Const-correct the 'kstr' parameter of PEM functions

Also rename to pass and pass_len, which makes a bit more sense for what
these are.

Change-Id: If3421ed7890c92cd11130641a8a2e090cc7f8b91
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/65810
Commit-Queue: David Benjamin <davidben@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Bob Beck <bbe@google.com>

4 files changed, 131 insertions, 123 deletions

diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c
index 30ba387..38c1d3f 100644
--- a/crypto/pem/pem_lib.c
+++ b/crypto/pem/pem_lib.c
@@ -261,21 +261,22 @@ err:
 }
 
 int PEM_ASN1_write(i2d_of_void *i2d, const char *name, FILE *fp, void *x,
-                   const EVP_CIPHER *enc, unsigned char *kstr, int klen,
-                   pem_password_cb *callback, void *u) {
+                   const EVP_CIPHER *enc, const unsigned char *pass,
+                   int pass_len, pem_password_cb *callback, void *u) {
   BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
   if (b == NULL) {
     OPENSSL_PUT_ERROR(PEM, ERR_R_BUF_LIB);
     return 0;
   }
-  int ret = PEM_ASN1_write_bio(i2d, name, b, x, enc, kstr, klen, callback, u);
+  int ret =
+      PEM_ASN1_write_bio(i2d, name, b, x, enc, pass, pass_len, callback, u);
   BIO_free(b);
   return ret;
 }
 
 int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
-                       const EVP_CIPHER *enc, unsigned char *kstr, int klen,
-                       pem_password_cb *callback, void *u) {
+                       const EVP_CIPHER *enc, const unsigned char *pass,
+                       int pass_len, pem_password_cb *callback, void *u) {
   EVP_CIPHER_CTX ctx;
   int dsize = 0, i, j, ret = 0;
   unsigned char *p, *data = NULL;
@@ -310,17 +311,17 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
   if (enc != NULL) {
     const unsigned iv_len = EVP_CIPHER_iv_length(enc);
 
-    if (kstr == NULL) {
-      klen = 0;
+    if (pass == NULL) {
+      pass_len = 0;
       if (!callback) {
         callback = PEM_def_callback;
       }
-      klen = (*callback)(buf, PEM_BUFSIZE, 1, u);
-      if (klen <= 0) {
+      pass_len = (*callback)(buf, PEM_BUFSIZE, 1, u);
+      if (pass_len <= 0) {
         OPENSSL_PUT_ERROR(PEM, PEM_R_READ_KEY);
         goto err;
       }
-      kstr = (unsigned char *)buf;
+      pass = (const unsigned char *)buf;
     }
     assert(iv_len <= sizeof(iv));
     if (!RAND_bytes(iv, iv_len)) {  // Generate a salt
@@ -328,11 +329,11 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
     }
     // The 'iv' is used as the iv and as a salt.  It is NOT taken from
     // the BytesToKey function
-    if (!EVP_BytesToKey(enc, EVP_md5(), iv, kstr, klen, 1, key, NULL)) {
+    if (!EVP_BytesToKey(enc, EVP_md5(), iv, pass, pass_len, 1, key, NULL)) {
       goto err;
     }
 
-    if (kstr == (unsigned char *)buf) {
+    if (pass == (const unsigned char *)buf) {
       OPENSSL_cleanse(buf, PEM_BUFSIZE);
     }
 
@@ -375,7 +376,7 @@ err:
 
 int PEM_do_header(EVP_CIPHER_INFO *cipher, unsigned char *data, long *plen,
                   pem_password_cb *callback, void *u) {
-  int i = 0, j, o, klen;
+  int i = 0, j, o, pass_len;
   long len;
   EVP_CIPHER_CTX ctx;
   unsigned char key[EVP_MAX_KEY_LENGTH];
@@ -387,18 +388,18 @@ int PEM_do_header(EVP_CIPHER_INFO *cipher, unsigned char *data, long *plen,
     return 1;
   }
 
