[openssl-commits] [openssl] OpenSSL_1_1_0-stable update

[Richard Levitte]

The branch OpenSSL_1_1_0-stable has been updated
       via  7faab6869b09c7b66b52dd7b71469fe862157e32 (commit)
      from  ca1beab7c11f0fe5e2717adc85fcf4ee8a9b4ae1 (commit)


- Log -----------------------------------------------------------------
commit 7faab6869b09c7b66b52dd7b71469fe862157e32
Author: Rich Salz <rsalz at openssl.org>
Date:   Thu Apr 5 22:55:28 2018 -0400

    Fix bugs in X509_NAME_ENTRY_set
    
    The wrong "set" field was incremented in the wrong place and would
    create a new RDN, not a multi-valued RDN.
    RDN inserts would happen after not before.
    Prepending an entry to an RDN incorrectly created a new RDN
    
    Anything which built up an X509_NAME could get a messed-up structure,
    which would then be "wrong" for anyone using that name.
    
    Thanks to Ingo Schwarze for extensive debugging and the initial
    fix (documented in GitHub issue #5870).
    
    Reviewed-by: Paul Dale <paul.dale at oracle.com>
    (Merged from https://github.com/openssl/openssl/pull/5882)
    
    (cherry picked from commit bbf27cd58337116c57a1c942153330ff83d5540a)

-----------------------------------------------------------------------

Summary of changes:
 crypto/x509/x509name.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/crypto/x509/x509name.c b/crypto/x509/x509name.c
index f87dc7d..3dc781f 100644
--- a/crypto/x509/x509name.c
+++ b/crypto/x509/x509name.c
@@ -191,7 +191,7 @@ int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *ne, int loc,
         loc = n;
     else if (loc < 0)
         loc = n;
-
+    inc = (set == 0);
     name->modified = 1;
 
     if (set == -1) {
@@ -200,7 +200,6 @@ int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *ne, int loc,
             inc = 1;
         } else {
             set = sk_X509_NAME_ENTRY_value(sk, loc - 1)->set;
-            inc = 0;
         }
     } else {                    /* if (set >= 0) */
 
@@ -211,12 +210,11 @@ int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *ne, int loc,
                 set = 0;
         } else
             set = sk_X509_NAME_ENTRY_value(sk, loc)->set;
-        inc = (set == 0) ? 1 : 0;
     }
 
     /*
      * X509_NAME_ENTRY_dup is ASN1 generated code, that can't be easily
-     * const'ified; harmless cast as dup() don't modify its input.
+     * const'ified; harmless cast since dup() don't modify its input.
      */
     if ((new_name = X509_NAME_ENTRY_dup((X509_NAME_ENTRY *)ne)) == NULL)
         goto err;
@@ -228,7 +226,7 @@ int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *ne, int loc,
     if (inc) {
         n = sk_X509_NAME_ENTRY_num(sk);
         for (i = loc + 1; i < n; i++)
-            sk_X509_NAME_ENTRY_value(sk, i - 1)->set += 1;
+            sk_X509_NAME_ENTRY_value(sk, i)->set += 1;
     }
     return (1);
  err: