The previous commit to crypto/stack/*.[ch] pulled the type-safety strings

[openssl.git] / ssl / s2_clnt.c

diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c
index c7ec4c07d176fc1c1f3afbfa919a397cd02b171c..47dd09c286f398922daf505534394f67b0f66395 100644 (file)
--- a/ssl/s2_clnt.c
+++ b/ssl/s2_clnt.c
@@ -245,7 +245,7 @@ int ssl2_connect(SSL *s)
                /*      ERR_clear_error();*/
 
                        /* If we want to cache session-ids in the client
-                        * and we sucessfully add the session-id to the
+                        * and we successfully add the session-id to the
                         * cache, and there is a callback, then pass it out.
                         * 26/11/96 - eay - only add if not a re-used session.
                         */
@@ -368,7 +368,7 @@ static int get_server_hello(SSL *s)
                */
 #endif
 
-               /* we need to do this incase we were trying to reuse a 
+               /* we need to do this in case we were trying to reuse a 
                 * client session but others are already reusing it.
                 * If this was a new 'blank' session ID, the session-id
                 * length will still be 0 */
@@ -418,7 +418,7 @@ static int get_server_hello(SSL *s)
 
                /* In theory we could have ciphers sent back that we
                 * don't want to use but that does not matter since we
-                * will check against the list we origionally sent and
+                * will check against the list we originally sent and
                 * for performance reasons we should not bother to match
                 * the two lists up just to check. */
                for (i=0; i<sk_SSL_CIPHER_num(cl); i++)
@@ -435,26 +435,28 @@ static int get_server_hello(SSL *s)
                        return(-1);
                        }
                s->session->cipher=sk_SSL_CIPHER_value(cl,i);
-               }
 
-       if (s->session->peer != NULL)
-               X509_free(s->session->peer);
-
-#if 0 /* What is all this meant to accomplish?? */
-       /* hmmm, can we have the problem of the other session with this
-        * cert, Free's it before we increment the reference count. */
-       CRYPTO_w_lock(CRYPTO_LOCK_X509);
-       s->session->peer=s->session->sess_cert->key->x509;
-       /* Shouldn't do this: already locked */
-       /*CRYPTO_add(&s->session->peer->references,1,CRYPTO_LOCK_X509);*/
-       s->session->peer->references++;
-       CRYPTO_w_unlock(CRYPTO_LOCK_X509);
-#else
-       s->session->peer = s->session->sess_cert->peer_key->x509;
-       /* peer_key->x509 has been set by ssl2_set_certificate. */
-       CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509);
-#endif
 
+               if (s->session->peer != NULL) /* can't happen*/
+                       {
+                       ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
+                       SSLerr(SSL_F_GET_SERVER_HELLO, SSL_R_INTERNAL_ERROR);
+                       return(-1);
+                       }
+
+               s->session->peer = s->session->sess_cert->peer_key->x509;
+               /* peer_key->x509 has been set by ssl2_set_certificate. */
+               CRYPTO_add(&s->session->peer->references, 1, CRYPTO_LOCK_X509);
+               }
+
+       if (s->session->peer != s->session->sess_cert->peer_key->x509)
+               /* can't happen */
+               {
+               ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
+               SSLerr(SSL_F_GET_SERVER_HELLO, SSL_R_INTERNAL_ERROR);
+               return(-1);
+               }
+               
        s->s2->conn_id_length=s->s2->tmp.conn_id_length;
        memcpy(s->s2->conn_id,p,s->s2->tmp.conn_id_length);
        return(1);
@@ -766,7 +768,7 @@ static int client_certificate(SSL *s)
                        {
                        /* this is not good.  If things have failed it
                         * means there so something wrong with the key.
-                        * We will contiune with a 0 length signature
+                        * We will continue with a 0 length signature
                         */
                        }
                memset(&ctx,0,sizeof(ctx));
@@ -918,6 +920,7 @@ int ssl2_set_certificate(SSL *s, int type, int len, unsigned char *data)
                SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
                goto err;
                }
+       ERR_clear_error(); /* but we keep s->verify_result */
 
        /* server's cert for this session */
        sc=ssl_sess_cert_new();