1 files changed, 217 insertions, 245 deletions

diff --git a/src/lib/libcrypto/rsa/rsa_ameth.c b/src/lib/libcrypto/rsa/rsa_ameth.c
index 2e2194e8b3..8e15e3f535 100644
--- a/src/lib/libcrypto/rsa/rsa_ameth.c
+++ b/src/lib/libcrypto/rsa/rsa_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa_ameth.c,v 1.6 2014/06/12 15:49:30 deraadt Exp $ */
+/* $OpenBSD: rsa_ameth.c,v 1.7 2014/07/09 08:20:08 miod Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -67,207 +67,213 @@
 #endif
 #include "asn1_locl.h"
 
-static int rsa_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
-        {
+static int
+rsa_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
+{
         unsigned char *penc = NULL;
         int penclen;
+
         penclen = i2d_RSAPublicKey(pkey->pkey.rsa, &penc);
         if (penclen <= 0)
                 return 0;
         if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_RSA),
-                                V_ASN1_NULL, NULL, penc, penclen))
+            V_ASN1_NULL, NULL, penc, penclen))
                 return 1;
 
         free(penc);
         return 0;
-        }
+}
 
-static int rsa_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
-        {
+static int
+rsa_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
+{
         const unsigned char *p;
         int pklen;
         RSA *rsa = NULL;
+
         if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, NULL, pubkey))
                 return 0;
-        if (!(rsa = d2i_RSAPublicKey(NULL, &p, pklen)))
-                {
+        if (!(rsa = d2i_RSAPublicKey(NULL, &p, pklen))) {
                 RSAerr(RSA_F_RSA_PUB_DECODE, ERR_R_RSA_LIB);
                 return 0;
-                }
+        }
         EVP_PKEY_assign_RSA (pkey, rsa);
         return 1;
-        }
+}
 
-static int rsa_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
-        {
-        if (BN_cmp(b->pkey.rsa->n,a->pkey.rsa->n) != 0
-                || BN_cmp(b->pkey.rsa->e,a->pkey.rsa->e) != 0)
-                        return 0;
+static int
+rsa_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
+{
+        if (BN_cmp(b->pkey.rsa->n,a->pkey.rsa->n) != 0 ||
+            BN_cmp(b->pkey.rsa->e,a->pkey.rsa->e) != 0)
+                return 0;
         return 1;
-        }
+}
 
-static int old_rsa_priv_decode(EVP_PKEY *pkey,
-                                        const unsigned char **pder, int derlen)
-        {
+static int
+old_rsa_priv_decode(EVP_PKEY *pkey, const unsigned char **pder, int derlen)
+{
         RSA *rsa;
-        if (!(rsa = d2i_RSAPrivateKey (NULL, pder, derlen)))
-                {
+
+        if (!(rsa = d2i_RSAPrivateKey (NULL, pder, derlen))) {
                 RSAerr(RSA_F_OLD_RSA_PRIV_DECODE, ERR_R_RSA_LIB);
                 return 0;
-                }
+        }
         EVP_PKEY_assign_RSA(pkey, rsa);
         return 1;
-        }
+}
 
-static int old_rsa_priv_encode(const EVP_PKEY *pkey, unsigned char **pder)
-        {
+static int
+old_rsa_priv_encode(const EVP_PKEY *pkey, unsigned char **pder)
+{
         return i2d_RSAPrivateKey(pkey->pkey.rsa, pder);
-        }
+}
 
-static int rsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
-        {
+static int
+rsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
+{
         unsigned char *rk = NULL;
         int rklen;
+
         rklen = i2d_RSAPrivateKey(pkey->pkey.rsa, &rk);
 
-        if (rklen <= 0)
-                {
-                RSAerr(RSA_F_RSA_PRIV_ENCODE,ERR_R_MALLOC_FAILURE);
+        if (rklen <= 0) {
+                RSAerr(RSA_F_RSA_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
                 return 0;
-                }
+        }
 
         if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_rsaEncryption), 0,
-                                V_ASN1_NULL, NULL, rk, rklen))
-                {
-                RSAerr(RSA_F_RSA_PRIV_ENCODE,ERR_R_MALLOC_FAILURE);
+            V_ASN1_NULL, NULL, rk, rklen)) {
+                RSAerr(RSA_F_RSA_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
                 return 0;
-                }
+        }
 
         return 1;
-        }
+}
 
-static int rsa_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
-        {
+static int
+rsa_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
+{
         const unsigned char *p;
         int pklen;
+
         if (!PKCS8_pkey_get0(NULL, &p, &pklen, NULL, p8))
                 return 0;
         return old_rsa_priv_decode(pkey, &p, pklen);
-        }
+}
 
