Skip to content

Commit 3a192bb

Browse files
rheniumrhenium
authored
Merge pull request #854 from rhenium/ky/do-not-use-null-sk
Avoid calling sk_*() with NULL
2 parents 697d449 + 895ce6f commit 3a192bb

File tree

8 files changed

+72
-62
lines changed

8 files changed

+72
-62
lines changed

‎ext/openssl/ossl.c‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -69,16 +69,9 @@ ossl_##name##_sk2ary(const STACK_OF(type) *sk) \
6969
int i, num; \
7070
VALUE ary; \
7171
\
72-
if (!sk) { \
73-
OSSL_Debug("empty sk!"); \
74-
return Qnil; \
75-
} \
72+
RUBY_ASSERT(sk != NULL); \
7673
num = sk_##type##_num(sk); \
77-
if (num < 0) { \
78-
OSSL_Debug("items in sk < -1???"); \
79-
return rb_ary_new(); \
80-
} \
81-
ary = rb_ary_new2(num); \
74+
ary = rb_ary_new_capa(num); \
8275
\
8376
for (i=0; i<num; i++) { \
8477
t = sk_##type##_value(sk, i); \

‎ext/openssl/ossl_pkcs7.c‎

Lines changed: 25 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -557,21 +557,16 @@ ossl_pkcs7_get_signer(VALUE self)
557557
{
558558
PKCS7 *pkcs7;
559559
STACK_OF(PKCS7_SIGNER_INFO) *sk;
560-
PKCS7_SIGNER_INFO *si;
561560
int num, i;
562561
VALUE ary;
563562

564563
GetPKCS7(self, pkcs7);
565-
if (!(sk = PKCS7_get_signer_info(pkcs7))) {
566-
OSSL_Debug("OpenSSL::PKCS7#get_signer_info == NULL!");
567-
return rb_ary_new();
568-
}
569-
if ((num = sk_PKCS7_SIGNER_INFO_num(sk)) < 0) {
570-
ossl_raise(ePKCS7Error, "Negative number of signers!");
571-
}
572-
ary = rb_ary_new2(num);
564+
if (!(sk = PKCS7_get_signer_info(pkcs7)))
565+
return rb_ary_new();
566+
num = sk_PKCS7_SIGNER_INFO_num(sk);
567+
ary = rb_ary_new_capa(num);
573568
for (i=0; i<num; i++) {
574-
si = sk_PKCS7_SIGNER_INFO_value(sk, i);
569+
PKCS7_SIGNER_INFO *si = sk_PKCS7_SIGNER_INFO_value(sk, i);
575570
rb_ary_push(ary, ossl_pkcs7si_new(si));
576571
}
577572

@@ -604,7 +599,6 @@ ossl_pkcs7_get_recipient(VALUE self)
604599
{
605600
PKCS7 *pkcs7;
606601
STACK_OF(PKCS7_RECIP_INFO) *sk;
607-
PKCS7_RECIP_INFO *si;
608602
int num, i;
609603
VALUE ary;
610604

@@ -615,13 +609,11 @@ ossl_pkcs7_get_recipient(VALUE self)
615609
sk = pkcs7->d.signed_and_enveloped->recipientinfo;
616610
else sk = NULL;
617611
if (!sk) return rb_ary_new();
618-
if ((num = sk_PKCS7_RECIP_INFO_num(sk)) < 0) {
619-
ossl_raise(ePKCS7Error, "Negative number of recipient!");
620-
}
621-
ary = rb_ary_new2(num);
612+
num = sk_PKCS7_RECIP_INFO_num(sk);
613+
ary = rb_ary_new_capa(num);
622614
for (i=0; i<num; i++) {
623-
si = sk_PKCS7_RECIP_INFO_value(sk, i);
624-
rb_ary_push(ary, ossl_pkcs7ri_new(si));
615+
PKCS7_RECIP_INFO *ri = sk_PKCS7_RECIP_INFO_value(sk, i);
616+
rb_ary_push(ary, ossl_pkcs7ri_new(ri));
625617
}
626618

627619
return ary;
@@ -701,7 +693,10 @@ ossl_pkcs7_set_certificates(VALUE self, VALUE ary)
701693
X509 *cert;
702694

