From ee65e3efa00f4f0af523e0f0e05cd92fd2cc584a Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Mon, 12 Jul 2021 19:57:34 +0000 Subject: [PATCH] Use accessors for X509_STORE and X509_OBJECT This will avoid build failures in the future when X509_STORE and X509_OBJECT become opaque. Along the way, it does the following: - Remove unnecessary NULL check for the object list (it's always non-NULL, and STACK_OF(T) functions generally treat NULL as the empty list). - Use BoringSSL's ranged-for adapters for STACK_OF(T). By using the X509_OBJECT accessor, rather than reaching into the union directly, this also avoids a potential memory error in the future, if you ever put non-X509 objects into your X509_STORE. (X509_OBJECT_get0_X509 checks the type and returns NULL.) TEST=rely on CI tests, this is refactor Change-Id: Iafb8c06cfdfa86948119c229837b2e20b824f612 Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/206460 Reviewed-by: Alexander Aprelev Commit-Queue: Alexander Aprelev Auto-Submit: David Benjamin --- runtime/bin/security_context_macos.cc | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/runtime/bin/security_context_macos.cc b/runtime/bin/security_context_macos.cc index 410a33b11b3..357173daf8f 100644 --- a/runtime/bin/security_context_macos.cc +++ b/runtime/bin/security_context_macos.cc @@ -162,15 +162,13 @@ static ssl_verify_result_t CertificateVerificationCallback(SSL* ssl, ScopedCFMutableArrayRef trusted_certs(CFArrayCreateMutable(NULL, 0, NULL)); ASSERT(store != NULL); - if (store->objs != NULL) { - for (uintptr_t i = 0; i < sk_X509_OBJECT_num(store->objs); ++i) { - X509* ca = sk_X509_OBJECT_value(store->objs, i)->data.x509; - ScopedSecCertificateRef cert(CreateSecCertificateFromX509(ca)); - if (cert == NULL) { - return ssl_verify_invalid; - } - CFArrayAppendValue(trusted_certs.get(), cert.release()); + for (const X509_OBJECT* obj : X509_STORE_get0_objects(store)) { + X509* ca = X509_OBJECT_get0_X509(obj); + ScopedSecCertificateRef cert(CreateSecCertificateFromX509(ca)); + if (cert == NULL) { + return ssl_verify_invalid; } + CFArrayAppendValue(trusted_certs.get(), cert.release()); } // Generate a policy for validating chains for SSL.