From 7793a2e39cc5f830148fcc983fc2ec0e0133fc2e Mon Sep 17 00:00:00 2001
From: David Benjamin <davidben@google.com>
Date: Tue, 25 Feb 2025 14:24:38 -0800
Subject: [PATCH] Avoid call to deprecated X509_STORE_get0_objects

X509_STORE_get0_objects is not thread-safe and also constrains
X509_STORE's internals in undesirable ways. See
https://github.com/openssl/openssl/pull/23224

TEST=ci

Change-Id: I0d501d92208e4af9de944b38c07cbcb66acaec66
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/407840
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: Brian Quinlan <bquinlan@google.com>
Reviewed-by: Brian Quinlan <bquinlan@google.com>
---
 runtime/bin/security_context_macos.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/runtime/bin/security_context_macos.cc b/runtime/bin/security_context_macos.cc
index 5b8e9d08c5b..7803d3c7c68 100644
--- a/runtime/bin/security_context_macos.cc
+++ b/runtime/bin/security_context_macos.cc
@@ -146,7 +146,8 @@ static ssl_verify_result_t CertificateVerificationCallback(SSL* ssl,
       CFArrayCreateMutable(nullptr, 0, nullptr));
   ASSERT(store != nullptr);
 
-  for (const X509_OBJECT* obj : X509_STORE_get0_objects(store)) {
+  bssl::UniquePtr<STACK_OF(X509_OBJECT)> objs(X509_STORE_get1_objects(store));
+  for (const X509_OBJECT* obj : objs.get()) {
     X509* ca = X509_OBJECT_get0_X509(obj);
     ScopedSecCertificateRef cert(CreateSecCertificateFromX509(ca));
     if (cert == nullptr) {