
Author: FdaSilvaYY <fdasilvayy at gmail.com>
Date:   Sun Apr 3 23:24:51 2016 +0200

    Add X509_REQ_get0_pubkey method
    
    Reviewed-by: Stephen Henson <steve at openssl.org>
    Reviewed-by: Rich Salz <rsalz at openssl.org>

commit 0517538d1a39bc5eb664928a6c40b4a0afad01da
Author: FdaSilvaYY <fdasilvayy at gmail.com>
Date:   Thu Mar 17 00:15:48 2016 +0100

    Fix two leaks in X509_REQ_to_X509
    
    Issue #182
    
    Reviewed-by: Stephen Henson <steve at openssl.org>
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/ca.c                      |  6 +++---
 apps/req.c                     | 19 +++++++------------
 apps/x509.c                    |  6 ++----
 crypto/x509/x509_r2x.c         | 11 +++++++----
 crypto/x509/x509_req.c         |  7 +++++++
 doc/crypto/X509_get_pubkey.pod | 12 +++++++-----
 include/openssl/x509.h         |  1 +
 util/libcrypto.num             |  1 +
 8 files changed, 35 insertions(+), 28 deletions(-)

diff --git a/apps/ca.c b/apps/ca.c
index 3062d7e..cc74c5b 100644
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -1351,12 +1351,12 @@ static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
         ok = 0;
         goto end;
     }
-    if ((pktmp = X509_REQ_get_pubkey(req)) == NULL) {
+    if ((pktmp = X509_REQ_get0_pubkey(req)) == NULL) {
         BIO_printf(bio_err, "error unpacking public key\n");
         goto end;
     }
     i = X509_REQ_verify(req, pktmp);
-    EVP_PKEY_free(pktmp);
+    pktmp = NULL;
     if (i < 0) {
         ok = 0;
         BIO_printf(bio_err, "Signature verification problems....\n");
@@ -1790,7 +1790,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
     pktmp = X509_REQ_get_pubkey(req);
     i = X509_set_pubkey(ret, pktmp);
-    EVP_PKEY_free(pktmp);
     if (!i)
         goto end;
 
@@ -2072,6 +2071,7 @@ static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey,
 
     j = NETSCAPE_SPKI_verify(spki, pktmp);
     if (j <= 0) {
+        EVP_PKEY_free(pktmp);
         BIO_printf(bio_err,
                    "signature verification failed on SPKAC public key\n");
         goto end;
diff --git a/apps/req.c b/apps/req.c
index edf998b..561cccc 100644
--- a/apps/req.c
+++ b/apps/req.c
@@ -375,6 +375,7 @@ int req_main(int argc, char **argv)
     if (!nmflag_set)
         nmflag = XN_FLAG_ONELINE;
 
+    /* TODO: simplify this as pkey is still always NULL here */ 
     private = newreq && (pkey == NULL) ? 1 : 0;
 
     if (!app_passwd(passargin, passargout, &passin, &passout)) {
@@ -666,10 +667,9 @@ int req_main(int argc, char **argv)
             if (!X509_set_subject_name
                 (x509ss, X509_REQ_get_subject_name(req)))
                 goto end;
-            tmppkey = X509_REQ_get_pubkey(req);
+            tmppkey = X509_REQ_get0_pubkey(req);
             if (!tmppkey || !X509_set_pubkey(x509ss, tmppkey))
                 goto end;
-            EVP_PKEY_free(tmppkey);
 
             /* Set up V3 context struct */
 
@@ -739,20 +739,15 @@ int req_main(int argc, char **argv)
     }
 
     if (verify && !x509) {
-        int tmp = 0;
+        EVP_PKEY *pubkey = pkey;
 
-        if (pkey == NULL) {
-            pkey = X509_REQ_get_pubkey(req);
-            tmp = 1;
-            if (pkey == NULL)
+        if (pubkey == NULL) {
+            pubkey = X509_REQ_get0_pubkey(req);
+            if (pubkey == NULL)
                 goto end;
         }
 
-        i = X509_REQ_verify(req, pkey);
-        if (tmp) {
-            EVP_PKEY_free(pkey);
-            pkey = NULL;
-        }
+        i = X509_REQ_verify(req, pubkey);
 
         if (i < 0) {
             goto end;
diff --git a/apps/x509.c b/apps/x509.c
index 00c0d97..bc56233 100644
--- a/apps/x509.c
+++ b/apps/x509.c
@@ -562,12 +562,11 @@ int x509_main(int argc, char **argv)
             goto end;
         }
 
-        if ((pkey = X509_REQ_get_pubkey(req)) == NULL) {
+        if ((pkey = X509_REQ_get0_pubkey(req)) == NULL) {
             BIO_printf(bio_err, "error unpacking public key\n");
             goto end;
         }
         i = X509_REQ_verify(req, pkey);
-        EVP_PKEY_free(pkey);
         if (i < 0) {
             BIO_printf(bio_err, "Signature verification error\n");
             ERR_print_errors(bio_err);
@@ -607,9 +606,8 @@ int x509_main(int argc, char **argv)
         if (fkey)
             X509_set_pubkey(x, fkey);
         else {
-            pkey = X509_REQ_get_pubkey(req);
+            pkey = X509_REQ_get0_pubkey(req);
             X509_set_pubkey(x, pkey);
-            EVP_PKEY_free(pkey);
         }
     } else
         x = load_cert(infile, informat, "Certificate");
diff --git a/crypto/x509/x509_r2x.c b/crypto/x509/x509_r2x.c
index a6c5941..d082636 100644
--- a/crypto/x509/x509_r2x.c
+++ b/crypto/x509/x509_r2x.c
@@ -70,10 +70,11 @@ X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
     X509 *ret = NULL;
     X509_CINF *xi = NULL;
     X509_NAME *xn;
+    EVP_PKEY *pubkey = NULL;
 
     if ((ret = X509_new()) == NULL) {
         X509err(X509_F_X509_REQ_TO_X509, ERR_R_MALLOC_FAILURE);
-        goto err;
+        return NULL;
     }
 