-static int int_rsa_size(const EVP_PKEY *pkey)
-        {
+static int
+int_rsa_size(const EVP_PKEY *pkey)
+{
         return RSA_size(pkey->pkey.rsa);
-        }
+}
 
-static int rsa_bits(const EVP_PKEY *pkey)
-        {
+static int
+rsa_bits(const EVP_PKEY *pkey)
+{
         return BN_num_bits(pkey->pkey.rsa->n);
-        }
+}
 
-static void int_rsa_free(EVP_PKEY *pkey)
-        {
+static void
+int_rsa_free(EVP_PKEY *pkey)
+{
         RSA_free(pkey->pkey.rsa);
-        }
-
+}
 
-static void update_buflen(const BIGNUM *b, size_t *pbuflen)
-        {
+static void
+update_buflen(const BIGNUM *b, size_t *pbuflen)
+{
         size_t i;
+
         if (!b)
                 return;
         if (*pbuflen < (i = (size_t)BN_num_bytes(b)))
-                        *pbuflen = i;
-        }
+                *pbuflen = i;
+}
 
-static int do_rsa_print(BIO *bp, const RSA *x, int off, int priv)
-        {
+static int
+do_rsa_print(BIO *bp, const RSA *x, int off, int priv)
+{
         char *str;
         const char *s;
-        unsigned char *m=NULL;
-        int ret=0, mod_len = 0;
-        size_t buf_len=0;
+        unsigned char *m = NULL;
+        int ret = 0, mod_len = 0;
+        size_t buf_len = 0;
 
         update_buflen(x->n, &buf_len);
         update_buflen(x->e, &buf_len);
 
-        if (priv)
-                {
+        if (priv) {
                 update_buflen(x->d, &buf_len);
                 update_buflen(x->p, &buf_len);
                 update_buflen(x->q, &buf_len);
                 update_buflen(x->dmp1, &buf_len);
                 update_buflen(x->dmq1, &buf_len);
                 update_buflen(x->iqmp, &buf_len);
-                }
+        }
 
-        m = malloc(buf_len+10);
-        if (m == NULL)
-                {
-                RSAerr(RSA_F_DO_RSA_PRINT,ERR_R_MALLOC_FAILURE);
+        m = malloc(buf_len + 10);
+        if (m == NULL) {
+                RSAerr(RSA_F_DO_RSA_PRINT, ERR_R_MALLOC_FAILURE);
                 goto err;
-                }
+        }
 
         if (x->n != NULL)
                 mod_len = BN_num_bits(x->n);
 
-        if(!BIO_indent(bp,off,128))
+        if (!BIO_indent(bp, off, 128))
                 goto err;
 
