3 files changed, 9 insertions, 14 deletions

diff --git a/src/lib/libcrypto/x509/Makefile.ssl b/src/lib/libcrypto/x509/Makefile.ssl
index 4619693733..79f09d4f71 100644
--- a/src/lib/libcrypto/x509/Makefile.ssl
+++ b/src/lib/libcrypto/x509/Makefile.ssl
@@ -49,7 +49,8 @@ all:	lib
 
 lib:    $(LIBOBJ)
         $(AR) $(LIB) $(LIBOBJ)
-        $(RANLIB) $(LIB)
+        @echo You may get an error following this line.  Please ignore.
+        - $(RANLIB) $(LIB)
         @touch lib
 
 files:
diff --git a/src/lib/libcrypto/x509/by_dir.c b/src/lib/libcrypto/x509/by_dir.c
index cac64a6f40..448bd7e69c 100644
--- a/src/lib/libcrypto/x509/by_dir.c
+++ b/src/lib/libcrypto/x509/by_dir.c
@@ -327,7 +327,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
                  * it out again */
                 CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE);
                 j = sk_X509_OBJECT_find(xl->store_ctx->objs,&stmp);
-                if(j != -1) tmp=sk_X509_OBJECT_value(xl->store_ctx->objs,i);
+                if(j != -1) tmp=sk_X509_OBJECT_value(xl->store_ctx->objs,j);
                 else tmp = NULL;
                 CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE);
 
diff --git a/src/lib/libcrypto/x509/x509_cmp.c b/src/lib/libcrypto/x509/x509_cmp.c
index b147d573d2..3f9f9b3d47 100644
--- a/src/lib/libcrypto/x509/x509_cmp.c
+++ b/src/lib/libcrypto/x509/x509_cmp.c
@@ -199,19 +199,13 @@ unsigned long X509_NAME_hash(X509_NAME *x)
         {
         unsigned long ret=0;
         unsigned char md[16];
-        unsigned char str[256],*p,*pp;
-        int i;
-
-        i=i2d_X509_NAME(x,NULL);
-        if (i > sizeof(str))
-                p=OPENSSL_malloc(i);
-        else
-                p=str;
 
-        pp=p;
-        i2d_X509_NAME(x,&pp);
-        MD5((unsigned char *)p,i,&(md[0]));
-        if (p != str) OPENSSL_free(p);
+        /* Ensure cached version is up to date */
+        i2d_X509_NAME(x,NULL);
+        /* Use cached encoding directly rather than copying: this should
+         * keep libsafe happy.
+         */
+        MD5((unsigned char *)x->bytes->data,x->bytes->length,&(md[0]));
 
         ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                 ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)