7 files changed, 205 insertions, 182 deletions

diff --git a/src/lib/libcrypto/pkcs7/Makefile.ssl b/src/lib/libcrypto/pkcs7/Makefile.ssl
index 0e508386e8..6cd18b671e 100644
--- a/src/lib/libcrypto/pkcs7/Makefile.ssl
+++ b/src/lib/libcrypto/pkcs7/Makefile.ssl
@@ -99,12 +99,14 @@ clean:
 
 pk7_attr.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pk7_attr.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
-pk7_attr.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
-pk7_attr.o: ../../include/openssl/des.h ../../include/openssl/dh.h
-pk7_attr.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
-pk7_attr.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-pk7_attr.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
-pk7_attr.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+pk7_attr.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+pk7_attr.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+pk7_attr.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+pk7_attr.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+pk7_attr.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+pk7_attr.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+pk7_attr.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+pk7_attr.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
 pk7_attr.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 pk7_attr.o: ../../include/openssl/opensslv.h ../../include/openssl/pem.h
 pk7_attr.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs7.h
@@ -112,26 +114,29 @@ pk7_attr.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
 pk7_attr.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 pk7_attr.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 pk7_attr.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-pk7_attr.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+pk7_attr.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
+pk7_attr.o: ../../include/openssl/x509_vfy.h
 pk7_doit.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pk7_doit.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 pk7_doit.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
 pk7_doit.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
 pk7_doit.o: ../../include/openssl/des.h ../../include/openssl/dh.h
 pk7_doit.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
-pk7_doit.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
-pk7_doit.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
-pk7_doit.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+pk7_doit.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+pk7_doit.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+pk7_doit.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+pk7_doit.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 pk7_doit.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-pk7_doit.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+pk7_doit.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+pk7_doit.o: ../../include/openssl/opensslconf.h
 pk7_doit.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
 pk7_doit.o: ../../include/openssl/rand.h ../../include/openssl/rc2.h
 pk7_doit.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 pk7_doit.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 pk7_doit.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-pk7_doit.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-pk7_doit.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
-pk7_doit.o: ../cryptlib.h
+pk7_doit.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+pk7_doit.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+pk7_doit.o: ../../include/openssl/x509v3.h ../cryptlib.h
 pk7_lib.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pk7_lib.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 pk7_lib.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -139,14 +144,16 @@ pk7_lib.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 pk7_lib.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 pk7_lib.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 pk7_lib.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-pk7_lib.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+pk7_lib.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+pk7_lib.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 pk7_lib.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-pk7_lib.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-pk7_lib.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
-pk7_lib.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
-pk7_lib.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
-pk7_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-pk7_lib.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+pk7_lib.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+pk7_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+pk7_lib.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+pk7_lib.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+pk7_lib.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+pk7_lib.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+pk7_lib.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
 pk7_lib.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 pk7_lib.o: ../cryptlib.h
 pk7_mime.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
@@ -156,47 +163,55 @@ pk7_mime.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 pk7_mime.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 pk7_mime.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 pk7_mime.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-pk7_mime.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+pk7_mime.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+pk7_mime.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 pk7_mime.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-pk7_mime.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+pk7_mime.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+pk7_mime.o: ../../include/openssl/opensslconf.h
 pk7_mime.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
 pk7_mime.o: ../../include/openssl/rand.h ../../include/openssl/rc2.h
 pk7_mime.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 pk7_mime.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 pk7_mime.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-pk7_mime.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-pk7_mime.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+pk7_mime.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+pk7_mime.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+pk7_mime.o: ../cryptlib.h
 pk7_smime.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pk7_smime.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 pk7_smime.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
 pk7_smime.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
 pk7_smime.o: ../../include/openssl/des.h ../../include/openssl/dh.h
 pk7_smime.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
-pk7_smime.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
-pk7_smime.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
-pk7_smime.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+pk7_smime.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+pk7_smime.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+pk7_smime.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+pk7_smime.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 pk7_smime.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-pk7_smime.o: ../../include/openssl/objects.h
+pk7_smime.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
 pk7_smime.o: ../../include/openssl/opensslconf.h
 pk7_smime.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
 pk7_smime.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
 pk7_smime.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 pk7_smime.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 pk7_smime.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-pk7_smime.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-pk7_smime.o: ../../include/openssl/x509v3.h ../cryptlib.h
+pk7_smime.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
+pk7_smime.o: ../../include/openssl/x509_vfy.h ../../include/openssl/x509v3.h
+pk7_smime.o: ../cryptlib.h
 pkcs7err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pkcs7err.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
-pkcs7err.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
-pkcs7err.o: ../../include/openssl/des.h ../../include/openssl/dh.h
-pkcs7err.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
-pkcs7err.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-pkcs7err.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
-pkcs7err.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+pkcs7err.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+pkcs7err.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+pkcs7err.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+pkcs7err.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+pkcs7err.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+pkcs7err.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+pkcs7err.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+pkcs7err.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
 pkcs7err.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 pkcs7err.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
 pkcs7err.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
 pkcs7err.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 pkcs7err.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 pkcs7err.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-pkcs7err.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+pkcs7err.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
+pkcs7err.o: ../../include/openssl/x509_vfy.h
diff --git a/src/lib/libcrypto/pkcs7/bio_ber.c b/src/lib/libcrypto/pkcs7/bio_ber.c
index 4803966fd2..5447e69818 100644
--- a/src/lib/libcrypto/pkcs7/bio_ber.c
+++ b/src/lib/libcrypto/pkcs7/bio_ber.c
@@ -128,7 +128,7 @@ static int ber_new(BIO *bi)
         {
         BIO_BER_CTX *ctx;
 