-  klen = 0;
+  pass_len = 0;
   if (!callback) {
     callback = PEM_def_callback;
   }
-  klen = callback(buf, PEM_BUFSIZE, 0, u);
-  if (klen <= 0) {
+  pass_len = callback(buf, PEM_BUFSIZE, 0, u);
+  if (pass_len <= 0) {
     OPENSSL_PUT_ERROR(PEM, PEM_R_BAD_PASSWORD_READ);
     return 0;
   }
 
   if (!EVP_BytesToKey(cipher->cipher, EVP_md5(), &(cipher->iv[0]),
-                      (unsigned char *)buf, klen, 1, key, NULL)) {
+                      (unsigned char *)buf, pass_len, 1, key, NULL)) {
     return 0;
   }
 
diff --git a/crypto/pem/pem_pk8.c b/crypto/pem/pem_pk8.c
index 610f36c..9c6419b 100644
--- a/crypto/pem/pem_pk8.c
+++ b/crypto/pem/pem_pk8.c
@@ -65,10 +65,10 @@
 #include <openssl/x509.h>
 
 static int do_pk8pkey(BIO *bp, const EVP_PKEY *x, int isder, int nid,
-                      const EVP_CIPHER *enc, char *kstr, int klen,
+                      const EVP_CIPHER *enc, const char *pass, int pass_len,
                       pem_password_cb *cb, void *u);
 static int do_pk8pkey_fp(FILE *bp, const EVP_PKEY *x, int isder, int nid,
-                         const EVP_CIPHER *enc, char *kstr, int klen,
+                         const EVP_CIPHER *enc, const char *pass, int pass_len,
                          pem_password_cb *cb, void *u);
 
 // These functions write a private key in PKCS#8 format: it is a "drop in"
@@ -77,30 +77,31 @@ static int do_pk8pkey_fp(FILE *bp, const EVP_PKEY *x, int isder, int nid,
 // uses PKCS#5 v1.5 PBE algorithms whereas the others use PKCS#5 v2.0.
 
 int PEM_write_bio_PKCS8PrivateKey_nid(BIO *bp, const EVP_PKEY *x, int nid,
-                                      char *kstr, int klen, pem_password_cb *cb,
-                                      void *u) {
-  return do_pk8pkey(bp, x, 0, nid, NULL, kstr, klen, cb, u);
+                                      const char *pass, int pass_len,
+                                      pem_password_cb *cb, void *u) {
+  return do_pk8pkey(bp, x, 0, nid, NULL, pass, pass_len, cb, u);
 }
 
 int PEM_write_bio_PKCS8PrivateKey(BIO *bp, const EVP_PKEY *x,
-                                  const EVP_CIPHER *enc, char *kstr, int klen,
-                                  pem_password_cb *cb, void *u) {
-  return do_pk8pkey(bp, x, 0, -1, enc, kstr, klen, cb, u);
+                                  const EVP_CIPHER *enc, const char *pass,
+                                  int pass_len, pem_password_cb *cb, void *u) {
+  return do_pk8pkey(bp, x, 0, -1, enc, pass, pass_len, cb, u);
 }
 
 int i2d_PKCS8PrivateKey_bio(BIO *bp, const EVP_PKEY *x, const EVP_CIPHER *enc,
-                            char *kstr, int klen, pem_password_cb *cb,
+                            const char *pass, int pass_len, pem_password_cb *cb,
                             void *u) {
-  return do_pk8pkey(bp, x, 1, -1, enc, kstr, klen, cb, u);
+  return do_pk8pkey(bp, x, 1, -1, enc, pass, pass_len, cb, u);
 }
 
