diff options
| author | Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> | 2018-05-02 23:06:15 +0200 |
|---|---|---|
| committer | Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> | 2018-05-03 22:22:37 +0200 |
| commit | bc624bd95554ea218cbc3fad0d794abdfeb21eb6 (patch) | |
| tree | 3594b0f05820bd9349323a0a1f96a39238cccf85 /crypto/x509v3/v3_purp.c | |
| parent | 463e6ef500ead3fefccc470ce2f82429bb060e70 (diff) | |
| download | openssl-bc624bd95554ea218cbc3fad0d794abdfeb21eb6.zip openssl-bc624bd95554ea218cbc3fad0d794abdfeb21eb6.tar.gz openssl-bc624bd95554ea218cbc3fad0d794abdfeb21eb6.tar.bz2 | |
v3_purp.c: add locking to x509v3_cache_extensions()
Fixes #6121
Thanks to Mingtao Yang for reporting this bug.
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6162)
Diffstat (limited to 'crypto/x509v3/v3_purp.c')
| -rw-r--r-- | crypto/x509v3/v3_purp.c | 24 |
1 files changed, 14 insertions, 10 deletions
diff --git a/crypto/x509v3/v3_purp.c b/crypto/x509v3/v3_purp.c index d344e2d..1ba1ce8 100644 --- a/crypto/x509v3/v3_purp.c +++ b/crypto/x509v3/v3_purp.c @@ -78,11 +78,9 @@ int X509_check_purpose(X509 *x, int id, int ca) { int idx; const X509_PURPOSE *pt; - if (!(x->ex_flags & EXFLAG_SET)) { - CRYPTO_THREAD_write_lock(x->lock); - x509v3_cache_extensions(x); - CRYPTO_THREAD_unlock(x->lock); - } + + x509v3_cache_extensions(x); + /* Return if side-effect only call */ if (id == -1) return 1; @@ -354,8 +352,16 @@ static void x509v3_cache_extensions(X509 *x) X509_EXTENSION *ex; int i; + if (x->ex_flags & EXFLAG_SET) return; + + CRYPTO_THREAD_write_lock(x->lock); + if (x->ex_flags & EXFLAG_SET) { + CRYPTO_THREAD_unlock(x->lock); + return; + } + X509_digest(x, EVP_sha1(), x->sha1_hash, NULL); /* V1 should mean no extensions ... */ if (!X509_get_version(x)) @@ -490,6 +496,7 @@ static void x509v3_cache_extensions(X509 *x) } x509_init_sig_info(x); x->ex_flags |= EXFLAG_SET; + CRYPTO_THREAD_unlock(x->lock); } /*- @@ -542,11 +549,7 @@ void X509_set_proxy_pathlen(X509 *x, long l) int X509_check_ca(X509 *x) { - if (!(x->ex_flags & EXFLAG_SET)) { - CRYPTO_THREAD_write_lock(x->lock); - x509v3_cache_extensions(x); - CRYPTO_THREAD_unlock(x->lock); - } + x509v3_cache_extensions(x); return check_ca(x); } @@ -760,6 +763,7 @@ int X509_check_issued(X509 *issuer, X509 *subject) if (X509_NAME_cmp(X509_get_subject_name(issuer), X509_get_issuer_name(subject))) return X509_V_ERR_SUBJECT_ISSUER_MISMATCH; + x509v3_cache_extensions(issuer); x509v3_cache_extensions(subject); |