-        ctx=(BIO_BER_CTX *)Malloc(sizeof(BIO_BER_CTX));
+        ctx=(BIO_BER_CTX *)OPENSSL_malloc(sizeof(BIO_BER_CTX));
         if (ctx == NULL) return(0);
 
         memset((char *)ctx,0,sizeof(BIO_BER_CTX));
@@ -146,7 +146,7 @@ static int ber_free(BIO *a)
         if (a == NULL) return(0);
         b=(BIO_BER_CTX *)a->ptr;
         memset(a->ptr,0,sizeof(BIO_BER_CTX));
-        Free(a->ptr);
+        OPENSSL_free(a->ptr);
         a->ptr=NULL;
         a->init=0;
         a->flags=0;
diff --git a/src/lib/libcrypto/pkcs7/pk7_attr.c b/src/lib/libcrypto/pkcs7/pk7_attr.c
index 3b9c0fe3f2..6ae264cbf9 100644
--- a/src/lib/libcrypto/pkcs7/pk7_attr.c
+++ b/src/lib/libcrypto/pkcs7/pk7_attr.c
@@ -12,22 +12,24 @@
 #include <openssl/asn1.h>
 #include <openssl/pem.h>
 #include <openssl/pkcs7.h>
+#include <openssl/x509.h>
 #include <openssl/err.h>
 
-int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK *cap)
+int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK_OF(X509_ALGOR) *cap)
 {
         ASN1_STRING *seq;
         unsigned char *p, *pp;
         int len;
-        len=i2d_ASN1_SET(cap,NULL,i2d_X509_ALGOR, V_ASN1_SEQUENCE,
-                                                V_ASN1_UNIVERSAL, IS_SEQUENCE);
-        if(!(pp=(unsigned char *)Malloc(len))) {
+        len=i2d_ASN1_SET_OF_X509_ALGOR(cap,NULL,i2d_X509_ALGOR,
+                                       V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL,
+                                       IS_SEQUENCE);
+        if(!(pp=(unsigned char *)OPENSSL_malloc(len))) {
                 PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
                 return 0;
         }
         p=pp;
-        i2d_ASN1_SET(cap,&p,i2d_X509_ALGOR, V_ASN1_SEQUENCE,
-                                                V_ASN1_UNIVERSAL, IS_SEQUENCE);
+        i2d_ASN1_SET_OF_X509_ALGOR(cap,&p,i2d_X509_ALGOR, V_ASN1_SEQUENCE,
+                                   V_ASN1_UNIVERSAL, IS_SEQUENCE);
         if(!(seq = ASN1_STRING_new())) {
                 PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
                 return 0;
@@ -36,27 +38,29 @@ int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK *cap)
                 PKCS7err(PKCS7_F_PKCS7_ADD_ATTRIB_SMIMECAP,ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        Free (pp);
+        OPENSSL_free (pp);
         return PKCS7_add_signed_attribute(si, NID_SMIMECapabilities,
                                                         V_ASN1_SEQUENCE, seq);
 }
 
-STACK *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si)
+STACK_OF(X509_ALGOR) *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si)
 {
         ASN1_TYPE *cap;
         unsigned char *p;
         cap = PKCS7_get_signed_attribute(si, NID_SMIMECapabilities);
         if (!cap) return NULL;
         p = cap->value.sequence->data;
-        return d2i_ASN1_SET (NULL, &p, cap->value.sequence->length, 
-                (char *(*)())d2i_X509_ALGOR, X509_ALGOR_free, V_ASN1_SEQUENCE,
-                                                         V_ASN1_UNIVERSAL);
+        return d2i_ASN1_SET_OF_X509_ALGOR(NULL, &p,
+                                          cap->value.sequence->length,
+                                          d2i_X509_ALGOR, X509_ALGOR_free,
+                                          V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
 }
 