-int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, const EVP_PKEY *x, int nid, char *kstr,
-                                int klen, pem_password_cb *cb, void *u) {
-  return do_pk8pkey(bp, x, 1, nid, NULL, kstr, klen, cb, u);
+int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, const EVP_PKEY *x, int nid,
+                                const char *pass, int pass_len,
+                                pem_password_cb *cb, void *u) {
+  return do_pk8pkey(bp, x, 1, nid, NULL, pass, pass_len, cb, u);
 }
 
 static int do_pk8pkey(BIO *bp, const EVP_PKEY *x, int isder, int nid,
-                      const EVP_CIPHER *enc, char *kstr, int klen,
+                      const EVP_CIPHER *enc, const char *pass, int pass_len,
                       pem_password_cb *cb, void *u) {
   X509_SIG *p8;
   PKCS8_PRIV_KEY_INFO *p8inf;
@@ -111,23 +112,23 @@ static int do_pk8pkey(BIO *bp, const EVP_PKEY *x, int isder, int nid,
     return 0;
   }
   if (enc || (nid != -1)) {
-    if (!kstr) {
-      klen = 0;
+    if (!pass) {
+      pass_len = 0;
       if (!cb) {
         cb = PEM_def_callback;
       }
-      klen = cb(buf, PEM_BUFSIZE, 1, u);
-      if (klen <= 0) {
+      pass_len = cb(buf, PEM_BUFSIZE, 1, u);
+      if (pass_len <= 0) {
         OPENSSL_PUT_ERROR(PEM, PEM_R_READ_KEY);
         PKCS8_PRIV_KEY_INFO_free(p8inf);
         return 0;
       }
 
-      kstr = buf;
+      pass = buf;
     }
-    p8 = PKCS8_encrypt(nid, enc, kstr, klen, NULL, 0, 0, p8inf);
-    if (kstr == buf) {
-      OPENSSL_cleanse(buf, klen);
+    p8 = PKCS8_encrypt(nid, enc, pass, pass_len, NULL, 0, 0, p8inf);
+    if (pass == buf) {
+      OPENSSL_cleanse(buf, pass_len);
     }
     PKCS8_PRIV_KEY_INFO_free(p8inf);
     if (isder) {
@@ -152,7 +153,7 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
                                   void *u) {
   PKCS8_PRIV_KEY_INFO *p8inf = NULL;
   X509_SIG *p8 = NULL;
-  int klen;
+  int pass_len;
   EVP_PKEY *ret;
   char psbuf[PEM_BUFSIZE];
   p8 = d2i_PKCS8_bio(bp, NULL);
@@ -160,19 +161,19 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
     return NULL;
   }
 
-  klen = 0;
+  pass_len = 0;
   if (!cb) {
     cb = PEM_def_callback;
   }
-  klen = cb(psbuf, PEM_BUFSIZE, 0, u);
-  if (klen <= 0) {
+  pass_len = cb(psbuf, PEM_BUFSIZE, 0, u);
+  if (pass_len <= 0) {
     OPENSSL_PUT_ERROR(PEM, PEM_R_BAD_PASSWORD_READ);
     X509_SIG_free(p8);
     return NULL;
   }
-  p8inf = PKCS8_decrypt(p8, psbuf, klen);
+  p8inf = PKCS8_decrypt(p8, psbuf, pass_len);
   X509_SIG_free(p8);
-  OPENSSL_cleanse(psbuf, klen);
+  OPENSSL_cleanse(psbuf, pass_len);
   if (!p8inf) {
     return NULL;
   }
@@ -192,29 +193,31 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
 
 
 int i2d_PKCS8PrivateKey_fp(FILE *fp, const EVP_PKEY *x, const EVP_CIPHER *enc,
-                           char *kstr, int klen, pem_password_cb *cb, void *u) {
-  return do_pk8pkey_fp(fp, x, 1, -1, enc, kstr, klen, cb, u);
+                           const char *pass, int pass_len, pem_password_cb *cb,
+                           void *u) {
+  return do_pk8pkey_fp(fp, x, 1, -1, enc, pass, pass_len, cb, u);
 }
 
