Changeset 6053 for pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

Timestamp:

Aug 28, 2019 9:32:26 AM (5 years ago)

Author:

riza

Message:

Re #2220: Fixed the use of sk_X509_NAME_new macro. It might lead to build failure or runtime crash. Thanks to Peter Koletzki for the fix.

File:

• pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c (modified) (2 diffs)

pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

@@ -701 +701 @@
 }
 
+static int xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b) {
+  return X509_NAME_cmp(*a, *b);
+}
 
 /* Create and initialize new SSL context and instance */
@@ -1065 +1068 @@
      */
     if (cert && ssock->is_server) {
-        STACK_OF(X509_NAME) *ca_dn = NULL;
-
-        if (cert->CA_file.slen > 0) {
-            ca_dn = SSL_load_client_CA_file(cert->CA_file.ptr);
-        } else if (cert->CA_buf.slen > 0) {
-            X509      *x  = NULL;
-            X509_NAME *xn = NULL;
-            STACK_OF(X509_NAME) *sk = NULL;
-            BIO *bio = BIO_new_mem_buf((void*)cert->CA_buf.ptr,
-                                       cert->CA_buf.slen);
-
-            sk = sk_X509_NAME_new((sk_X509_NAME_compfunc)X509_NAME_cmp);
-
-            if (sk != NULL && bio != NULL) {
-                for (;;) {
-                    if (PEM_read_bio_X509(bio, &x, NULL, NULL) == NULL)
-                        break;
-
-                    if (ca_dn == NULL) {
-                        ca_dn = sk_X509_NAME_new_null();
-
-                        if (ca_dn == NULL)
-                            break;
-                    }
-
-                    if ((xn = X509_get_subject_name(x)) == NULL)
-                        break;
-
-                    if ((xn = X509_NAME_dup(xn)) == NULL )
-                        break;
-
-                    if (sk_X509_NAME_find(sk, xn) >= 0) {
-                        X509_NAME_free(xn);
-                    } else {
-                        sk_X509_NAME_push(sk, xn);
-                        sk_X509_NAME_push(ca_dn, xn);
-                    }
-                }
-            }
-            if (sk != NULL)
-                sk_X509_NAME_free(sk);
-            if (bio != NULL)
-                BIO_free(bio);
-        }
-
-        if (ca_dn != NULL)
-            SSL_CTX_set_client_CA_list(ctx, ca_dn);
+        STACK_OF(X509_NAME) *ca_dn = NULL;
+
+        if (cert->CA_file.slen > 0) {
+            ca_dn = SSL_load_client_CA_file(cert->CA_file.ptr);
+        } else if (cert->CA_buf.slen > 0) {
+            X509      *x  = NULL;
+            X509_NAME *xn = NULL;
+            STACK_OF(X509_NAME) *sk = NULL;
+            BIO *new_bio = BIO_new_mem_buf((void*)cert->CA_buf.ptr,
+                                           cert->CA_buf.slen);
+
+            sk = sk_X509_NAME_new(xname_cmp);
+
+            if (sk != NULL && new_bio != NULL) {
+                for (;;) {
+                    if (PEM_read_bio_X509(new_bio, &x, NULL, NULL) == NULL)
+                        break;
+
+                    if ((xn = X509_get_subject_name(x)) == NULL)
+                        break;
+
+                    if ((xn = X509_NAME_dup(xn)) == NULL )
+                        break;
+
+                    if (sk_X509_NAME_find(sk, xn) >= 0) {
+                        X509_NAME_free(xn);
+                    } else {
+                        sk_X509_NAME_push(sk, xn);
+                    }
+                    X509_free(x);
+                    x = NULL;
+                }
+            }
+            if (sk != NULL)
+                ca_dn = sk;
+            if (new_bio != NULL)
+                BIO_free(new_bio);
+        }
+
+        if (ca_dn != NULL)
+            SSL_CTX_set_client_CA_list(ctx, ca_dn);
     }