-        if (priv && x->d)
-                {
-                if (BIO_printf(bp,"Private-Key: (%d bit)\n", mod_len)
-                        <= 0) goto err;
+        if (priv && x->d) {
+                if (BIO_printf(bp, "Private-Key: (%d bit)\n", mod_len) <= 0)
+                        goto err;
                 str = "modulus:";
                 s = "publicExponent:";
-                }
-        else
-                {
-                if (BIO_printf(bp,"Public-Key: (%d bit)\n", mod_len)
-                        <= 0) goto err;
+        } else {
+                if (BIO_printf(bp, "Public-Key: (%d bit)\n", mod_len) <= 0)
+                        goto err;
                 str = "Modulus:";
                 s= "Exponent:";
-                }
-        if (!ASN1_bn_print(bp,str,x->n,m,off)) goto err;
-        if (!ASN1_bn_print(bp,s,x->e,m,off))
+        }
+        if (!ASN1_bn_print(bp, str, x->n, m, off))
                 goto err;
-        if (priv)
-                {
-                if (!ASN1_bn_print(bp,"privateExponent:",x->d,m,off))
+        if (!ASN1_bn_print(bp, s, x->e, m, off))
+                goto err;
+        if (priv) {
+                if (!ASN1_bn_print(bp, "privateExponent:", x->d,m, off))
                         goto err;
-                if (!ASN1_bn_print(bp,"prime1:",x->p,m,off))
+                if (!ASN1_bn_print(bp, "prime1:", x->p, m, off))
                         goto err;
-                if (!ASN1_bn_print(bp,"prime2:",x->q,m,off))
+                if (!ASN1_bn_print(bp, "prime2:", x->q, m, off))
                         goto err;
-                if (!ASN1_bn_print(bp,"exponent1:",x->dmp1,m,off))
+                if (!ASN1_bn_print(bp, "exponent1:", x->dmp1, m, off))
                         goto err;
-                if (!ASN1_bn_print(bp,"exponent2:",x->dmq1,m,off))
+                if (!ASN1_bn_print(bp, "exponent2:", x->dmq1, m, off))
                         goto err;
-                if (!ASN1_bn_print(bp,"coefficient:",x->iqmp,m,off))
+                if (!ASN1_bn_print(bp, "coefficient:", x->iqmp, m, off))
                         goto err;
-                }
-        ret=1;
+        }
+        ret = 1;
 err:
         free(m);
         return(ret);
-        }
+}
 
-static int rsa_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent,
-                                                        ASN1_PCTX *ctx)
-        {
+static int
+rsa_pub_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
+{
         return do_rsa_print(bp, pkey->pkey.rsa, indent, 0);
-        }
-
+}
 
-static int rsa_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent,
-                                                        ASN1_PCTX *ctx)
-        {
+static int
+rsa_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
+{
         return do_rsa_print(bp, pkey->pkey.rsa, indent, 1);
-        }
+}
 
-static RSA_PSS_PARAMS *rsa_pss_decode(const X509_ALGOR *alg,
-                                        X509_ALGOR **pmaskHash)
-        {
+static RSA_PSS_PARAMS *
+rsa_pss_decode(const X509_ALGOR *alg, X509_ALGOR **pmaskHash)
+{
         const unsigned char *p;
         int plen;
         RSA_PSS_PARAMS *pss;
@@ -283,31 +289,30 @@ static RSA_PSS_PARAMS *rsa_pss_decode(const X509_ALGOR *alg,
         if (!pss)
                 return NULL;
         
-        if (pss->maskGenAlgorithm)
-                {
+        if (pss->maskGenAlgorithm) {
                 ASN1_TYPE *param = pss->maskGenAlgorithm->parameter;
-                if (OBJ_obj2nid(pss->maskGenAlgorithm->algorithm) == NID_mgf1
-                        && param->type == V_ASN1_SEQUENCE)
-                        {
+                if (OBJ_obj2nid(pss->maskGenAlgorithm->algorithm) == NID_mgf1 &&
+                    param->type == V_ASN1_SEQUENCE) {
                         p = param->value.sequence->data;
                         plen = param->value.sequence->length;
                         *pmaskHash = d2i_X509_ALGOR(NULL, &p, plen);
-                        }
                 }
+        }
 
         return pss;
-        }
+}
 
-static int rsa_pss_param_print(BIO *bp, RSA_PSS_PARAMS *pss, 
-                                X509_ALGOR *maskHash, int indent)
-        {
+static int
+rsa_pss_param_print(BIO *bp, RSA_PSS_PARAMS *pss, X509_ALGOR *maskHash,
+    int indent)
+{
         int rv = 0;
-        if (!pss)
-                {
+
+        if (!pss) {
                 if (BIO_puts(bp, " (INVALID PSS PARAMETERS)\n") <= 0)
                         return 0;
                 return 1;
-                }
+        }
         if (BIO_puts(bp, "\n") <= 0)
                 goto err;
         if (!BIO_indent(bp, indent, 128))
@@ -315,12 +320,10 @@ static int rsa_pss_param_print(BIO *bp, RSA_PSS_PARAMS *pss,
         if (BIO_puts(bp, "Hash Algorithm: ") <= 0)
                 goto err;
 