-int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, const EVP_PKEY *x, int nid, char *kstr,
-                               int klen, pem_password_cb *cb, void *u) {
-  return do_pk8pkey_fp(fp, x, 1, nid, NULL, kstr, klen, cb, u);
+int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, const EVP_PKEY *x, int nid,
+                               const char *pass, int pass_len,
+                               pem_password_cb *cb, void *u) {
+  return do_pk8pkey_fp(fp, x, 1, nid, NULL, pass, pass_len, cb, u);
 }
 
 int PEM_write_PKCS8PrivateKey_nid(FILE *fp, const EVP_PKEY *x, int nid,
-                                  char *kstr, int klen, pem_password_cb *cb,
-                                  void *u) {
-  return do_pk8pkey_fp(fp, x, 0, nid, NULL, kstr, klen, cb, u);
+                                  const char *pass, int pass_len,
+                                  pem_password_cb *cb, void *u) {
+  return do_pk8pkey_fp(fp, x, 0, nid, NULL, pass, pass_len, cb, u);
 }
 
 int PEM_write_PKCS8PrivateKey(FILE *fp, const EVP_PKEY *x,
-                              const EVP_CIPHER *enc, char *kstr, int klen,
-                              pem_password_cb *cb, void *u) {
-  return do_pk8pkey_fp(fp, x, 0, -1, enc, kstr, klen, cb, u);
+                              const EVP_CIPHER *enc, const char *pass,
+                              int pass_len, pem_password_cb *cb, void *u) {
+  return do_pk8pkey_fp(fp, x, 0, -1, enc, pass, pass_len, cb, u);
 }
 
 static int do_pk8pkey_fp(FILE *fp, const EVP_PKEY *x, int isder, int nid,
-                         const EVP_CIPHER *enc, char *kstr, int klen,
+                         const EVP_CIPHER *enc, const char *pass, int pass_len,
                          pem_password_cb *cb, void *u) {
   BIO *bp;
   int ret;
@@ -222,7 +225,7 @@ static int do_pk8pkey_fp(FILE *fp, const EVP_PKEY *x, int isder, int nid,
     OPENSSL_PUT_ERROR(PEM, ERR_R_BUF_LIB);
     return 0;
   }
-  ret = do_pk8pkey(bp, x, isder, nid, enc, kstr, klen, cb, u);
+  ret = do_pk8pkey(bp, x, isder, nid, enc, pass, pass_len, cb, u);
   BIO_free(bp);
   return ret;
 }
diff --git a/crypto/pem/pem_pkey.c b/crypto/pem/pem_pkey.c
index 2d28d6c..2fb450c 100644
--- a/crypto/pem/pem_pkey.c
+++ b/crypto/pem/pem_pkey.c
@@ -98,26 +98,26 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
   } else if (strcmp(nm, PEM_STRING_PKCS8) == 0) {
     PKCS8_PRIV_KEY_INFO *p8inf;
     X509_SIG *p8;
-    int klen;
+    int pass_len;
     char psbuf[PEM_BUFSIZE];
     p8 = d2i_X509_SIG(NULL, &p, len);
     if (!p8) {
       goto p8err;
     }
 
-    klen = 0;
+    pass_len = 0;
     if (!cb) {
       cb = PEM_def_callback;
     }
-    klen = cb(psbuf, PEM_BUFSIZE, 0, u);
-    if (klen <= 0) {
+    pass_len = cb(psbuf, PEM_BUFSIZE, 0, u);
+    if (pass_len <= 0) {
       OPENSSL_PUT_ERROR(PEM, PEM_R_BAD_PASSWORD_READ);
       X509_SIG_free(p8);
       goto err;
     }
-    p8inf = PKCS8_decrypt(p8, psbuf, klen);
+    p8inf = PKCS8_decrypt(p8, psbuf, pass_len);
     X509_SIG_free(p8);
-    OPENSSL_cleanse(psbuf, klen);
+    OPENSSL_cleanse(psbuf, pass_len);
     if (!p8inf) {
       goto p8err;
     }
@@ -151,9 +151,10 @@ err:
 }
 
 int PEM_write_bio_PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
-                             unsigned char *kstr, int klen, pem_password_cb *cb,
-                             void *u) {
-  return PEM_write_bio_PKCS8PrivateKey(bp, x, enc, (char *)kstr, klen, cb, u);
+                             const unsigned char *pass, int pass_len,
+                             pem_password_cb *cb, void *u) {
+  return PEM_write_bio_PKCS8PrivateKey(bp, x, enc, (const char *)pass, pass_len,
+                                       cb, u);
 }
 
