import of openssl-0.9.7g; tested on platforms from alpha to zaurus, ok deraadt@

1 files changed, 35 insertions, 13 deletions

diff --git a/src/lib/libcrypto/x509/x509_cmp.c b/src/lib/libcrypto/x509/x509_cmp.c
index f460102f49..030d0966fc 100644
--- a/src/lib/libcrypto/x509/x509_cmp.c
+++ b/src/lib/libcrypto/x509/x509_cmp.c
@@ -254,33 +254,49 @@ static int nocase_spacenorm_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
         return 0;
 }
 
+static int asn1_string_memcmp(ASN1_STRING *a, ASN1_STRING *b)
+        {
+        int j;
+        j = a->length - b->length;
+        if (j)
+                return j;
+        return memcmp(a->data, b->data, a->length);
+        }
+
+#define STR_TYPE_CMP (B_ASN1_PRINTABLESTRING|B_ASN1_T61STRING|B_ASN1_UTF8STRING)
+
 int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
         {
         int i,j;
         X509_NAME_ENTRY *na,*nb;
 
-        if (sk_X509_NAME_ENTRY_num(a->entries)
-            != sk_X509_NAME_ENTRY_num(b->entries))
-                return sk_X509_NAME_ENTRY_num(a->entries)
-                  -sk_X509_NAME_ENTRY_num(b->entries);
+        unsigned long nabit, nbbit;
+
+        j = sk_X509_NAME_ENTRY_num(a->entries)
+                  - sk_X509_NAME_ENTRY_num(b->entries);
+        if (j)
+                return j;
         for (i=sk_X509_NAME_ENTRY_num(a->entries)-1; i>=0; i--)
                 {
                 na=sk_X509_NAME_ENTRY_value(a->entries,i);
                 nb=sk_X509_NAME_ENTRY_value(b->entries,i);
                 j=na->value->type-nb->value->type;
-                if (j) return(j);
-                if (na->value->type == V_ASN1_PRINTABLESTRING)
+                if (j)
+                        {
+                        nabit = ASN1_tag2bit(na->value->type);
+                        nbbit = ASN1_tag2bit(nb->value->type);
+                        if (!(nabit & STR_TYPE_CMP) ||
+                                !(nbbit & STR_TYPE_CMP))
+                                return j;
+                        j = asn1_string_memcmp(na->value, nb->value);
+                        }
+                else if (na->value->type == V_ASN1_PRINTABLESTRING)
                         j=nocase_spacenorm_cmp(na->value, nb->value);
                 else if (na->value->type == V_ASN1_IA5STRING
                         && OBJ_obj2nid(na->object) == NID_pkcs9_emailAddress)
                         j=nocase_cmp(na->value, nb->value);
                 else
-                        {
-                        j=na->value->length-nb->value->length;
-                        if (j) return(j);
-                        j=memcmp(na->value->data,nb->value->data,
-                                na->value->length);
-                        }
+                        j = asn1_string_memcmp(na->value, nb->value);
                 if (j) return(j);
                 j=na->set-nb->set;
                 if (j) return(j);
@@ -306,10 +322,16 @@ unsigned long X509_NAME_hash(X509_NAME *x)
         {
         unsigned long ret=0;
         unsigned char md[16];
+        EVP_MD_CTX md_ctx;
 
         /* Make sure X509_NAME structure contains valid cached encoding */
         i2d_X509_NAME(x,NULL);
-        EVP_Digest(x->bytes->data, x->bytes->length, md, NULL, EVP_md5(), NULL);
+        EVP_MD_CTX_init(&md_ctx);
+        EVP_MD_CTX_set_flags(&md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+        EVP_DigestInit_ex(&md_ctx, EVP_md5(), NULL);
+        EVP_DigestUpdate(&md_ctx, x->bytes->data, x->bytes->length);
+        EVP_DigestFinal_ex(&md_ctx,md,NULL);
+        EVP_MD_CTX_cleanup(&md_ctx);
 
         ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                 ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)