703695
certs = pkcs7_get_certs(self);
704-
while((cert = sk_X509_pop(certs))) X509_free(cert);
696+
if (certs) {
697+
while ((cert = sk_X509_pop(certs)))
698+
X509_free(cert);
699+
}
705700
rb_block_call(ary, rb_intern("each"), 0, 0, ossl_pkcs7_set_certs_i, self);
706701

707702
return ary;
@@ -710,7 +705,10 @@ ossl_pkcs7_set_certificates(VALUE self, VALUE ary)
710705
static VALUE
711706
ossl_pkcs7_get_certificates(VALUE self)
712707
{
713-
return ossl_x509_sk2ary(pkcs7_get_certs(self));
708+
STACK_OF(X509) *certs = pkcs7_get_certs(self);
709+
if (!certs)
710+
return Qnil;
711+
return ossl_x509_sk2ary(certs);
714712
}
715713

716714
static VALUE
@@ -741,7 +739,10 @@ ossl_pkcs7_set_crls(VALUE self, VALUE ary)
741739
X509_CRL *crl;
742740

743741
crls = pkcs7_get_crls(self);
744-
while((crl = sk_X509_CRL_pop(crls))) X509_CRL_free(crl);
742+
if (crls) {
743+
while ((crl = sk_X509_CRL_pop(crls)))
744+
X509_CRL_free(crl);
745+
}
745746
rb_block_call(ary, rb_intern("each"), 0, 0, ossl_pkcs7_set_crls_i, self);
746747

747748
return ary;
@@ -750,7 +751,10 @@ ossl_pkcs7_set_crls(VALUE self, VALUE ary)
750751
static VALUE
751752
ossl_pkcs7_get_crls(VALUE self)
752753
{
753-
return ossl_x509crl_sk2ary(pkcs7_get_crls(self));
754+
STACK_OF(X509_CRL) *crls = pkcs7_get_crls(self);
755+
if (!crls)
756+
return Qnil;
757+
return ossl_x509crl_sk2ary(crls);
754758
}
755759

756760
static VALUE

‎ext/openssl/ossl_ssl.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2450,7 +2450,7 @@ ossl_ssl_get_peer_finished(VALUE self)
24502450

24512451
/*
24522452
* call-seq:
2453-
* ssl.client_ca => [x509name, ...]
2453+
* ssl.client_ca => [x509name, ...] or nil
24542454
*
24552455
* Returns the list of client CAs. Please note that in contrast to
24562456
* SSLContext#client_ca= no array of X509::Certificate is returned but
@@ -2468,6 +2468,8 @@ ossl_ssl_get_client_ca_list(VALUE self)
24682468
GetSSL(self, ssl);
24692469

24702470
ca = SSL_get_client_CA_list(ssl);
2471+
if (!ca)
2472+
return Qnil;
24712473
return ossl_x509name_sk2ary(ca);
24722474
}
24732475

‎ext/openssl/ossl_x509cert.c‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -619,10 +619,7 @@ ossl_x509_get_extensions(VALUE self)
619619

620620
GetX509(self, x509);
621621
count = X509_get_ext_count(x509);
622-
if (count < 0) {
623-
return rb_ary_new();
624-
}
625-
ary = rb_ary_new2(count);
622+
ary = rb_ary_new_capa(count);
626623
for (i=0; i<count; i++) {
627624
ext = X509_get_ext(x509, i); /* NO DUP - don't free! */
628625
rb_ary_push(ary, ossl_x509ext_new(ext));

‎ext/openssl/ossl_x509crl.c‎

Lines changed: 11 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -276,21 +276,19 @@ ossl_x509crl_get_revoked(VALUE self)
276276
{
277277
X509_CRL *crl;
278278
int i, num;
279-
X509_REVOKED *rev;
280-
VALUE ary, revoked;
279+
STACK_OF(X509_REVOKED) *sk;
280+
VALUE ary;
281281

282282
GetX509CRL(self, crl);
283-
num = sk_X509_REVOKED_num(X509_CRL_get_REVOKED(crl));
284-
if (num < 0) {
285-
OSSL_Debug("num < 0???");
286-
return rb_ary_new();
287-
}
288-
ary = rb_ary_new2(num);
283+
sk = X509_CRL_get_REVOKED(crl);
284+
if (!sk)
285+
return rb_ary_new();
286+
287+
num = sk_X509_REVOKED_num(sk);
288+
ary = rb_ary_new_capa(num);
289289
for(i=0; i<num; i++) {
290-
/* NO DUP - don't free! */
291-
rev = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), i);
292-
revoked = ossl_x509revoked_new(rev);
293-
rb_ary_push(ary, revoked);
290+
X509_REVOKED *rev = sk_X509_REVOKED_value(sk, i);
291+
rb_ary_push(ary, ossl_x509revoked_new(rev));
294292
}
295293