-        if (pss->hashAlgorithm)
-                {
+        if (pss->hashAlgorithm) {
                 if (i2a_ASN1_OBJECT(bp, pss->hashAlgorithm->algorithm) <= 0)
                         goto err;
-                }
-        else if (BIO_puts(bp, "sha1 (default)") <= 0)
+        } else if (BIO_puts(bp, "sha1 (default)") <= 0)
                 goto err;
 
         if (BIO_puts(bp, "\n") <= 0)
@@ -330,22 +333,18 @@ static int rsa_pss_param_print(BIO *bp, RSA_PSS_PARAMS *pss,
                 goto err;
 
         if (BIO_puts(bp, "Mask Algorithm: ") <= 0)
-                        goto err;
-        if (pss->maskGenAlgorithm)
-                {
+                goto err;
+        if (pss->maskGenAlgorithm) {
                 if (i2a_ASN1_OBJECT(bp, pss->maskGenAlgorithm->algorithm) <= 0)
                         goto err;
                 if (BIO_puts(bp, " with ") <= 0)
                         goto err;
-                if (maskHash)
-                        {
+                if (maskHash) {
                         if (i2a_ASN1_OBJECT(bp, maskHash->algorithm) <= 0)
+                                goto err;
+                } else if (BIO_puts(bp, "INVALID") <= 0)
                         goto err;
-                        }
-                else if (BIO_puts(bp, "INVALID") <= 0)
-                        goto err;
-                }
-        else if (BIO_puts(bp, "mgf1 with sha1 (default)") <= 0)
+        } else if (BIO_puts(bp, "mgf1 with sha1 (default)") <= 0)
                 goto err;
         BIO_puts(bp, "\n");
 
@@ -353,41 +352,35 @@ static int rsa_pss_param_print(BIO *bp, RSA_PSS_PARAMS *pss,
                 goto err;
         if (BIO_puts(bp, "Salt Length: 0x") <= 0)
                         goto err;
-        if (pss->saltLength)
-                {
+        if (pss->saltLength) {
                 if (i2a_ASN1_INTEGER(bp, pss->saltLength) <= 0)
                         goto err;
-                }
-        else if (BIO_puts(bp, "0x14 (default)") <= 0)
+        } else if (BIO_puts(bp, "0x14 (default)") <= 0)
                 goto err;
         BIO_puts(bp, "\n");
 
         if (!BIO_indent(bp, indent, 128))
                 goto err;
         if (BIO_puts(bp, "Trailer Field: 0x") <= 0)
-                        goto err;
-        if (pss->trailerField)
-                {
+                goto err;
+        if (pss->trailerField) {
                 if (i2a_ASN1_INTEGER(bp, pss->trailerField) <= 0)
                         goto err;
-                }
-        else if (BIO_puts(bp, "BC (default)") <= 0)
+        } else if (BIO_puts(bp, "BC (default)") <= 0)
                 goto err;
         BIO_puts(bp, "\n");
         
         rv = 1;
 
-        err:
+err:
         return rv;
+}
 
-        }
-
-static int rsa_sig_print(BIO *bp, const X509_ALGOR *sigalg,
-                                        const ASN1_STRING *sig,
-                                        int indent, ASN1_PCTX *pctx)
-        {
-        if (OBJ_obj2nid(sigalg->algorithm) == NID_rsassaPss)
-                {
+static int
+rsa_sig_print(BIO *bp, const X509_ALGOR *sigalg, const ASN1_STRING *sig,
+    int indent, ASN1_PCTX *pctx)
+{
+        if (OBJ_obj2nid(sigalg->algorithm) == NID_rsassaPss) {
                 int rv;
                 RSA_PSS_PARAMS *pss;
                 X509_ALGOR *maskHash;
@@ -399,147 +392,132 @@ static int rsa_sig_print(BIO *bp, const X509_ALGOR *sigalg,
                         X509_ALGOR_free(maskHash);
                 if (!rv)
                         return 0;
-                }
-        else if (!sig && BIO_puts(bp, "\n") <= 0)
+        } else if (!sig && BIO_puts(bp, "\n") <= 0)
                 return 0;
         if (sig)
                 return X509_signature_dump(bp, sig, indent);
         return 1;
-        }
+}
 
