dart-lang/sdk
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Use accessors for X509_STORE and X509_OBJECT

Browse Source 
This will avoid build failures in the future when X509_STORE and
X509_OBJECT become opaque. Along the way, it does the following:

- Remove unnecessary NULL check for the object list (it's always
  non-NULL, and STACK_OF(T) functions generally treat NULL as the empty
  list).

- Use BoringSSL's ranged-for adapters for STACK_OF(T).

By using the X509_OBJECT accessor, rather than reaching into the union
directly, this also avoids a potential memory error in the future, if
you ever put non-X509 objects into your X509_STORE.
(X509_OBJECT_get0_X509 checks the type and returns NULL.)

TEST=rely on CI tests, this is refactor

Change-Id: Iafb8c06cfdfa86948119c229837b2e20b824f612
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/206460
Reviewed-by: Alexander Aprelev <aam@google.com>
Commit-Queue: Alexander Aprelev <aam@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
This commit is contained in:
David Benjamin
2021-07-12 19:57:34 +00:00
committed by commit-bot@chromium.org
parent 46b6bbe9da
commit ee65e3efa0
1 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runtime/bin/security_context_macos.cc
+6 -8
View File
@@ -162,15 +162,13 @@ static ssl_verify_result_t CertificateVerificationCallback(SSL* ssl,
ScopedCFMutableArrayRef trusted_certs(CFArrayCreateMutable(NULL, 0, NULL));
ASSERT(store != NULL);
if (store->objs != NULL) {
for (uintptr_t i = 0; i < sk_X509_OBJECT_num(store->objs); ++i) {
X509* ca = sk_X509_OBJECT_value(store->objs, i)->data.x509;
ScopedSecCertificateRef cert(CreateSecCertificateFromX509(ca));
if (cert == NULL) {
return ssl_verify_invalid;
}
CFArrayAppendValue(trusted_certs.get(), cert.release());
for (const X509_OBJECT* obj : X509_STORE_get0_objects(store)) {
X509* ca = X509_OBJECT_get0_X509(obj);
ScopedSecCertificateRef cert(CreateSecCertificateFromX509(ca));
if (cert == NULL) {
return ssl_verify_invalid;
}
CFArrayAppendValue(trusted_certs.get(), cert.release());
}
// Generate a policy for validating chains for SSL.