 /* Basic smime-capabilities OID and optional integer arg */
-int PKCS7_simple_smimecap(STACK *sk, int nid, int arg)
+int PKCS7_simple_smimecap(STACK_OF(X509_ALGOR) *sk, int nid, int arg)
 {
         X509_ALGOR *alg;
+
         if(!(alg = X509_ALGOR_new())) {
                 PKCS7err(PKCS7_F_PKCS7_SIMPLE_SMIMECAP,ERR_R_MALLOC_FAILURE);
                 return 0;
@@ -80,6 +84,6 @@ int PKCS7_simple_smimecap(STACK *sk, int nid, int arg)
                 alg->parameter->value.integer = nbit;
                 alg->parameter->type = V_ASN1_INTEGER;
         }
-        sk_push (sk, (char *)alg);
+        sk_X509_ALGOR_push (sk, alg);
         return 1;
 }
diff --git a/src/lib/libcrypto/pkcs7/pk7_doit.c b/src/lib/libcrypto/pkcs7/pk7_doit.c
index 4ab24a86f5..099e9651c1 100644
--- a/src/lib/libcrypto/pkcs7/pk7_doit.c
+++ b/src/lib/libcrypto/pkcs7/pk7_doit.c
@@ -189,7 +189,7 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                         EVP_PKEY_free(pkey);
                         if (max < jj) max=jj;
                         }
-                if ((tmp=(unsigned char *)Malloc(max)) == NULL)
+                if ((tmp=(unsigned char *)OPENSSL_malloc(max)) == NULL)
                         {
                         PKCS7err(PKCS7_F_PKCS7_DATAINIT,ERR_R_MALLOC_FAILURE);
                         goto err;
@@ -203,12 +203,12 @@ BIO *PKCS7_dataInit(PKCS7 *p7, BIO *bio)
                         if (jj <= 0)
                                 {
                                 PKCS7err(PKCS7_F_PKCS7_DATAINIT,ERR_R_EVP_LIB);
-                                Free(tmp);
+                                OPENSSL_free(tmp);
                                 goto err;
                                 }
                         M_ASN1_OCTET_STRING_set(ri->enc_key,tmp,jj);
                         }
-                Free(tmp);
+                OPENSSL_free(tmp);
                 memset(key, 0, keylen);
 
                 if (out == NULL)
@@ -265,13 +265,6 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         STACK_OF(PKCS7_RECIP_INFO) *rsk=NULL;
         X509_ALGOR *xalg=NULL;
         PKCS7_RECIP_INFO *ri=NULL;
-#ifndef NO_RC2
-        char is_rc2 = 0;
-#endif
-/*      EVP_PKEY *pkey; */
-#if 0
-        X509_STORE_CTX s_ctx;
-#endif
 
         i=OBJ_obj2nid(p7->type);
         p7->state=PKCS7_S_HEADER;
@@ -312,16 +305,6 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 goto err;
                 }
 
-        if(EVP_CIPHER_nid(evp_cipher) == NID_rc2_cbc)
-                {
-#ifndef NO_RC2          
-                is_rc2 = 1; 
-#else
-                PKCS7err(PKCS7_F_PKCS7_DATADECODE,PKCS7_R_UNSUPPORTED_CIPHER_TYPE);
-                goto err;
-#endif
-                }
-
         /* We will be checking the signature */
         if (md_sk != NULL)
                 {
@@ -391,7 +374,7 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 }
 
                 jj=EVP_PKEY_size(pkey);
-                tmp=(unsigned char *)Malloc(jj+10);
+                tmp=(unsigned char *)OPENSSL_malloc(jj+10);
                 if (tmp == NULL)
                         {
                         PKCS7err(PKCS7_F_PKCS7_DATADECODE,ERR_R_MALLOC_FAILURE);
@@ -413,24 +396,18 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                         return(NULL);
 
                 if (jj != EVP_CIPHER_CTX_key_length(evp_ctx)) {
-                        /* HACK: some S/MIME clients don't use the same key
+                        /* Some S/MIME clients don't use the same key
                          * and effective key length. The key length is
                          * determined by the size of the decrypted RSA key.
-                         * So we hack things to manually set the RC2 key
-                         * because we currently can't do this with the EVP
-                         * interface.
                          */
-#ifndef NO_RC2          
-                        if(is_rc2) RC2_set_key(&(evp_ctx->c.rc2_ks),jj, tmp,
-                                        EVP_CIPHER_CTX_key_length(evp_ctx)*8);
-                        else
-#endif
+                        if(!EVP_CIPHER_CTX_set_key_length(evp_ctx, jj))
                                 {
                                 PKCS7err(PKCS7_F_PKCS7_DATADECODE,
                                         PKCS7_R_DECRYPTED_KEY_IS_WRONG_LENGTH);
                                 goto err;
                                 }
-                } else EVP_CipherInit(evp_ctx,NULL,tmp,NULL,0);
+                } 
+                EVP_CipherInit(evp_ctx,NULL,tmp,NULL,0);
 
                 memset(tmp,0,jj);
 
@@ -479,7 +456,7 @@ err:
                 out=NULL;
                 }
         if (tmp != NULL)
-                Free(tmp);
+                OPENSSL_free(tmp);
         return(out);
         }
 
@@ -557,7 +534,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                                 if (EVP_MD_CTX_type(mdc) == j)
                                         break;
                                 else
-                                        btmp=btmp->next_bio;
+                                        btmp=BIO_next(btmp);
                                 }
                         