296294
return ary;
@@ -451,11 +449,7 @@ ossl_x509crl_get_extensions(VALUE self)
451449

452450
GetX509CRL(self, crl);
453451
count = X509_CRL_get_ext_count(crl);
454-
if (count < 0) {
455-
OSSL_Debug("count < 0???");
456-
return rb_ary_new();
457-
}
458-
ary = rb_ary_new2(count);
452+
ary = rb_ary_new_capa(count);
459453
for (i=0; i<count; i++) {
460454
ext = X509_CRL_get_ext(crl, i); /* NO DUP - don't free! */
461455
rb_ary_push(ary, ossl_x509ext_new(ext));

‎ext/openssl/ossl_x509name.c‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -354,11 +354,7 @@ ossl_x509name_to_a(VALUE self)
354354

355355
GetX509Name(self, name);
356356
entries = X509_NAME_entry_count(name);
357-
if (entries < 0) {
358-
OSSL_Debug("name entries < 0!");
359-
return rb_ary_new();
360-
}
361-
ret = rb_ary_new2(entries);
357+
ret = rb_ary_new_capa(entries);
362358
for (i=0; i<entries; i++) {
363359
if (!(entry = X509_NAME_get_entry(name, i))) {
364360
ossl_raise(eX509NameError, NULL);

‎ext/openssl/ossl_x509revoked.c‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -194,11 +194,7 @@ ossl_x509revoked_get_extensions(VALUE self)
194194

195195
GetX509Rev(self, rev);
196196
count = X509_REVOKED_get_ext_count(rev);
197-
if (count < 0) {
198-
OSSL_Debug("count < 0???");
199-
return rb_ary_new();
200-
}
201-
ary = rb_ary_new2(count);
197+
ary = rb_ary_new_capa(count);
202198
for (i=0; i<count; i++) {
203199
ext = X509_REVOKED_get_ext(rev, i);
204200
rb_ary_push(ary, ossl_x509ext_new(ext));

‎test/openssl/test_pkcs7.rb‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,34 @@ def test_enveloped
160160
}
161161
end
162162

163+
def test_data
164+
asn1 = OpenSSL::ASN1::Sequence([
165+
OpenSSL::ASN1::ObjectId("pkcs7-data"),
166+
OpenSSL::ASN1::OctetString("content", 0, :EXPLICIT),
167+
])
168+
p7 = OpenSSL::PKCS7.new
169+
p7.type = :data
170+
p7.data = "content"
171+
assert_raise(OpenSSL::PKCS7::PKCS7Error) { p7.add_certificate(@ee1_cert) }
172+
assert_raise(OpenSSL::PKCS7::PKCS7Error) { p7.certificates = [@ee1_cert] }
173+
assert_raise(OpenSSL::PKCS7::PKCS7Error) { p7.cipher = "aes-128-cbc" }
174+
assert_equal(asn1.to_der, p7.to_der)
175+
176+
p7 = OpenSSL::PKCS7.new(asn1)
177+
assert_equal(:data, p7.type)
178+
assert_equal(false, p7.detached?)
179+
# Not applicable
180+
assert_nil(p7.certificates)
181+
assert_nil(p7.crls)
182+
# Not applicable. Should they return nil or raise an exception instead?
183+
assert_equal([], p7.signers)
184+
assert_equal([], p7.recipients)
185+
# PKCS7#verify can't distinguish verification failure and other errors
186+
store = OpenSSL::X509::Store.new
187+
assert_equal(false, p7.verify([@ee1_cert], store))
188+
assert_raise(OpenSSL::PKCS7::PKCS7Error) { p7.decrypt(@rsa1024) }
189+
end
190+
163191
def test_empty_signed_data_ruby_bug_19974
164192
data = "-----BEGIN PKCS7-----\nMAsGCSqGSIb3DQEHAg==\n-----END PKCS7-----\n"
165193
assert_raise(ArgumentError) { OpenSSL::PKCS7.new(data) }

0 commit comments

Comments
 (0)