7 files changed, 22 insertions, 19 deletions

diff --git a/src/lib/libcrypto/x509/x509_trs.c b/src/lib/libcrypto/x509/x509_trs.c
index 17d69ac005..881252608d 100644
--- a/src/lib/libcrypto/x509/x509_trs.c
+++ b/src/lib/libcrypto/x509/x509_trs.c
@@ -82,6 +82,7 @@ static X509_TRUST trstandard[] = {
 {X509_TRUST_SSL_CLIENT, 0, trust_1oidany, "SSL Client", NID_client_auth, NULL},
 {X509_TRUST_SSL_SERVER, 0, trust_1oidany, "SSL Server", NID_server_auth, NULL},
 {X509_TRUST_EMAIL, 0, trust_1oidany, "S/MIME email", NID_email_protect, NULL},
+{X509_TRUST_OBJECT_SIGN, 0, trust_1oidany, "Object Signer", NID_code_sign, NULL},
 {X509_TRUST_OCSP_SIGN, 0, trust_1oid, "OCSP responder", NID_OCSP_sign, NULL},
 {X509_TRUST_OCSP_REQUEST, 0, trust_1oid, "OCSP request", NID_ad_OCSP, NULL}
 };
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 552d1e7251..2bb21b443e 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -453,9 +453,9 @@ static int check_revocation(X509_STORE_CTX *ctx)
         if (!(ctx->flags & X509_V_FLAG_CRL_CHECK))
                 return 1;
         if (ctx->flags & X509_V_FLAG_CRL_CHECK_ALL)
-                last = 0;
-        else
                 last = sk_X509_num(ctx->chain) - 1;
+        else
+                last = 0;
         for(i = 0; i <= last; i++)
                 {
                 ctx->error_depth = i;
@@ -674,7 +674,7 @@ static int internal_verify(X509_STORE_CTX *ctx)
                                 ok=(*cb)(0,ctx);
                                 if (!ok) goto end;
                                 }
-                        if (X509_verify(xs,pkey) <= 0)
+                        else if (X509_verify(xs,pkey) <= 0)
                                 /* XXX  For the final trusted self-signed cert,
                                  * this is a waste of time.  That check should
                                  * optional so that e.g. 'openssl x509' can be
diff --git a/src/lib/libcrypto/x509/x509type.c b/src/lib/libcrypto/x509/x509type.c
index 8e78b34458..f78c2a6b43 100644
--- a/src/lib/libcrypto/x509/x509type.c
+++ b/src/lib/libcrypto/x509/x509type.c
@@ -99,14 +99,15 @@ int X509_certificate_type(X509 *x, EVP_PKEY *pkey)
         case EVP_PKEY_RSA:
                 ret|=EVP_PKS_RSA;
                 break;
-        case EVP_PKS_DSA:
+        case EVP_PKEY_DSA:
                 ret|=EVP_PKS_DSA;
                 break;
         default:
                 break;
                 }
 
-        if (EVP_PKEY_size(pk) <= 512)
+        if (EVP_PKEY_size(pk) <= 512/8) /* /8 because it's 512 bits we look
+                                           for, not bytes */
                 ret|=EVP_PKT_EXP;
         if(pkey==NULL) EVP_PKEY_free(pk);
         return(ret);
diff --git a/src/lib/libcrypto/x509v3/v3_conf.c b/src/lib/libcrypto/x509v3/v3_conf.c
index 1a3448e121..1284d5aaa5 100644
--- a/src/lib/libcrypto/x509v3/v3_conf.c
+++ b/src/lib/libcrypto/x509v3/v3_conf.c
@@ -236,7 +236,7 @@ static int v3_check_critical(char **value)
 static int v3_check_generic(char **value)
 {
         char *p = *value;
-        if ((strlen(p) < 4) || strncmp(p, "DER:,", 4)) return 0;
+        if ((strlen(p) < 4) || strncmp(p, "DER:", 4)) return 0;
         p+=4;
         while (isspace((unsigned char)*p)) p++;
         *value = p;
diff --git a/src/lib/libcrypto/x509v3/v3_cpols.c b/src/lib/libcrypto/x509v3/v3_cpols.c
index 0d4ab1f680..0d554f3a2c 100644
--- a/src/lib/libcrypto/x509v3/v3_cpols.c
+++ b/src/lib/libcrypto/x509v3/v3_cpols.c
@@ -73,7 +73,7 @@ static POLICYINFO *policy_section(X509V3_CTX *ctx,
                                  STACK_OF(CONF_VALUE) *polstrs, int ia5org);
 static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
                                         STACK_OF(CONF_VALUE) *unot, int ia5org);
-static STACK_OF(ASN1_INTEGER) *nref_nos(STACK_OF(CONF_VALUE) *nos);
+static int nref_nos(STACK_OF(ASN1_INTEGER) *nnums, STACK_OF(CONF_VALUE) *nos);
 