                         /* We now have the EVP_MD_CTX, lets do the
@@ -601,13 +578,13 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                                 x=i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,NULL,
                                            i2d_X509_ATTRIBUTE,
                                            V_ASN1_SET,V_ASN1_UNIVERSAL,IS_SET);
-                                pp=(unsigned char *)Malloc(x);
+                                pp=(unsigned char *)OPENSSL_malloc(x);
                                 p=pp;
                                 i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,&p,
                                            i2d_X509_ATTRIBUTE,
                                            V_ASN1_SET,V_ASN1_UNIVERSAL,IS_SET);
                                 EVP_SignUpdate(&ctx_tmp,pp,x);
-                                Free(pp);
+                                OPENSSL_free(pp);
                                 pp=NULL;
                                 }
 
@@ -650,7 +627,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                         (unsigned char *)buf_mem->data,buf_mem->length);
 #endif
                 }
-        if (pp != NULL) Free(pp);
+        if (pp != NULL) OPENSSL_free(pp);
         pp=NULL;
 
         ret=1;
@@ -749,7 +726,7 @@ int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
                         }
                 if (EVP_MD_CTX_type(mdc) == md_type)
                         break;
-                btmp=btmp->next_bio;    
+                btmp=BIO_next(btmp);
                 }
 
         /* mdc is the digest ctx that we want, unless there are attributes,
@@ -795,13 +772,13 @@ for (ii=0; ii<md_len; ii++) printf("%02X",md_dat[ii]); printf(" calc\n");
                  */
                 i=i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,NULL,i2d_X509_ATTRIBUTE,
                         V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
-                pp=Malloc(i);
+                pp=OPENSSL_malloc(i);
                 p=pp;
                 i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,&p,i2d_X509_ATTRIBUTE,
                         V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
                 EVP_VerifyUpdate(&mdc_tmp,pp,i);
 
-                Free(pp);
+                OPENSSL_free(pp);
                 }
 
         os=si->enc_digest;
@@ -932,7 +909,7 @@ static int add_attribute(STACK_OF(X509_ATTRIBUTE) **sk, int nid, int atrtype,
 
         if (*sk == NULL)
                 {
-                *sk = sk_X509_ATTRIBUTE_new(NULL);
+                *sk = sk_X509_ATTRIBUTE_new_null();
 new_attrib:
                 attr=X509_ATTRIBUTE_create(nid,atrtype,value);
                 sk_X509_ATTRIBUTE_push(*sk,attr);
diff --git a/src/lib/libcrypto/pkcs7/pk7_mime.c b/src/lib/libcrypto/pkcs7/pk7_mime.c
index 734643be28..994473c0bd 100644
--- a/src/lib/libcrypto/pkcs7/pk7_mime.c
+++ b/src/lib/libcrypto/pkcs7/pk7_mime.c
@@ -70,16 +70,21 @@
  */
 
 typedef struct {
-char *name;                             /* Name of line e.g. "content-type" */
-char *value;                            /* Value of line e.g. "text/plain" */
-STACK /* MIME_PARAM */ *params;         /* Zero or more parameters */
-} MIME_HEADER;
-
-typedef struct {
 char *param_name;                       /* Param name e.g. "micalg" */
 char *param_value;                      /* Param value e.g. "sha1" */
 } MIME_PARAM;
 
+DECLARE_STACK_OF(MIME_PARAM)
+IMPLEMENT_STACK_OF(MIME_PARAM)
+
+typedef struct {
+char *name;                             /* Name of line e.g. "content-type" */
+char *value;                            /* Value of line e.g. "text/plain" */
+STACK_OF(MIME_PARAM) *params;           /* Zero or more parameters */
+} MIME_HEADER;
+
+DECLARE_STACK_OF(MIME_HEADER)
+IMPLEMENT_STACK_OF(MIME_HEADER)
 
 static int B64_write_PKCS7(BIO *bio, PKCS7 *p7);
 static PKCS7 *B64_read_PKCS7(BIO *bio);
@@ -88,14 +93,16 @@ static char * strip_start(char *name);
 static char * strip_end(char *name);
 static MIME_HEADER *mime_hdr_new(char *name, char *value);
 static int mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value);
-static STACK *mime_parse_hdr(BIO *bio);
-static int mime_hdr_cmp(MIME_HEADER **a, MIME_HEADER **b);
-static int mime_param_cmp(MIME_PARAM **a, MIME_PARAM **b);
+static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio);
+static int mime_hdr_cmp(const MIME_HEADER * const *a,
+                        const MIME_HEADER * const *b);
+static int mime_param_cmp(const MIME_PARAM * const *a,
+                        const MIME_PARAM * const *b);
 static void mime_param_free(MIME_PARAM *param);
 static int mime_bound_check(char *line, int linelen, char *bound, int blen);
-static int multi_split(BIO *bio, char *bound, STACK **ret);
+static int multi_split(BIO *bio, char *bound, STACK_OF(BIO) **ret);
 static int iscrlf(char c);
-static MIME_HEADER *mime_hdr_find(STACK *hdrs, char *name);
+static MIME_HEADER *mime_hdr_find(STACK_OF(MIME_HEADER) *hdrs, char *name);
 static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, char *name);
 static void mime_hdr_free(MIME_HEADER *hdr);
 
