PR: 2149

[oweals/openssl.git] / crypto / x509 / x509_cmp.c

diff --git a/crypto/x509/x509_cmp.c b/crypto/x509/x509_cmp.c
index ee234b04ad1689ba6eebf3379460cafd8fa1cc67..a75876edbbc5bc5e57d8a8cfc49b65f93f39cbf4 100644 (file)
--- a/crypto/x509/x509_cmp.c
+++ b/crypto/x509/x509_cmp.c
@@ -87,15 +87,20 @@ unsigned long X509_issuer_and_serial_hash(X509 *a)
        EVP_MD_CTX_init(&ctx);
        f=X509_NAME_oneline(a->cert_info->issuer,NULL,0);
        ret=strlen(f);
-       EVP_DigestInit_ex(&ctx, EVP_md5(), NULL);
-       EVP_DigestUpdate(&ctx,(unsigned char *)f,ret);
+       if (!EVP_DigestInit_ex(&ctx, EVP_md5(), NULL))
+               goto err;
+       if (!EVP_DigestUpdate(&ctx,(unsigned char *)f,ret))
+               goto err;
        OPENSSL_free(f);
-       EVP_DigestUpdate(&ctx,(unsigned char *)a->cert_info->serialNumber->data,
-               (unsigned long)a->cert_info->serialNumber->length);
-       EVP_DigestFinal_ex(&ctx,&(md[0]),NULL);
+       if(!EVP_DigestUpdate(&ctx,(unsigned char *)a->cert_info->serialNumber->data,
+               (unsigned long)a->cert_info->serialNumber->length))
+               goto err;
+       if (!EVP_DigestFinal_ex(&ctx,&(md[0]),NULL))
+               goto err;
        ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
                )&0xffffffffL;
+       err:
        EVP_MD_CTX_cleanup(&ctx);
        return(ret);
        }
@@ -133,6 +138,13 @@ unsigned long X509_issuer_name_hash(X509 *x)
        return(X509_NAME_hash(x->cert_info->issuer));
        }
 
+#ifndef OPENSSL_NO_MD5
+unsigned long X509_issuer_name_hash_old(X509 *x)
+       {
+       return(X509_NAME_hash_old(x->cert_info->issuer));
+       }
+#endif
+
 X509_NAME *X509_get_subject_name(X509 *a)
        {
        return(a->cert_info->subject);
@@ -148,6 +160,13 @@ unsigned long X509_subject_name_hash(X509 *x)
        return(X509_NAME_hash(x->cert_info->subject));
        }
 
+#ifndef OPENSSL_NO_MD5
+unsigned long X509_subject_name_hash_old(X509 *x)
+       {
+       return(X509_NAME_hash_old(x->cert_info->subject));
+       }
+#endif
+
 #ifndef OPENSSL_NO_SHA
 /* Compare two certificates: they must be identical for
  * this to work. NB: Although "cmp" operations are generally
@@ -173,16 +192,16 @@ int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
        {
        int ret;
 
-       /* Ensure canonical encoding is present */
+       /* Ensure canonical encoding is present and up to date */
 
-       if (!a->canon_enc)
+       if (!a->canon_enc || a->modified)
                {
                ret = i2d_X509_NAME((X509_NAME *)a, NULL);
                if (ret < 0)
                        return -2;
                }
 
-       if (!b->canon_enc)
+       if (!b->canon_enc || b->modified)
                {
                ret = i2d_X509_NAME((X509_NAME *)b, NULL);
                if (ret < 0)
@@ -201,11 +220,13 @@ int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
 unsigned long X509_NAME_hash(X509_NAME *x)
        {
        unsigned long ret=0;
-       unsigned char md[16];
+       unsigned char md[SHA_DIGEST_LENGTH];
 
        /* Make sure X509_NAME structure contains valid cached encoding */
        i2d_X509_NAME(x,NULL);
-       EVP_Digest(x->canon_enc, x->canon_enclen, md, NULL, EVP_sha1(), NULL);
+       if (!EVP_Digest(x->canon_enc, x->canon_enclen, md, NULL, EVP_sha1(),
+               NULL))
+               return 0;
 
        ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
@@ -225,7 +246,8 @@ unsigned long X509_NAME_hash_old(X509_NAME *x)
 
        /* Make sure X509_NAME structure contains valid cached encoding */
        i2d_X509_NAME(x,NULL);
-       EVP_Digest(x->bytes->data, x->bytes->length, md, NULL, EVP_md5(), NULL);
+       if (!EVP_Digest(x->bytes->data, x->bytes->length, md, NULL, EVP_md5(), NULL))
+               return 0;
 
        ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)