Add X509_ALGOR_set0_by_nid()

X509_ALGOR_set0() is annoyingly unergonomic since it takes an ASN1_OBJECT
rather than a nid.  This means that almost all callers call OBJ_obj2nid()
and they often do this inline without error checking so that the resulting
X509_ALGOR object is corrupted and may lead to incorrect encodings.

Provide an internal alternative X509_ALGOR_set0_by_nid() that takes a nid
instead of an ASN1_OBJECT and performs proper error checking. This will be
used to convert callers of X509_ALGOR_set0() in the library.

ok jsing

2 files changed, 33 insertions, 2 deletions

diff --git a/src/lib/libcrypto/asn1/x_algor.c b/src/lib/libcrypto/asn1/x_algor.c
index 76b78028ad..5ad1263b27 100644
--- a/src/lib/libcrypto/asn1/x_algor.c
+++ b/src/lib/libcrypto/asn1/x_algor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_algor.c,v 1.36 2023/11/01 20:26:24 tb Exp $ */
+/* $OpenBSD: x_algor.c,v 1.37 2023/11/01 20:37:42 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -159,6 +159,19 @@ X509_ALGOR_set0_obj(X509_ALGOR *alg, ASN1_OBJECT *aobj)
 }
 
 static int
+X509_ALGOR_set_obj_by_nid(X509_ALGOR *alg, int nid)
+{
+        ASN1_OBJECT *aobj;
+
+        if ((aobj = OBJ_nid2obj(nid)) == NULL)
+                return 0;
+        if (!X509_ALGOR_set0_obj(alg, aobj))
+                return 0;
+
+        return 1;
+}
+
+static int
 X509_ALGOR_set0_parameter(X509_ALGOR *alg, int parameter_type,
     void *parameter_value)
 {
@@ -181,6 +194,22 @@ X509_ALGOR_set0_parameter(X509_ALGOR *alg, int parameter_type,
 }
 
 int
+X509_ALGOR_set0_by_nid(X509_ALGOR *alg, int nid, int parameter_type,
+    void *parameter_value)
+{
+        if (alg == NULL)
+                return 0;
+
+        if (!X509_ALGOR_set_obj_by_nid(alg, nid))
+                return 0;
+
+        if (!X509_ALGOR_set0_parameter(alg, parameter_type, parameter_value))
+                return 0;
+
+        return 1;
+}
+
+int
 X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int parameter_type,
     void *parameter_value)
 {
diff --git a/src/lib/libcrypto/x509/x509_local.h b/src/lib/libcrypto/x509/x509_local.h
index 44fe6ad805..63082d1b19 100644
--- a/src/lib/libcrypto/x509/x509_local.h
+++ b/src/lib/libcrypto/x509/x509_local.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: x509_local.h,v 1.10 2023/10/11 13:05:18 tb Exp $ */
+/*      $OpenBSD: x509_local.h,v 1.11 2023/11/01 20:37:42 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2013.
  */
@@ -380,6 +380,8 @@ int x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int quiet);
 int name_cmp(const char *name, const char *cmp);
 
 int X509_ALGOR_set_evp_md(X509_ALGOR *alg, const EVP_MD *md);
+int X509_ALGOR_set0_by_nid(X509_ALGOR *alg, int nid, int parameter_type,
+    void *parameter_value);
 
 int X509_policy_check(const STACK_OF(X509) *certs,
     const STACK_OF(ASN1_OBJECT) *user_policies, unsigned long flags,