@@ -163,7 +170,7 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags)
                 BIO_printf(bio, "micalg=sha1 ; boundary=\"----%s\"\n\n", bound);
                 BIO_printf(bio, "This is an S/MIME signed message\n\n");
                 /* Now write out the first part */
-                BIO_printf(bio, "------%s\r\n", bound);
+                BIO_printf(bio, "------%s\n", bound);
                 if(flags & PKCS7_TEXT) BIO_printf(bio, "Content-Type: text/plain\n\n");
                 while((i = BIO_read(data, linebuf, MAX_SMLEN)) > 0) 
                                                 BIO_write(bio, linebuf, i);
@@ -196,8 +203,8 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags)
 PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont)
 {
         BIO *p7in;
-        STACK *headers = NULL;
-        STACK *parts = NULL;
+        STACK_OF(MIME_HEADER) *headers = NULL;
+        STACK_OF(BIO) *parts = NULL;
         MIME_HEADER *hdr;
         MIME_PARAM *prm;
         PKCS7 *p7;
@@ -211,7 +218,7 @@ PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont)
         }
 
         if(!(hdr = mime_hdr_find(headers, "content-type")) || !hdr->value) {
-                sk_pop_free(headers, mime_hdr_free);
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                 PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_CONTENT_TYPE);
                 return NULL;
         }
@@ -222,24 +229,24 @@ PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont)
                 /* Split into two parts */
                 prm = mime_param_find(hdr, "boundary");
                 if(!prm || !prm->param_value) {
-                        sk_pop_free(headers, mime_hdr_free);
+                        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                         PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_MULTIPART_BOUNDARY);
                         return NULL;
                 }
                 ret = multi_split(bio, prm->param_value, &parts);
-                sk_pop_free(headers, mime_hdr_free);
-                if(!ret || (sk_num(parts) != 2) ) {
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
+                if(!ret || (sk_BIO_num(parts) != 2) ) {
                         PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_MULTIPART_BODY_FAILURE);
-                        sk_pop_free(parts, (stkfree)BIO_free);
+                        sk_BIO_pop_free(parts, BIO_vfree);
                         return NULL;
                 }
 
                 /* Parse the signature piece */
-                p7in = (BIO *)sk_value(parts, 1);
+                p7in = sk_BIO_value(parts, 1);
 
                 if (!(headers = mime_parse_hdr(p7in))) {
                         PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_MIME_SIG_PARSE_ERROR);
-                        sk_pop_free(parts, (stkfree)BIO_free);
+                        sk_BIO_pop_free(parts, BIO_vfree);
                         return NULL;
                 }
 
@@ -247,32 +254,32 @@ PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont)
 
                 if(!(hdr = mime_hdr_find(headers, "content-type")) ||
                                                                  !hdr->value) {
-                        sk_pop_free(headers, mime_hdr_free);
+                        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                         PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_NO_SIG_CONTENT_TYPE);
                         return NULL;
                 }
 
                 if(strcmp(hdr->value, "application/x-pkcs7-signature") &&
                         strcmp(hdr->value, "application/pkcs7-signature")) {
-                        sk_pop_free(headers, mime_hdr_free);
+                        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                         PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_SIG_INVALID_MIME_TYPE);
                         ERR_add_error_data(2, "type: ", hdr->value);
-                        sk_pop_free(parts, (stkfree)BIO_free);
+                        sk_BIO_pop_free(parts, BIO_vfree);
                         return NULL;
                 }
-                sk_pop_free(headers, mime_hdr_free);
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                 /* Read in PKCS#7 */
                 if(!(p7 = B64_read_PKCS7(p7in))) {
                         PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_PKCS7_SIG_PARSE_ERROR);
-                        sk_pop_free(parts, (stkfree)BIO_free);
+                        sk_BIO_pop_free(parts, BIO_vfree);
                         return NULL;
                 }
 
                 if(bcont) {
-                        *bcont = (BIO *)sk_value(parts, 0);
+                        *bcont = sk_BIO_value(parts, 0);
                         BIO_free(p7in);
-                        sk_free(parts);
-                } else sk_pop_free(parts, (stkfree)BIO_free);
+                        sk_BIO_free(parts);
+                } else sk_BIO_pop_free(parts, BIO_vfree);
                 return p7;
         }
                 
@@ -282,11 +289,11 @@ PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont)
             strcmp (hdr->value, "application/pkcs7-mime")) {
                 PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_INVALID_MIME_TYPE);
                 ERR_add_error_data(2, "type: ", hdr->value);
-                sk_pop_free(headers, mime_hdr_free);
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                 return NULL;
         }
 
