6 files changed, 69 insertions, 44 deletions

diff --git a/src/lib/libcrypto/pkcs12/p12_crt.c b/src/lib/libcrypto/pkcs12/p12_crt.c
index 56d88b0759..ee8aed54c7 100644
--- a/src/lib/libcrypto/pkcs12/p12_crt.c
+++ b/src/lib/libcrypto/pkcs12/p12_crt.c
@@ -61,7 +61,7 @@
 #include <openssl/pkcs12.h>
 
 PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
-             STACK *ca, int nid_key, int nid_cert, int iter, int mac_iter,
+             STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter, int mac_iter,
              int keytype)
 {
         PKCS12 *p12;
@@ -103,8 +103,8 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
         
         /* Add all other certificates */
         if(ca) {
-                for(i = 0; i < sk_num(ca); i++) {
-                        tcert = (X509 *)sk_value(ca, i);
+                for(i = 0; i < sk_X509_num(ca); i++) {
+                        tcert = sk_X509_value(ca, i);
                         if(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL;
                         if(!sk_push(bags, (char *)bag)) {
                                 PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
diff --git a/src/lib/libcrypto/pkcs12/p12_key.c b/src/lib/libcrypto/pkcs12/p12_key.c
index 02fdd20e2f..b364671ed2 100644
--- a/src/lib/libcrypto/pkcs12/p12_key.c
+++ b/src/lib/libcrypto/pkcs12/p12_key.c
@@ -104,6 +104,14 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
 #ifdef  DEBUG_KEYGEN
         unsigned char *tmpout = out;
         int tmpn = n;
+#endif
+
+        if (!pass) {
+                PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_PASSED_NULL_PARAMETER);
+                return 0;
+        }
+
+#ifdef  DEBUG_KEYGEN
         fprintf(stderr, "KEYGEN DEBUG\n");
         fprintf(stderr, "ID %d, ITER %d\n", id, iter);
         fprintf(stderr, "Password (length %d):\n", passlen);
diff --git a/src/lib/libcrypto/pkcs12/p12_kiss.c b/src/lib/libcrypto/pkcs12/p12_kiss.c
index 08a60556e0..ee257ffbad 100644
--- a/src/lib/libcrypto/pkcs12/p12_kiss.c
+++ b/src/lib/libcrypto/pkcs12/p12_kiss.c
@@ -62,9 +62,17 @@
 
 /* Simplified PKCS#12 routines */
 
-static int parse_pk12( PKCS12 *p12, const char *pass, int passlen, EVP_PKEY **pkey, X509 **cert, STACK **ca);
-static int parse_bags( STACK *bags, const char *pass, int passlen, EVP_PKEY **pkey, X509 **cert, STACK **ca, ASN1_OCTET_STRING **keyid, char *keymatch);
-static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen, EVP_PKEY **pkey, X509 **cert, STACK **ca, ASN1_OCTET_STRING **keyid, char *keymatch);
+static int parse_pk12( PKCS12 *p12, const char *pass, int passlen,
+                EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca);
+
+static int parse_bags( STACK *bags, const char *pass, int passlen,
+                EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
+                ASN1_OCTET_STRING **keyid, char *keymatch);
+
+static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen,
+                        EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
+                        ASN1_OCTET_STRING **keyid, char *keymatch);
+
 /* Parse and decrypt a PKCS#12 structure returning user key, user cert
  * and other (CA) certs. Note either ca should be NULL, *ca should be NULL,
  * or it should point to a valid STACK structure. pkey and cert can be
@@ -72,54 +80,59 @@ static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen, EVP_PK
  */
 
 int PKCS12_parse (PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
-             STACK **ca)
+             STACK_OF(X509) **ca)
 {
 
-/* Check for NULL PKCS12 structure */
-
-if(!p12) {
-        PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_INVALID_NULL_PKCS12_POINTER);
-        return 0;
-}
+        /* Check for NULL PKCS12 structure */
 
-/* Allocate stack for ca certificates if needed */
-if ((ca != NULL) && (*ca == NULL)) {
-        if (!(*ca = sk_new(NULL))) {
-                PKCS12err(PKCS12_F_PKCS12_PARSE,ERR_R_MALLOC_FAILURE);
+        if(!p12)
+                {
+                PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_INVALID_NULL_PKCS12_POINTER);
                 return 0;
-        }
-}
+                }
+
+        /* Allocate stack for ca certificates if needed */
+        if ((ca != NULL) && (*ca == NULL))
+                {
+                if (!(*ca = sk_X509_new(NULL)))
+                        {
+                        PKCS12err(PKCS12_F_PKCS12_PARSE,ERR_R_MALLOC_FAILURE);
+                        return 0;
+                        }
+                }
 
-if(pkey) *pkey = NULL;
-if(cert) *cert = NULL;
+        if(pkey) *pkey = NULL;
+        if(cert) *cert = NULL;
 
