a ssl object needs it's own instance of a ecdh key; remove obsolete comment

[openssl.git] / ssl / ssl_cert.c

diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 93d2b13791ddf4ac47b886a8736544bd7ace949c..7908dcccdb8a8d0552059f4f802537a30cc1ecff 100644 (file)
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -121,7 +121,9 @@
 #include <openssl/bio.h>
 #include <openssl/pem.h>
 #include <openssl/x509v3.h>
+#ifndef OPENSSL_NO_DH
 #include <openssl/dh.h>
+#endif
 #include <openssl/bn.h>
 #include "ssl_locl.h"
 
@@ -198,7 +200,6 @@ CERT *ssl_cert_dup(CERT *cert)
 #ifndef OPENSSL_NO_DH
        if (cert->dh_tmp != NULL)
                {
-               /* DH parameters don't have a reference count */
                ret->dh_tmp = DHparams_dup(cert->dh_tmp);
                if (ret->dh_tmp == NULL)
                        {
@@ -232,8 +233,12 @@ CERT *ssl_cert_dup(CERT *cert)
 #ifndef OPENSSL_NO_ECDH
        if (cert->ecdh_tmp)
                {
-               EC_KEY_up_ref(cert->ecdh_tmp);
-               ret->ecdh_tmp = cert->ecdh_tmp;
+               ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp);
+               if (ret->ecdh_tmp == NULL)
+                       {
+                       SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_EC_LIB);
+                       goto err;
+                       }
                }
        ret->ecdh_tmp_cb = cert->ecdh_tmp_cb;
 #endif
@@ -635,14 +640,13 @@ STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file)
        BIO *in;
        X509 *x=NULL;
        X509_NAME *xn=NULL;
-       STACK_OF(X509_NAME) *ret,*sk;
+       STACK_OF(X509_NAME) *ret = NULL,*sk;
 
-       ret=sk_X509_NAME_new_null();
        sk=sk_X509_NAME_new(xname_cmp);
 
        in=BIO_new(BIO_s_file_internal());
 
-       if ((ret == NULL) || (sk == NULL) || (in == NULL))
+       if ((sk == NULL) || (in == NULL))
                {
                SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE,ERR_R_MALLOC_FAILURE);
                goto err;
@@ -655,6 +659,15 @@ STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file)
                {
                if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL)
                        break;
+               if (ret == NULL)
+                       {
+                       ret = sk_X509_NAME_new_null();
+                       if (ret == NULL)
+                               {
+                               SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE,ERR_R_MALLOC_FAILURE);
+                               goto err;
+                               }
+                       }
                if ((xn=X509_get_subject_name(x)) == NULL) goto err;
                /* check for duplicates */
                xn=X509_NAME_dup(xn);
@@ -677,6 +690,8 @@ err:
        if (sk != NULL) sk_X509_NAME_free(sk);
        if (in != NULL) BIO_free(in);
        if (x != NULL) X509_free(x);
+       if (ret != NULL)
+               ERR_clear_error();
        return(ret);
        }
 #endif