-        sk_pop_free(headers, mime_hdr_free);
+        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
         
         if(!(p7 = B64_read_PKCS7(bio))) {
                 PKCS7err(PKCS7_F_SMIME_READ_PKCS7, PKCS7_R_PKCS7_PARSE_ERROR);
@@ -325,24 +332,25 @@ int SMIME_text(BIO *in, BIO *out)
 {
         char iobuf[4096];
         int len;
-        STACK *headers;
+        STACK_OF(MIME_HEADER) *headers;
         MIME_HEADER *hdr;
+
         if (!(headers = mime_parse_hdr(in))) {
                 PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_MIME_PARSE_ERROR);
                 return 0;
         }
         if(!(hdr = mime_hdr_find(headers, "content-type")) || !hdr->value) {
                 PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_MIME_NO_CONTENT_TYPE);
-                sk_pop_free(headers, mime_hdr_free);
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                 return 0;
         }
         if (strcmp (hdr->value, "text/plain")) {
                 PKCS7err(PKCS7_F_SMIME_TEXT,PKCS7_R_INVALID_MIME_TYPE);
                 ERR_add_error_data(2, "type: ", hdr->value);
-                sk_pop_free(headers, mime_hdr_free);
+                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                 return 0;
         }
-        sk_pop_free(headers, mime_hdr_free);
+        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
         while ((len = BIO_read(in, iobuf, sizeof(iobuf))) > 0)
                                                 BIO_write(out, iobuf, len);
         return 1;
@@ -352,18 +360,19 @@ int SMIME_text(BIO *in, BIO *out)
  * canonical parts in a STACK of bios
  */
 
-static int multi_split(BIO *bio, char *bound, STACK **ret)
+static int multi_split(BIO *bio, char *bound, STACK_OF(BIO) **ret)
 {
         char linebuf[MAX_SMLEN];
         int len, blen;
         BIO *bpart = NULL;
-        STACK *parts;
+        STACK_OF(BIO) *parts;
         char state, part, first;
+
         blen = strlen(bound);
         part = 0;
         state = 0;
         first = 1;
-        parts = sk_new(NULL);
+        parts = sk_BIO_new_null();
         *ret = parts;
         while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
                 state = mime_bound_check(linebuf, len, bound, blen);
@@ -371,12 +380,12 @@ static int multi_split(BIO *bio, char *bound, STACK **ret)
                         first = 1;
                         part++;
                 } else if(state == 2) {
-                        sk_push(parts, (char *)bpart);
+                        sk_BIO_push(parts, bpart);
                         return 1;
                 } else if(part) {
                         if(first) {
                                 first = 0;
-                                if(bpart) sk_push(parts, (char *)bpart);
+                                if(bpart) sk_BIO_push(parts, bpart);
                                 bpart = BIO_new(BIO_s_mem());
                                 
                         } else BIO_write(bpart, "\r\n", 2);
@@ -405,15 +414,16 @@ static int iscrlf(char c)
 #define MIME_COMMENT    6
 
 
-static STACK *mime_parse_hdr(BIO *bio)
+static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio)
 {
         char *p, *q, c;
         char *ntmp;
         char linebuf[MAX_SMLEN];
         MIME_HEADER *mhdr = NULL;
-        STACK *headers;
+        STACK_OF(MIME_HEADER) *headers;
         int len, state, save_state = 0;
-        headers = sk_new(mime_hdr_cmp);
+
+        headers = sk_MIME_HEADER_new(mime_hdr_cmp);
         while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
         /* If whitespace at line start then continuation line */
         if(mhdr && isspace((unsigned char)linebuf[0])) state = MIME_NAME;
@@ -441,7 +451,7 @@ static STACK *mime_parse_hdr(BIO *bio)
                                 mime_debug("Found End Value\n");
                                 *p = 0;
                                 mhdr = mime_hdr_new(ntmp, strip_ends(q));
-                                sk_push(headers, (char *)mhdr);
+                                sk_MIME_HEADER_push(headers, mhdr);
                                 ntmp = NULL;
                                 q = p + 1;
                                 state = MIME_NAME;
@@ -493,7 +503,7 @@ static STACK *mime_parse_hdr(BIO *bio)
 
         if(state == MIME_TYPE) {
                 mhdr = mime_hdr_new(ntmp, strip_ends(q));
-                sk_push(headers, (char *)mhdr);
+                sk_MIME_HEADER_push(headers, mhdr);
         } else if(state == MIME_VALUE)
                          mime_hdr_addparam(mhdr, ntmp, strip_ends(q));
         if(p == linebuf) break; /* Blank line means end of headers */
@@ -569,11 +579,11 @@ static MIME_HEADER *mime_hdr_new(char *name, char *value)
                         }
                 }
         } else tmpval = NULL;
-        mhdr = (MIME_HEADER *) Malloc(sizeof(MIME_HEADER));
+        mhdr = (MIME_HEADER *) OPENSSL_malloc(sizeof(MIME_HEADER));
         if(!mhdr) return NULL;
         mhdr->name = tmpname;
         mhdr->value = tmpval;
-        if(!(mhdr->params = sk_new(mime_param_cmp))) return NULL;
+        if(!(mhdr->params = sk_MIME_PARAM_new(mime_param_cmp))) return NULL;
         return mhdr;
 }
                 
@@ -598,34 +608,36 @@ static int mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value)
                 if(!tmpval) return 0;
         } else tmpval = NULL;
         /* Parameter values are case sensitive so leave as is */
-        mparam = (MIME_PARAM *) Malloc(sizeof(MIME_PARAM));
+        mparam = (MIME_PARAM *) OPENSSL_malloc(sizeof(MIME_PARAM));
         if(!mparam) return 0;
         mparam->param_name = tmpname;
         mparam->param_value = tmpval;
-        sk_push(mhdr->params, (char *)mparam);
+        sk_MIME_PARAM_push(mhdr->params, mparam);
         return 1;
 }
 