-/* Check the mac */
+        /* Check the mac */
 
-if (!PKCS12_verify_mac (p12, pass, -1)) {
-        PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_MAC_VERIFY_FAILURE);
-        goto err;
-}
+        if (!PKCS12_verify_mac (p12, pass, -1))
+                {
+                PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_MAC_VERIFY_FAILURE);
+                goto err;
+                }
 
-if (!parse_pk12 (p12, pass, -1, pkey, cert, ca)) {
-        PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_PARSE_ERROR);
-        goto err;
-}
+        if (!parse_pk12 (p12, pass, -1, pkey, cert, ca))
+                {
+                PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_PARSE_ERROR);
+                goto err;
+                }
 
-return 1;
+        return 1;
 
-err:
+ err:
 
-if (pkey && *pkey) EVP_PKEY_free (*pkey);
-if (cert && *cert) X509_free (*cert);
-if (ca) sk_pop_free (*ca, X509_free);
-return 0;
+        if (pkey && *pkey) EVP_PKEY_free (*pkey);
+        if (cert && *cert) X509_free (*cert);
+        if (ca) sk_X509_pop_free (*ca, X509_free);
+        return 0;
 
 }
 
 /* Parse the outer PKCS#12 structure */
 
 static int parse_pk12 (PKCS12 *p12, const char *pass, int passlen,
-             EVP_PKEY **pkey, X509 **cert, STACK **ca)
+             EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
 {
         STACK *asafes, *bags;
         int i, bagnid;
@@ -154,7 +167,7 @@ static int parse_pk12 (PKCS12 *p12, const char *pass, int passlen,
 
 
 static int parse_bags (STACK *bags, const char *pass, int passlen,
-                       EVP_PKEY **pkey, X509 **cert, STACK **ca,
+                       EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
                        ASN1_OCTET_STRING **keyid, char *keymatch)
 {
         int i;
@@ -171,7 +184,7 @@ static int parse_bags (STACK *bags, const char *pass, int passlen,
 #define MATCH_ALL  0x3
 
 static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
-                      EVP_PKEY **pkey, X509 **cert, STACK **ca,
+                      EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
                       ASN1_OCTET_STRING **keyid,
              char *keymatch)
 {
@@ -221,7 +234,10 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
                 if (lkey) {
                         *keymatch |= MATCH_CERT;
                         if (cert) *cert = x509;
-                } else if (ca) sk_push (*ca, (char *)x509);
+                } else {
+                        if(ca) sk_X509_push (*ca, x509);
+                        else X509_free(x509);
+                }
         break;
 
         case NID_safeContentsBag:
diff --git a/src/lib/libcrypto/pkcs12/p12_mutl.c b/src/lib/libcrypto/pkcs12/p12_mutl.c
index f1094b3840..369257ed4c 100644
--- a/src/lib/libcrypto/pkcs12/p12_mutl.c
+++ b/src/lib/libcrypto/pkcs12/p12_mutl.c
@@ -157,7 +157,7 @@ int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
                 return 0;
         }
         if (!salt) {
-                if (RAND_bytes (p12->mac->salt->data, saltlen) <= 0)
+                if (RAND_pseudo_bytes (p12->mac->salt->data, saltlen) < 0)
                         return 0;
         }
         else memcpy (p12->mac->salt->data, salt, saltlen);
diff --git a/src/lib/libcrypto/pkcs12/pk12err.c b/src/lib/libcrypto/pkcs12/pk12err.c
index 9d8de10e1e..12db54f49e 100644
--- a/src/lib/libcrypto/pkcs12/pk12err.c
+++ b/src/lib/libcrypto/pkcs12/pk12err.c
@@ -54,7 +54,8 @@
  */
 
 /* NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file.
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
  */
 
 #include <stdio.h>
diff --git a/src/lib/libcrypto/pkcs12/pkcs12.h b/src/lib/libcrypto/pkcs12/pkcs12.h
index 254000fa12..dad356c00f 100644
--- a/src/lib/libcrypto/pkcs12/pkcs12.h
+++ b/src/lib/libcrypto/pkcs12/pkcs12.h
@@ -265,9 +265,9 @@ void PKCS12_SAFEBAG_free(PKCS12_SAFEBAG *a);
 void ERR_load_PKCS12_strings(void);
 void PKCS12_PBE_add(void);
 int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
-                 STACK **ca);
+                 STACK_OF(X509) **ca);
 PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
-                         STACK *ca, int nid_key, int nid_cert, int iter,
+                         STACK_OF(X509) *ca, int nid_key, int nid_cert, int iter,
                                                  int mac_iter, int keytype);
 int i2d_PKCS12_bio(BIO *bp, PKCS12 *p12);
 int i2d_PKCS12_fp(FILE *fp, PKCS12 *p12);