[openssl-commits] [openssl] OpenSSL_1_1_0-stable update

[matthias.st.pierre at ncp-e.com]

The branch OpenSSL_1_1_0-stable has been updated
       via  2c2d9dcd25b6a9e9c6522bfd030d6be5d8e1c92a (commit)
      from  f4be878edae21755fe83ef26f3f3821a2fe58a97 (commit)


- Log -----------------------------------------------------------------
commit 2c2d9dcd25b6a9e9c6522bfd030d6be5d8e1c92a
Author: Dr. Matthias St. Pierre <Matthias.St.Pierre at ncp-e.com>
Date:   Wed May 2 23:06:15 2018 +0200

    v3_purp.c: add locking to x509v3_cache_extensions()
    
    Fixes #6121
    
    Thanks to Mingtao Yang for reporting this bug.
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/6162)

-----------------------------------------------------------------------

Summary of changes:
 crypto/x509v3/v3_purp.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/crypto/x509v3/v3_purp.c b/crypto/x509v3/v3_purp.c
index 6d2f354..144de0c 100644
--- a/crypto/x509v3/v3_purp.c
+++ b/crypto/x509v3/v3_purp.c
@@ -78,11 +78,9 @@ int X509_check_purpose(X509 *x, int id, int ca)
 {
     int idx;
     const X509_PURPOSE *pt;
-    if (!(x->ex_flags & EXFLAG_SET)) {
-        CRYPTO_THREAD_write_lock(x->lock);
-        x509v3_cache_extensions(x);
-        CRYPTO_THREAD_unlock(x->lock);
-    }
+
+    x509v3_cache_extensions(x);
+
     /* Return if side-effect only call */
     if (id == -1)
         return 1;
@@ -354,8 +352,16 @@ static void x509v3_cache_extensions(X509 *x)
     X509_EXTENSION *ex;
 
     int i;
+
     if (x->ex_flags & EXFLAG_SET)
         return;
+
+    CRYPTO_THREAD_write_lock(x->lock);
+    if (x->ex_flags & EXFLAG_SET) {
+        CRYPTO_THREAD_unlock(x->lock);
+        return;
+    }
+
     X509_digest(x, EVP_sha1(), x->sha1_hash, NULL);
     /* V1 should mean no extensions ... */
     if (!X509_get_version(x))
@@ -489,6 +495,7 @@ static void x509v3_cache_extensions(X509 *x)
         }
     }
     x->ex_flags |= EXFLAG_SET;
+    CRYPTO_THREAD_unlock(x->lock);
 }
 
 /*-
@@ -541,11 +548,7 @@ void X509_set_proxy_pathlen(X509 *x, long l)
 
 int X509_check_ca(X509 *x)
 {
-    if (!(x->ex_flags & EXFLAG_SET)) {
-        CRYPTO_THREAD_write_lock(x->lock);
-        x509v3_cache_extensions(x);
-        CRYPTO_THREAD_unlock(x->lock);
-    }
+    x509v3_cache_extensions(x);
 
     return check_ca(x);
 }
@@ -759,6 +762,7 @@ int X509_check_issued(X509 *issuer, X509 *subject)
     if (X509_NAME_cmp(X509_get_subject_name(issuer),
                       X509_get_issuer_name(subject)))
         return X509_V_ERR_SUBJECT_ISSUER_MISMATCH;
+
     x509v3_cache_extensions(issuer);
     x509v3_cache_extensions(subject);