-static int mime_hdr_cmp(MIME_HEADER **a, MIME_HEADER **b)
+static int mime_hdr_cmp(const MIME_HEADER * const *a,
+                        const MIME_HEADER * const *b)
 {
         return(strcmp((*a)->name, (*b)->name));
 }
 
-static int mime_param_cmp(MIME_PARAM **a, MIME_PARAM **b)
+static int mime_param_cmp(const MIME_PARAM * const *a,
+                        const MIME_PARAM * const *b)
 {
         return(strcmp((*a)->param_name, (*b)->param_name));
 }
 
 /* Find a header with a given name (if possible) */
 
-static MIME_HEADER *mime_hdr_find(STACK *hdrs, char *name)
+static MIME_HEADER *mime_hdr_find(STACK_OF(MIME_HEADER) *hdrs, char *name)
 {
         MIME_HEADER htmp;
         int idx;
         htmp.name = name;
-        idx = sk_find(hdrs, (char *)&htmp);
+        idx = sk_MIME_HEADER_find(hdrs, &htmp);
         if(idx < 0) return NULL;
-        return (MIME_HEADER *)sk_value(hdrs, idx);
+        return sk_MIME_HEADER_value(hdrs, idx);
 }
 
 static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, char *name)
@@ -633,24 +645,24 @@ static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, char *name)
         MIME_PARAM param;
         int idx;
         param.param_name = name;
-        idx = sk_find(hdr->params, (char *)&param);
+        idx = sk_MIME_PARAM_find(hdr->params, &param);
         if(idx < 0) return NULL;
-        return (MIME_PARAM *)sk_value(hdr->params, idx);
+        return sk_MIME_PARAM_value(hdr->params, idx);
 }
 
 static void mime_hdr_free(MIME_HEADER *hdr)
 {
-        if(hdr->name) Free(hdr->name);
-        if(hdr->value) Free(hdr->value);
-        if(hdr->params) sk_pop_free(hdr->params, mime_param_free);
-        Free(hdr);
+        if(hdr->name) OPENSSL_free(hdr->name);
+        if(hdr->value) OPENSSL_free(hdr->value);
+        if(hdr->params) sk_MIME_PARAM_pop_free(hdr->params, mime_param_free);
+        OPENSSL_free(hdr);
 }
 
 static void mime_param_free(MIME_PARAM *param)
 {
-        if(param->param_name) Free(param->param_name);
-        if(param->param_value) Free(param->param_value);
-        Free(param);
+        if(param->param_name) OPENSSL_free(param->param_name);
+        if(param->param_value) OPENSSL_free(param->param_value);
+        OPENSSL_free(param);
 }
 
 /* Check for a multipart boundary. Returns:
diff --git a/src/lib/libcrypto/pkcs7/pk7_smime.c b/src/lib/libcrypto/pkcs7/pk7_smime.c
index b41f42ed04..d716f9faeb 100644
--- a/src/lib/libcrypto/pkcs7/pk7_smime.c
+++ b/src/lib/libcrypto/pkcs7/pk7_smime.c
@@ -64,12 +64,12 @@
 #include <openssl/x509v3.h>
 
 PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
-                                                        BIO *data, int flags)
+                  BIO *data, int flags)
 {
         PKCS7 *p7;
         PKCS7_SIGNER_INFO *si;
         BIO *p7bio;
-        STACK *smcap;
+        STACK_OF(X509_ALGOR) *smcap;
         int i;
 
         if(!X509_check_private_key(signcert, pkey)) {
@@ -109,7 +109,9 @@ PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
                 PKCS7_add_signed_attribute(si, NID_pkcs9_contentType,
                                 V_ASN1_OBJECT, OBJ_nid2obj(NID_pkcs7_data));
                 /* Add SMIMECapabilities */
-                if(!(smcap = sk_new(NULL))) {
+                if(!(flags & PKCS7_NOSMIMECAP))
+                {
+                if(!(smcap = sk_X509_ALGOR_new_null())) {
                         PKCS7err(PKCS7_F_PKCS7_SIGN,ERR_R_MALLOC_FAILURE);
                         return NULL;
                 }
@@ -127,7 +129,8 @@ PKCS7 *PKCS7_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
                 PKCS7_simple_smimecap (smcap, NID_rc2_cbc, 40);
 #endif
                 PKCS7_add_attrib_smimecap (si, smcap);
-                sk_pop_free(smcap, X509_ALGOR_free);
+                sk_X509_ALGOR_pop_free(smcap, X509_ALGOR_free);
+                }
         }
 
         if(flags & PKCS7_DETACHED)PKCS7_set_detached(p7, 1);
@@ -150,7 +153,7 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
         PKCS7_SIGNER_INFO *si;
         X509_STORE_CTX cert_ctx;
         char buf[4096];
-        int i, j=0;
+        int i, j=0, k;
         BIO *p7bio;
         BIO *tmpout;
 