-static int rsa_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
-        {
+static int
+rsa_pkey_ctrl(EVP_PKEY *pkey, int op, long arg1, void *arg2)
+{
         X509_ALGOR *alg = NULL;
-        switch (op)
-                {
-
-                case ASN1_PKEY_CTRL_PKCS7_SIGN:
+        switch (op) {
+        case ASN1_PKEY_CTRL_PKCS7_SIGN:
                 if (arg1 == 0)
                         PKCS7_SIGNER_INFO_get0_algs(arg2, NULL, NULL, &alg);
                 break;
 
-                case ASN1_PKEY_CTRL_PKCS7_ENCRYPT:
+        case ASN1_PKEY_CTRL_PKCS7_ENCRYPT:
                 if (arg1 == 0)
                         PKCS7_RECIP_INFO_get0_alg(arg2, &alg);
                 break;
 #ifndef OPENSSL_NO_CMS
-                case ASN1_PKEY_CTRL_CMS_SIGN:
+        case ASN1_PKEY_CTRL_CMS_SIGN:
                 if (arg1 == 0)
                         CMS_SignerInfo_get0_algs(arg2, NULL, NULL, NULL, &alg);
                 break;
 
-                case ASN1_PKEY_CTRL_CMS_ENVELOPE:
+        case ASN1_PKEY_CTRL_CMS_ENVELOPE:
                 if (arg1 == 0)
                         CMS_RecipientInfo_ktri_get0_algs(arg2, NULL, NULL, &alg);
-                break;
+        break;
 #endif
 
-                case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
+        case ASN1_PKEY_CTRL_DEFAULT_MD_NID:
                 *(int *)arg2 = NID_sha1;
                 return 1;
 
-                default:
+        default:
                 return -2;
-
-                }
+        }
 
         if (alg)
                 X509_ALGOR_set0(alg, OBJ_nid2obj(NID_rsaEncryption),
-                                                        V_ASN1_NULL, 0);
+                    V_ASN1_NULL, 0);
 
         return 1;
-
-        }
+}
 
 /* Customised RSA item verification routine. This is called 
  * when a signature is encountered requiring special handling. We 
  * currently only handle PSS.
  */
-
-
-static int rsa_item_verify(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
-                        X509_ALGOR *sigalg, ASN1_BIT_STRING *sig,
-                        EVP_PKEY *pkey)
-        {
+static int
+rsa_item_verify(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
+    X509_ALGOR *sigalg, ASN1_BIT_STRING *sig, EVP_PKEY *pkey)
+{
         int rv = -1;
         int saltlen;
         const EVP_MD *mgf1md = NULL, *md = NULL;
         RSA_PSS_PARAMS *pss;
         X509_ALGOR *maskHash;
         EVP_PKEY_CTX *pkctx;
+
         /* Sanity check: make sure it is PSS */
-        if (OBJ_obj2nid(sigalg->algorithm) != NID_rsassaPss)
-                {
+        if (OBJ_obj2nid(sigalg->algorithm) != NID_rsassaPss) {
                 RSAerr(RSA_F_RSA_ITEM_VERIFY, RSA_R_UNSUPPORTED_SIGNATURE_TYPE);
                 return -1;
-                }
+        }
         /* Decode PSS parameters */
         pss = rsa_pss_decode(sigalg, &maskHash);
 