 EVP_PKEY *PEM_read_PrivateKey(FILE *fp, EVP_PKEY **x, pem_password_cb *cb,
@@ -169,14 +170,14 @@ EVP_PKEY *PEM_read_PrivateKey(FILE *fp, EVP_PKEY **x, pem_password_cb *cb,
 }
 
 int PEM_write_PrivateKey(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
-                         unsigned char *kstr, int klen, pem_password_cb *cb,
-                         void *u) {
+                         const unsigned char *pass, int pass_len,
+                         pem_password_cb *cb, void *u) {
   BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
   if (b == NULL) {
     OPENSSL_PUT_ERROR(PEM, ERR_R_BUF_LIB);
     return 0;
   }
-  int ret = PEM_write_bio_PrivateKey(b, x, enc, kstr, klen, cb, u);
+  int ret = PEM_write_bio_PrivateKey(b, x, enc, pass, pass_len, cb, u);
   BIO_free(b);
   return ret;
 }
diff --git a/include/openssl/pem.h b/include/openssl/pem.h
index b67417f..919cacd 100644
--- a/include/openssl/pem.h
+++ b/include/openssl/pem.h
@@ -142,26 +142,26 @@ extern "C" {
                           NULL, 0, NULL, NULL);                             \
   }
 
-#define IMPLEMENT_PEM_write_cb_fp(name, type, str, asn1)                       \
-  static int pem_write_##name##_i2d(const void *x, unsigned char **outp) {     \
-    return i2d_##asn1((type *)x, outp);                                        \
-  }                                                                            \
-  OPENSSL_EXPORT int PEM_write_##name(                                         \
-      FILE *fp, type *x, const EVP_CIPHER *enc, unsigned char *kstr, int klen, \
-      pem_password_cb *cb, void *u) {                                          \
-    return PEM_ASN1_write(pem_write_##name##_i2d, str, fp, x, enc, kstr, klen, \
-                          cb, u);                                              \
+#define IMPLEMENT_PEM_write_cb_fp(name, type, str, asn1)                   \
+  static int pem_write_##name##_i2d(const void *x, unsigned char **outp) { \
+    return i2d_##asn1((type *)x, outp);                                    \
+  }                                                                        \
+  OPENSSL_EXPORT int PEM_write_##name(                                     \
+      FILE *fp, type *x, const EVP_CIPHER *enc, const unsigned char *pass, \
+      int pass_len, pem_password_cb *cb, void *u) {                        \
+    return PEM_ASN1_write(pem_write_##name##_i2d, str, fp, x, enc, pass,   \
+                          pass_len, cb, u);                                \
   }
 
-#define IMPLEMENT_PEM_write_cb_fp_const(name, type, str, asn1)                 \
-  static int pem_write_##name##_i2d(const void *x, unsigned char **outp) {     \
-    return i2d_##asn1((const type *)x, outp);                                  \
-  }                                                                            \
-  OPENSSL_EXPORT int PEM_write_##name(                                         \
-      FILE *fp, type *x, const EVP_CIPHER *enc, unsigned char *kstr, int klen, \
-      pem_password_cb *cb, void *u) {                                          \
-    return PEM_ASN1_write(pem_write_##name##_i2d, str, fp, x, enc, kstr, klen, \
-                          cb, u);                                              \
+#define IMPLEMENT_PEM_write_cb_fp_const(name, type, str, asn1)             \
+  static int pem_write_##name##_i2d(const void *x, unsigned char **outp) { \
+    return i2d_##asn1((const type *)x, outp);                              \
+  }                                                                        \
+  OPENSSL_EXPORT int PEM_write_##name(                                     \
+      FILE *fp, type *x, const EVP_CIPHER *enc, const unsigned char *pass, \
+      int pass_len, pem_password_cb *cb, void *u) {                        \
+    return PEM_ASN1_write(pem_write_##name##_i2d, str, fp, x, enc, pass,   \
+                          pass_len, cb, u);                                \
   }
 