 X509V3_EXT_METHOD v3_cpols = {
 NID_certificate_policies, 0,ASN1_ITEM_ref(CERTIFICATEPOLICIES),
@@ -226,6 +226,8 @@ static POLICYINFO *policy_section(X509V3_CTX *ctx,
                         qual = notice_section(ctx, unot, ia5org);
                         X509V3_section_free(ctx, unot);
                         if(!qual) goto err;
+                        if(!pol->qualifiers) pol->qualifiers =
+                                                 sk_POLICYQUALINFO_new_null();
                         if(!sk_POLICYQUALINFO_push(pol->qualifiers, qual))
                                                                  goto merr;
                 } else {
@@ -255,7 +257,7 @@ static POLICYINFO *policy_section(X509V3_CTX *ctx,
 static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
                                         STACK_OF(CONF_VALUE) *unot, int ia5org)
 {
-        int i;
+        int i, ret;
         CONF_VALUE *cnf;
         USERNOTICE *not;
         POLICYQUALINFO *qual;
@@ -275,8 +277,8 @@ static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
                                 if(!(nref = NOTICEREF_new())) goto merr;
                                 not->noticeref = nref;
                         } else nref = not->noticeref;
-                        if(ia5org) nref->organization = M_ASN1_IA5STRING_new();
-                        else nref->organization = M_ASN1_VISIBLESTRING_new();
+                        if(ia5org) nref->organization->type = V_ASN1_IA5STRING;
+                        else nref->organization->type = V_ASN1_VISIBLESTRING;
                         if(!ASN1_STRING_set(nref->organization, cnf->value,
                                                  strlen(cnf->value))) goto merr;
                 } else if(!strcmp(cnf->name, "noticeNumbers")) {
@@ -292,12 +294,12 @@ static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
                                 X509V3_conf_err(cnf);
                                 goto err;
                         }
-                        nref->noticenos = nref_nos(nos);
+                        ret = nref_nos(nref->noticenos, nos);
                         sk_CONF_VALUE_pop_free(nos, X509V3_conf_free);
-                        if(!nref->noticenos) goto err;
+                        if (!ret)
+                                goto err;
                 } else {
                         X509V3err(X509V3_F_NOTICE_SECTION,X509V3_R_INVALID_OPTION);
-
                         X509V3_conf_err(cnf);
                         goto err;
                 }
@@ -319,15 +321,13 @@ static POLICYQUALINFO *notice_section(X509V3_CTX *ctx,
         return NULL;
 }
 
-static STACK_OF(ASN1_INTEGER) *nref_nos(STACK_OF(CONF_VALUE) *nos)
+static int nref_nos(STACK_OF(ASN1_INTEGER) *nnums, STACK_OF(CONF_VALUE) *nos)
 {
-        STACK_OF(ASN1_INTEGER) *nnums;
         CONF_VALUE *cnf;
         ASN1_INTEGER *aint;
 
         int i;
 
-        if(!(nnums = sk_ASN1_INTEGER_new_null())) goto merr;
         for(i = 0; i < sk_CONF_VALUE_num(nos); i++) {
                 cnf = sk_CONF_VALUE_value(nos, i);
                 if(!(aint = s2i_ASN1_INTEGER(NULL, cnf->name))) {
@@ -336,14 +336,14 @@ static STACK_OF(ASN1_INTEGER) *nref_nos(STACK_OF(CONF_VALUE) *nos)
                 }
                 if(!sk_ASN1_INTEGER_push(nnums, aint)) goto merr;
         }
-        return nnums;
+        return 1;
 
         merr:
         X509V3err(X509V3_F_NOTICE_SECTION,ERR_R_MALLOC_FAILURE);
 
         err:
         sk_ASN1_INTEGER_pop_free(nnums, ASN1_STRING_free);
-        return NULL;
+        return 0;
 }
 
 
diff --git a/src/lib/libcrypto/x509v3/v3_lib.c b/src/lib/libcrypto/x509v3/v3_lib.c
index 482ca8ccf5..ca5a4a4a57 100644
--- a/src/lib/libcrypto/x509v3/v3_lib.c
+++ b/src/lib/libcrypto/x509v3/v3_lib.c
@@ -202,6 +202,7 @@ void *X509V3_get_d2i(STACK_OF(X509_EXTENSION) *x, int nid, int *crit, int *idx)
                 if(OBJ_obj2nid(ex->object) == nid) {
                         if(idx) {
                                 *idx = i;
+                                found_ex = ex;
                                 break;
                         } else if(found_ex) {
                                 /* Found more than one */
diff --git a/src/lib/libcrypto/x509v3/v3_prn.c b/src/lib/libcrypto/x509v3/v3_prn.c
index 754808b625..5d268eb768 100644
--- a/src/lib/libcrypto/x509v3/v3_prn.c
+++ b/src/lib/libcrypto/x509v3/v3_prn.c
@@ -184,7 +184,7 @@ int X509V3_extensions_print(BIO *bp, char *title, STACK_OF(X509_EXTENSION) *exts
                 j=X509_EXTENSION_get_critical(ex);
                 if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0)
                         return 0;
-                if(!X509V3_EXT_print(bp, ex, flag, 12))
+                if(!X509V3_EXT_print(bp, ex, flag, indent + 4))
                         {
                         BIO_printf(bp, "%*s", indent + 4, "");
                         M_ASN1_OCTET_STRING_print(bp,ex->value);