-        if (pss == NULL)
-                {
+        if (pss == NULL) {
                 RSAerr(RSA_F_RSA_ITEM_VERIFY, RSA_R_INVALID_PSS_PARAMETERS);
                 goto err;
-                }
+        }
         /* Check mask and lookup mask hash algorithm */
-        if (pss->maskGenAlgorithm)
-                {
-                if (OBJ_obj2nid(pss->maskGenAlgorithm->algorithm) != NID_mgf1)
-                        {
-                        RSAerr(RSA_F_RSA_ITEM_VERIFY, RSA_R_UNSUPPORTED_MASK_ALGORITHM);
+        if (pss->maskGenAlgorithm) {
+                if (OBJ_obj2nid(pss->maskGenAlgorithm->algorithm) != NID_mgf1) {
+                        RSAerr(RSA_F_RSA_ITEM_VERIFY,
+                            RSA_R_UNSUPPORTED_MASK_ALGORITHM);
                         goto err;
-                        }
-                if (!maskHash)
-                        {
-                        RSAerr(RSA_F_RSA_ITEM_VERIFY, RSA_R_UNSUPPORTED_MASK_PARAMETER);
+                }
+                if (!maskHash) {
+                        RSAerr(RSA_F_RSA_ITEM_VERIFY,
+                            RSA_R_UNSUPPORTED_MASK_PARAMETER);
                         goto err;
-                        }
+                }
                 mgf1md = EVP_get_digestbyobj(maskHash->algorithm);
-                if (mgf1md == NULL)
-                        {
-                        RSAerr(RSA_F_RSA_ITEM_VERIFY, RSA_R_UNKNOWN_MASK_DIGEST);
+                if (mgf1md == NULL) {
+                        RSAerr(RSA_F_RSA_ITEM_VERIFY,
+                            RSA_R_UNKNOWN_MASK_DIGEST);
                         goto err;
-                        }
                 }
-        else
+        } else
                 mgf1md = EVP_sha1();
 
-        if (pss->hashAlgorithm)
-                {
+        if (pss->hashAlgorithm) {
                 md = EVP_get_digestbyobj(pss->hashAlgorithm->algorithm);
-                if (md == NULL)
-                        {
+                if (md == NULL) {
                         RSAerr(RSA_F_RSA_ITEM_VERIFY, RSA_R_UNKNOWN_PSS_DIGEST);
                         goto err;
-                        }
                 }
-        else
+        } else
                 md = EVP_sha1();
 
-        if (pss->saltLength)
-                {
+        if (pss->saltLength) {
                 saltlen = ASN1_INTEGER_get(pss->saltLength);
 
                 /* Could perform more salt length sanity checks but the main
                  * RSA routines will trap other invalid values anyway.
                  */
-                if (saltlen < 0)
-                        {
-                        RSAerr(RSA_F_RSA_ITEM_VERIFY, RSA_R_INVALID_SALT_LENGTH);
+                if (saltlen < 0) {
+                        RSAerr(RSA_F_RSA_ITEM_VERIFY,
+                            RSA_R_INVALID_SALT_LENGTH);
                         goto err;
-                        }
                 }
-        else
+        } else
                 saltlen = 20;
 
         /* low-level routines support only trailer field 0xbc (value 1)
          * and PKCS#1 says we should reject any other value anyway.
          */
-        if (pss->trailerField && ASN1_INTEGER_get(pss->trailerField) != 1)
-                {
+        if (pss->trailerField && ASN1_INTEGER_get(pss->trailerField) != 1) {
                 RSAerr(RSA_F_RSA_ITEM_VERIFY, RSA_R_INVALID_TRAILER);
                 goto err;
-                }
+        }
 
         /* We have all parameters now set up context */
 
@@ -557,31 +535,32 @@ static int rsa_item_verify(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
         /* Carry on */
         rv = 2;
 
-        err:
+err:
         RSA_PSS_PARAMS_free(pss);
         if (maskHash)
                 X509_ALGOR_free(maskHash);
         return rv;
-        }
+}
 