 
@@ -199,10 +199,10 @@ extern "C" {
     return i2d_##asn1((type *)x, outp);                                        \
   }                                                                            \
   OPENSSL_EXPORT int PEM_write_bio_##name(                                     \
-      BIO *bp, type *x, const EVP_CIPHER *enc, unsigned char *kstr, int klen,  \
-      pem_password_cb *cb, void *u) {                                          \
+      BIO *bp, type *x, const EVP_CIPHER *enc, const unsigned char *pass,      \
+      int pass_len, pem_password_cb *cb, void *u) {                            \
     return PEM_ASN1_write_bio(pem_write_bio_##name##_i2d, str, bp, x, enc,     \
-                              kstr, klen, cb, u);                              \
+                              pass, pass_len, cb, u);                          \
   }
 
 #define IMPLEMENT_PEM_write_cb_bio_const(name, type, str, asn1)                \
@@ -210,10 +210,10 @@ extern "C" {
     return i2d_##asn1((const type *)x, outp);                                  \
   }                                                                            \
   OPENSSL_EXPORT int PEM_write_bio_##name(                                     \
-      BIO *bp, type *x, const EVP_CIPHER *enc, unsigned char *kstr, int klen,  \
-      pem_password_cb *cb, void *u) {                                          \
+      BIO *bp, type *x, const EVP_CIPHER *enc, const unsigned char *pass,      \
+      int pass_len, pem_password_cb *cb, void *u) {                            \
     return PEM_ASN1_write_bio(pem_write_bio_##name##_i2d, str, bp, (void *)x,  \
-                              enc, kstr, klen, cb, u);                         \
+                              enc, pass, pass_len, cb, u);                     \
   }
 
 #define IMPLEMENT_PEM_write(name, type, str, asn1) \
@@ -260,10 +260,10 @@ extern "C" {
 #define DECLARE_PEM_write_fp_const(name, type) \
   OPENSSL_EXPORT int PEM_write_##name(FILE *fp, const type *x);
 
-#define DECLARE_PEM_write_cb_fp(name, type)                                    \
-  OPENSSL_EXPORT int PEM_write_##name(                                         \
-      FILE *fp, type *x, const EVP_CIPHER *enc, unsigned char *kstr, int klen, \
-      pem_password_cb *cb, void *u);
+#define DECLARE_PEM_write_cb_fp(name, type)                                \
+  OPENSSL_EXPORT int PEM_write_##name(                                     \
+      FILE *fp, type *x, const EVP_CIPHER *enc, const unsigned char *pass, \
+      int pass_len, pem_password_cb *cb, void *u);
 
 #define DECLARE_PEM_read_bio(name, type)                      \
   OPENSSL_EXPORT type *PEM_read_bio_##name(BIO *bp, type **x, \
@@ -275,10 +275,10 @@ extern "C" {
 #define DECLARE_PEM_write_bio_const(name, type) \
   OPENSSL_EXPORT int PEM_write_bio_##name(BIO *bp, const type *x);
 
-#define DECLARE_PEM_write_cb_bio(name, type)                                  \
-  OPENSSL_EXPORT int PEM_write_bio_##name(                                    \
-      BIO *bp, type *x, const EVP_CIPHER *enc, unsigned char *kstr, int klen, \
-      pem_password_cb *cb, void *u);
+#define DECLARE_PEM_write_cb_bio(name, type)                              \
+  OPENSSL_EXPORT int PEM_write_bio_##name(                                \
+      BIO *bp, type *x, const EVP_CIPHER *enc, const unsigned char *pass, \
+      int pass_len, pem_password_cb *cb, void *u);
 