@@ -169,12 +172,17 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
                 PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_NO_CONTENT);
                 return 0;
         }
+#if 0
+        /* NB: this test commented out because some versions of Netscape
+         * illegally include zero length content when signing data.
+         */
 
         /* Check for data and content: two sets of data */
         if(!PKCS7_get_detached(p7) && indata) {
                                 PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_CONTENT_AND_DATA_PRESENT);
                 return 0;
         }
+#endif
 
         sinfos = PKCS7_get_signer_info(p7);
 
@@ -190,8 +198,8 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
 
         /* Now verify the certificates */
 
-        if (!(flags & PKCS7_NOVERIFY)) for (i = 0; i < sk_X509_num(signers); i++) {
-                signer = sk_X509_value (signers, i);
+        if (!(flags & PKCS7_NOVERIFY)) for (k = 0; k < sk_X509_num(signers); k++) {
+                signer = sk_X509_value (signers, k);
                 if (!(flags & PKCS7_NOCHAIN)) {
                         X509_STORE_CTX_init(&cert_ctx, store, signer,
                                                         p7->d.sign->cert);
@@ -282,7 +290,7 @@ STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
                 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,PKCS7_R_WRONG_CONTENT_TYPE);
                 return NULL;
         }
-        if(!(signers = sk_X509_new(NULL))) {
+        if(!(signers = sk_X509_new_null())) {
                 PKCS7err(PKCS7_F_PKCS7_GET0_SIGNERS,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
diff --git a/src/lib/libcrypto/pkcs7/pkcs7.h b/src/lib/libcrypto/pkcs7/pkcs7.h
index 3ec725d226..1b817e605d 100644
--- a/src/lib/libcrypto/pkcs7/pkcs7.h
+++ b/src/lib/libcrypto/pkcs7/pkcs7.h
@@ -59,15 +59,13 @@
 #ifndef HEADER_PKCS7_H
 #define HEADER_PKCS7_H
 
-#ifdef  __cplusplus
-extern "C" {
-#endif
-
 #include <openssl/bio.h>
 #include <openssl/x509.h>
 
-#ifdef VMS
-#include <openssl/vms_idhacks.h>
+#include <openssl/symhacks.h>
+
+#ifdef  __cplusplus
+extern "C" {
 #endif
 
 #ifdef WIN32
@@ -210,9 +208,16 @@ typedef struct pkcs7_st
 
                 /* NID_pkcs7_encrypted */
                 PKCS7_ENCRYPT *encrypted;
+
+                /* Anything else */
+                ASN1_TYPE *other;
                 } d;
         } PKCS7;
 
+DECLARE_STACK_OF(PKCS7)
+DECLARE_ASN1_SET_OF(PKCS7)
+DECLARE_PKCS12_STACK_OF(PKCS7)
+
 #define PKCS7_OP_SET_DETACHED_SIGNATURE 1
 #define PKCS7_OP_GET_DETACHED_SIGNATURE 2
 
@@ -240,15 +245,16 @@ typedef struct pkcs7_st
 
 /* S/MIME related flags */
 
-#define PKCS7_TEXT      0x1
-#define PKCS7_NOCERTS   0x2
-#define PKCS7_NOSIGS    0x4
-#define PKCS7_NOCHAIN   0x8
-#define PKCS7_NOINTERN  0x10
-#define PKCS7_NOVERIFY  0x20
-#define PKCS7_DETACHED  0x40
-#define PKCS7_BINARY    0x80
-#define PKCS7_NOATTR    0x100
+#define PKCS7_TEXT              0x1
+#define PKCS7_NOCERTS           0x2
+#define PKCS7_NOSIGS            0x4
+#define PKCS7_NOCHAIN           0x8
+#define PKCS7_NOINTERN          0x10
+#define PKCS7_NOVERIFY          0x20
+#define PKCS7_DETACHED          0x40
+#define PKCS7_BINARY            0x80
+#define PKCS7_NOATTR            0x100
+#define PKCS7_NOSMIMECAP        0x200
 
 /* Flags: for compatibility with older code */
 
@@ -402,9 +408,10 @@ PKCS7 *PKCS7_encrypt(STACK_OF(X509) *certs, BIO *in, EVP_CIPHER *cipher,
                                                                 int flags);
 int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags);
 
-int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si, STACK *cap);
-STACK *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si);
-int PKCS7_simple_smimecap(STACK *sk, int nid, int arg);
+int PKCS7_add_attrib_smimecap(PKCS7_SIGNER_INFO *si,
+                              STACK_OF(X509_ALGOR) *cap);
+STACK_OF(X509_ALGOR) *PKCS7_get_smimecap(PKCS7_SIGNER_INFO *si);
+int PKCS7_simple_smimecap(STACK_OF(X509_ALGOR) *sk, int nid, int arg);
 
 int SMIME_write_PKCS7(BIO *bio, PKCS7 *p7, BIO *data, int flags);
 PKCS7 *SMIME_read_PKCS7(BIO *bio, BIO **bcont);