-static int rsa_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
-                                X509_ALGOR *alg1, X509_ALGOR *alg2, 
-                                ASN1_BIT_STRING *sig)
-        {
+static int
+rsa_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
+   X509_ALGOR *alg1, X509_ALGOR *alg2, ASN1_BIT_STRING *sig)
+{
         int pad_mode;
         EVP_PKEY_CTX *pkctx = ctx->pctx;
+
         if (EVP_PKEY_CTX_get_rsa_padding(pkctx, &pad_mode) <= 0)
                 return 0;
         if (pad_mode == RSA_PKCS1_PADDING)
                 return 2;
-        if (pad_mode == RSA_PKCS1_PSS_PADDING)
-                {
+        if (pad_mode == RSA_PKCS1_PSS_PADDING) {
                 const EVP_MD *sigmd, *mgf1md;
                 RSA_PSS_PARAMS *pss = NULL;
                 X509_ALGOR *mgf1alg = NULL;
                 ASN1_STRING *os1 = NULL, *os2 = NULL;
                 EVP_PKEY *pk = EVP_PKEY_CTX_get0_pkey(pkctx);
                 int saltlen, rv = 0;
+
                 sigmd = EVP_MD_CTX_md(ctx);
                 if (EVP_PKEY_CTX_get_rsa_mgf1_md(pkctx, &mgf1md) <= 0)
                         goto err;
@@ -589,62 +568,56 @@ static int rsa_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
                         goto err;
                 if (saltlen == -1)
                         saltlen = EVP_MD_size(sigmd);
-                else if (saltlen == -2)
-                        {
+                else if (saltlen == -2) {
                         saltlen = EVP_PKEY_size(pk) - EVP_MD_size(sigmd) - 2;
                         if (((EVP_PKEY_bits(pk) - 1) & 0x7) == 0)
                                 saltlen--;
-                        }
+                }
                 pss = RSA_PSS_PARAMS_new();
                 if (!pss)
                         goto err;
-                if (saltlen != 20)
-                        {
+                if (saltlen != 20) {
                         pss->saltLength = ASN1_INTEGER_new();
                         if (!pss->saltLength)
                                 goto err;
                         if (!ASN1_INTEGER_set(pss->saltLength, saltlen))
                                 goto err;
-                        }
-                if (EVP_MD_type(sigmd) != NID_sha1)
-                        {
+                }
+                if (EVP_MD_type(sigmd) != NID_sha1) {
                         pss->hashAlgorithm = X509_ALGOR_new();
                         if (!pss->hashAlgorithm)
                                 goto err;
                         X509_ALGOR_set_md(pss->hashAlgorithm, sigmd);
-                        }
-                if (EVP_MD_type(mgf1md) != NID_sha1)
-                        {
+                }
+                if (EVP_MD_type(mgf1md) != NID_sha1) {
                         ASN1_STRING *stmp = NULL;
                         /* need to embed algorithm ID inside another */
                         mgf1alg = X509_ALGOR_new();
                         X509_ALGOR_set_md(mgf1alg, mgf1md);
                         if (!ASN1_item_pack(mgf1alg, ASN1_ITEM_rptr(X509_ALGOR),
-                                                                        &stmp))
-                                        goto err;
+                            &stmp))
+                                goto err;
                         pss->maskGenAlgorithm = X509_ALGOR_new();
                         if (!pss->maskGenAlgorithm)
                                 goto err;
                         X509_ALGOR_set0(pss->maskGenAlgorithm,
-                                        OBJ_nid2obj(NID_mgf1),
-                                        V_ASN1_SEQUENCE, stmp);
-                        }
+                            OBJ_nid2obj(NID_mgf1), V_ASN1_SEQUENCE, stmp);
+                }
                 /* Finally create string with pss parameter encoding. */
                 if (!ASN1_item_pack(pss, ASN1_ITEM_rptr(RSA_PSS_PARAMS), &os1))
                         goto err;
-                if (alg2)
-                        {
+                if (alg2) {
                         os2 = ASN1_STRING_dup(os1);
                         if (!os2)
                                 goto err;
                         X509_ALGOR_set0(alg2, OBJ_nid2obj(NID_rsassaPss),
-                                                V_ASN1_SEQUENCE, os2);
-                        }
+                            V_ASN1_SEQUENCE, os2);
+                }
                 X509_ALGOR_set0(alg1, OBJ_nid2obj(NID_rsassaPss),
-                                        V_ASN1_SEQUENCE, os1);
+                    V_ASN1_SEQUENCE, os1);
                 os1 = os2 = NULL;
                 rv = 3;
-                err:
+err:
                 if (mgf1alg)
                         X509_ALGOR_free(mgf1alg);
                 if (pss)
@@ -652,10 +625,9 @@ static int rsa_item_sign(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
                 if (os1)
                         ASN1_STRING_free(os1);
                 return rv;
-                
-                }
-        return 2;
         }
+        return 2;
+}
 
 const EVP_PKEY_ASN1_METHOD rsa_asn1_meths[] = {
         {