     /* duplicate the request */
@@ -89,9 +90,9 @@ X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
     }
 
     xn = X509_REQ_get_subject_name(r);
-    if (X509_set_subject_name(ret, X509_NAME_dup(xn)) == 0)
+    if (X509_set_subject_name(ret, xn) == 0)
         goto err;
-    if (X509_set_issuer_name(ret, X509_NAME_dup(xn)) == 0)
+    if (X509_set_issuer_name(ret, xn) == 0)
         goto err;
 
     if (X509_gmtime_adj(xi->validity.notBefore, 0) == NULL)
@@ -100,7 +101,9 @@ X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
         NULL)
         goto err;
 
-    X509_set_pubkey(ret, X509_REQ_get_pubkey(r));
+    pubkey = X509_REQ_get0_pubkey(r);
+    if (pubkey == NULL || !X509_set_pubkey(ret, pubkey))
+        goto err;
 
     if (!X509_sign(ret, pkey, EVP_md5()))
         goto err;
diff --git a/crypto/x509/x509_req.c b/crypto/x509/x509_req.c
index c67f609..2b2cbce 100644
--- a/crypto/x509/x509_req.c
+++ b/crypto/x509/x509_req.c
@@ -115,6 +115,13 @@ EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
     return (X509_PUBKEY_get(req->req_info.pubkey));
 }
 
+EVP_PKEY *X509_REQ_get0_pubkey(X509_REQ *req)
+{
+    if (req == NULL)
+        return NULL;
+    return (X509_PUBKEY_get0(req->req_info.pubkey));
+}
+
 X509_PUBKEY *X509_REQ_get_X509_PUBKEY(X509_REQ *req)
 {
     return req->req_info.pubkey;
diff --git a/doc/crypto/X509_get_pubkey.pod b/doc/crypto/X509_get_pubkey.pod
index 2740f98..c2fb5c0 100644
--- a/doc/crypto/X509_get_pubkey.pod
+++ b/doc/crypto/X509_get_pubkey.pod
@@ -3,8 +3,9 @@
 =head1 NAME
 
 X509_get_pubkey, X509_get0_pubkey, X509_set_pubkey, X509_get_X509_PUBKEY,
-X509_REQ_get_pubkey, X509_REQ_set_pubkey, X509_REQ_get_X509_PUBKEY - get or
-set certificate or certificate request public key.
+X509_REQ_get_pubkey, X509_REQ_get0_pubkey, X509_REQ_set_pubkey, 
+X509_REQ_get_X509_PUBKEY - get or set certificate or certificate request 
+public key.
 
 =head1 SYNOPSIS
 
@@ -16,6 +17,7 @@ set certificate or certificate request public key.
  X509_PUBKEY *X509_get_X509_PUBKEY(X509 *x);
 
  EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req);
+ EVP_PKEY *X509_REQ_get0_pubkey(X509_REQ *req);
  int X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey);
  X509_PUBKEY *X509_REQ_get_X509_PUBKEY(X509_REQ *x);
 
@@ -35,8 +37,8 @@ must not be freed up after use.
 X509_set_pubkey() attempts to set the public key for certificate B<x> to
 B<pkey>. The key B<pkey> should be freed up after use.
 
-X509_REQ_get_pubkey(), X509_REQ_set_pubkey() and X509_REQ_get_X509_PUBKEY()
-are similar but operate on certificate request B<req>.
+X509_REQ_get_pubkey(), X509_REQ_get0_pubkey(), X509_REQ_set_pubkey() and 
+X509_REQ_get_X509_PUBKEY() are similar but operate on certificate request B<req>.
 
 =head1 NOTES
 
@@ -51,7 +53,7 @@ X509_get_pubkey(), X509_get0_pubkey(), X509_get_X509_PUBKEY(),
 X509_REQ_get_pubkey() and X509_REQ_get_X509_PUBKEY() return a public key or
 B<NULL> if an error occurred.
 
-X509_set_pubkey() and X509_REQ_set_pubkey() rerturn 1 for success and 0
+X509_set_pubkey() and X509_REQ_set_pubkey() return 1 for success and 0
 for failure.
 
 =head1 SEE ALSO
diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 4f22dc3..ae2fb1d 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -696,6 +696,7 @@ int X509_REQ_get_signature_nid(const X509_REQ *req);
 int i2d_re_X509_REQ_tbs(X509_REQ *req, unsigned char **pp);
 int X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey);
 EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req);
+EVP_PKEY *X509_REQ_get0_pubkey(X509_REQ *req);
 X509_PUBKEY *X509_REQ_get_X509_PUBKEY(X509_REQ *req);
 int X509_REQ_extension_nid(int nid);
 int *X509_REQ_get_extension_nids(void);
diff --git a/util/libcrypto.num b/util/libcrypto.num
index e1ca4ef..581a84b 100644
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -4124,3 +4124,4 @@ DSA_meth_get_sign_setup                 3989	1_1_0	EXIST::FUNCTION:DSA
 DSA_get0_engine                         3990	1_1_0	EXIST::FUNCTION:DSA
 X509_VERIFY_PARAM_set_auth_level        3991	1_1_0	EXIST::FUNCTION:
 X509_VERIFY_PARAM_get_auth_level        3992	1_1_0	EXIST::FUNCTION:
+X509_REQ_get0_pubkey                    3993	1_1_0	EXIST::FUNCTION:


More information about the openssl-commits mailing list