X-Git-Url: https://git.openssl.org/gitweb/?a=blobdiff_plain;ds=sidebyside;f=ssl%2Fssl_cert.c;h=d8b47e62099109d5016cc1d0a7333b1a22e1ef75;hb=d45ba43dab962bdc84158efc0cdddd5f5a08cf5e;hp=367f7a9603a4c3a00e9970c8a90ef04b72fac16c;hpb=ca3a82c3b364e1e584546f0f3bbb938b0b472580;p=openssl.git diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c index 367f7a9603..d8b47e6209 100644 --- a/ssl/ssl_cert.c +++ b/ssl/ssl_cert.c @@ -123,7 +123,7 @@ # include #endif -#include "o_dir.h" +#include "internal/o_dir.h" #include #include #include @@ -182,14 +182,13 @@ void ssl_cert_set_default_md(CERT *cert) CERT *ssl_cert_new(void) { - CERT *ret; + CERT *ret = OPENSSL_malloc(sizeof(*ret)); - ret = (CERT *)OPENSSL_malloc(sizeof(CERT)); if (ret == NULL) { SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE); return (NULL); } - memset(ret, 0, sizeof(CERT)); + memset(ret, 0, sizeof(*ret)); ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]); ret->references = 1; @@ -202,23 +201,17 @@ CERT *ssl_cert_new(void) CERT *ssl_cert_dup(CERT *cert) { - CERT *ret; + CERT *ret = OPENSSL_malloc(sizeof(*ret)); int i; - ret = (CERT *)OPENSSL_malloc(sizeof(CERT)); if (ret == NULL) { SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE); return (NULL); } - memset(ret, 0, sizeof(CERT)); - - ret->key = &ret->pkeys[cert->key - &cert->pkeys[0]]; - /* - * or ret->key = ret->pkeys + (cert->key - cert->pkeys), if you find that - * more readable - */ + memset(ret, 0, sizeof(*ret)); + ret->key = &ret->pkeys[cert->key - cert->pkeys]; ret->valid = cert->valid; ret->mask_k = cert->mask_k; ret->mask_a = cert->mask_a; @@ -398,24 +391,16 @@ void ssl_cert_clear_certs(CERT *c) return; for (i = 0; i < SSL_PKEY_NUM; i++) { CERT_PKEY *cpk = c->pkeys + i; - if (cpk->x509) { - X509_free(cpk->x509); - cpk->x509 = NULL; - } - if (cpk->privatekey) { - EVP_PKEY_free(cpk->privatekey); - cpk->privatekey = NULL; - } - if (cpk->chain) { - sk_X509_pop_free(cpk->chain, X509_free); - cpk->chain = NULL; - } + X509_free(cpk->x509); + cpk->x509 = NULL; + EVP_PKEY_free(cpk->privatekey); + cpk->privatekey = NULL; + sk_X509_pop_free(cpk->chain, X509_free); + cpk->chain = NULL; #ifndef OPENSSL_NO_TLSEXT - if (cpk->serverinfo) { - OPENSSL_free(cpk->serverinfo); - cpk->serverinfo = NULL; - cpk->serverinfo_length = 0; - } + OPENSSL_free(cpk->serverinfo); + cpk->serverinfo = NULL; + cpk->serverinfo_length = 0; #endif /* Clear all flags apart from explicit sign */ cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN; @@ -449,36 +434,24 @@ void ssl_cert_free(CERT *c) DH_free(c->dh_tmp); #endif #ifndef OPENSSL_NO_EC - if (c->ecdh_tmp) - EC_KEY_free(c->ecdh_tmp); + EC_KEY_free(c->ecdh_tmp); #endif ssl_cert_clear_certs(c); - if (c->peer_sigalgs) - OPENSSL_free(c->peer_sigalgs); - if (c->conf_sigalgs) - OPENSSL_free(c->conf_sigalgs); - if (c->client_sigalgs) - OPENSSL_free(c->client_sigalgs); - if (c->shared_sigalgs) - OPENSSL_free(c->shared_sigalgs); - if (c->ctypes) - OPENSSL_free(c->ctypes); - if (c->verify_store) - X509_STORE_free(c->verify_store); - if (c->chain_store) - X509_STORE_free(c->chain_store); - if (c->ciphers_raw) - OPENSSL_free(c->ciphers_raw); + OPENSSL_free(c->peer_sigalgs); + OPENSSL_free(c->conf_sigalgs); + OPENSSL_free(c->client_sigalgs); + OPENSSL_free(c->shared_sigalgs); + OPENSSL_free(c->ctypes); + X509_STORE_free(c->verify_store); + X509_STORE_free(c->chain_store); + OPENSSL_free(c->ciphers_raw); #ifndef OPENSSL_NO_TLSEXT custom_exts_free(&c->cli_ext); custom_exts_free(&c->srv_ext); #endif - if (c->pms) { - OPENSSL_cleanse(c->pms, c->pmslen); - OPENSSL_free(c->pms); - c->pms = NULL; - } + OPENSSL_clear_free(c->pms, c->pmslen); + c->pms = NULL; OPENSSL_free(c); } @@ -488,8 +461,7 @@ int ssl_cert_set0_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain) CERT_PKEY *cpk = s ? s->cert->key : ctx->cert->key; if (!cpk) return 0; - if (cpk->chain) - sk_X509_pop_free(cpk->chain, X509_free); + sk_X509_pop_free(cpk->chain, X509_free); for (i = 0; i < sk_X509_num(chain); i++) { r = ssl_security_cert(s, ctx, sk_X509_value(chain, i), 0, 0); if (r != 1) { @@ -598,13 +570,13 @@ SESS_CERT *ssl_sess_cert_new(void) { SESS_CERT *ret; - ret = OPENSSL_malloc(sizeof *ret); + ret = OPENSSL_malloc(sizeof(*ret)); if (ret == NULL) { SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE); return NULL; } - memset(ret, 0, sizeof *ret); + memset(ret, 0, sizeof(*ret)); ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]); ret->references = 1; @@ -632,19 +604,16 @@ void ssl_sess_cert_free(SESS_CERT *sc) #endif /* i == 0 */ - if (sc->cert_chain != NULL) - sk_X509_pop_free(sc->cert_chain, X509_free); + sk_X509_pop_free(sc->cert_chain, X509_free); for (i = 0; i < SSL_PKEY_NUM; i++) { - if (sc->peer_pkeys[i].x509 != NULL) - X509_free(sc->peer_pkeys[i].x509); + X509_free(sc->peer_pkeys[i].x509); #if 0 /* - * We don't have the peer's private key. These lines are just + * We don't have the peer's private key. This line is just * here as a reminder that we're still using a not-quite-appropriate * data structure. */ - if (sc->peer_pkeys[i].privatekey != NULL) - EVP_PKEY_free(sc->peer_pkeys[i].privatekey); + EVP_PKEY_free(sc->peer_pkeys[i].privatekey); #endif } @@ -655,8 +624,7 @@ void ssl_sess_cert_free(SESS_CERT *sc) DH_free(sc->peer_dh_tmp); #endif #ifndef OPENSSL_NO_EC - if (sc->peer_ecdh_tmp != NULL) - EC_KEY_free(sc->peer_ecdh_tmp); + EC_KEY_free(sc->peer_ecdh_tmp); #endif OPENSSL_free(sc); @@ -730,9 +698,7 @@ int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk) static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list, STACK_OF(X509_NAME) *name_list) { - if (*ca_list != NULL) - sk_X509_NAME_pop_free(*ca_list, X509_NAME_free); - + sk_X509_NAME_pop_free(*ca_list, X509_NAME_free); *ca_list = name_list; } @@ -868,18 +834,15 @@ STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file) sk_X509_NAME_push(ret, xn); } } + goto done; - if (0) { err: - if (ret != NULL) - sk_X509_NAME_pop_free(ret, X509_NAME_free); - ret = NULL; - } - if (sk != NULL) - sk_X509_NAME_free(sk); + sk_X509_NAME_pop_free(ret, X509_NAME_free); + ret = NULL; + done: + sk_X509_NAME_free(sk); BIO_free(in); - if (x != NULL) - X509_free(x); + X509_free(x); if (ret != NULL) ERR_clear_error(); return (ret); @@ -932,17 +895,14 @@ int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack, } ERR_clear_error(); + goto done; - if (0) { err: ret = 0; - } + done: BIO_free(in); - if (x != NULL) - X509_free(x); - + X509_free(x); (void)sk_X509_NAME_set_cmp_func(stack, oldcmp); - return ret; } @@ -1209,8 +1169,7 @@ int ssl_build_cert_chain(SSL *s, SSL_CTX *ctx, int flags) goto err; } } - if (cpk->chain) - sk_X509_pop_free(cpk->chain, X509_free); + sk_X509_pop_free(cpk->chain, X509_free); cpk->chain = chain; if (rv == 0) rv = 1; @@ -1228,8 +1187,7 @@ int ssl_cert_set_cert_store(CERT *c, X509_STORE *store, int chain, int ref) pstore = &c->chain_store; else pstore = &c->verify_store; - if (*pstore) - X509_STORE_free(*pstore); + X509_STORE_free(*pstore); *pstore = store; if (ref && store) CRYPTO_add(&store->references, 1, CRYPTO_LOCK_X509_STORE);