 
 #define DECLARE_PEM_write(name, type) \
@@ -344,7 +344,7 @@ OPENSSL_EXPORT void *PEM_ASN1_read_bio(d2i_of_void *d2i, const char *name,
                                        void *u);
 OPENSSL_EXPORT int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name,
                                       BIO *bp, void *x, const EVP_CIPHER *enc,
-                                      unsigned char *kstr, int klen,
+                                      const unsigned char *pass, int pass_len,
                                       pem_password_cb *cb, void *u);
 
 // PEM_X509_INFO_read_bio reads PEM blocks from |bp| and decodes any
@@ -381,7 +381,7 @@ OPENSSL_EXPORT void *PEM_ASN1_read(d2i_of_void *d2i, const char *name, FILE *fp,
                                    void **x, pem_password_cb *cb, void *u);
 OPENSSL_EXPORT int PEM_ASN1_write(i2d_of_void *i2d, const char *name, FILE *fp,
                                   void *x, const EVP_CIPHER *enc,
-                                  unsigned char *kstr, int klen,
+                                  const unsigned char *pass, int pass_len,
                                   pem_password_cb *callback, void *u);
 
 // PEM_def_callback treats |userdata| as a string and copies it into |buf|,
@@ -436,42 +436,45 @@ DECLARE_PEM_rw_cb(PrivateKey, EVP_PKEY)
 DECLARE_PEM_rw(PUBKEY, EVP_PKEY)
 
 OPENSSL_EXPORT int PEM_write_bio_PKCS8PrivateKey_nid(BIO *bp, const EVP_PKEY *x,
-                                                     int nid, char *kstr,
-                                                     int klen,
+                                                     int nid, const char *pass,
+                                                     int pass_len,
                                                      pem_password_cb *cb,
                                                      void *u);
-OPENSSL_EXPORT int PEM_write_bio_PKCS8PrivateKey(BIO *, const EVP_PKEY *,
-                                                 const EVP_CIPHER *, char *,
-                                                 int, pem_password_cb *,
-                                                 void *);
+OPENSSL_EXPORT int PEM_write_bio_PKCS8PrivateKey(BIO *bp, const EVP_PKEY *x,
+                                                 const EVP_CIPHER *enc,
+                                                 const char *pass, int pass_len,
+                                                 pem_password_cb *cb, void *u);
 OPENSSL_EXPORT int i2d_PKCS8PrivateKey_bio(BIO *bp, const EVP_PKEY *x,
-                                           const EVP_CIPHER *enc, char *kstr,
-                                           int klen, pem_password_cb *cb,
-                                           void *u);
+                                           const EVP_CIPHER *enc,
+                                           const char *pass, int pass_len,
+                                           pem_password_cb *cb, void *u);
 OPENSSL_EXPORT int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, const EVP_PKEY *x,
-                                               int nid, char *kstr, int klen,
+                                               int nid, const char *pass,
+                                               int pass_len,
                                                pem_password_cb *cb, void *u);
 OPENSSL_EXPORT EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x,
                                                  pem_password_cb *cb, void *u);
 
 OPENSSL_EXPORT int i2d_PKCS8PrivateKey_fp(FILE *fp, const EVP_PKEY *x,
-                                          const EVP_CIPHER *enc, char *kstr,
-                                          int klen, pem_password_cb *cb,
-                                          void *u);
+                                          const EVP_CIPHER *enc,
+                                          const char *pass, int pass_len,
+                                          pem_password_cb *cb, void *u);
 OPENSSL_EXPORT int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, const EVP_PKEY *x,
-                                              int nid, char *kstr, int klen,
-                                              pem_password_cb *cb, void *u);
+                                              int nid, const char *pass,
+                                              int pass_len, pem_password_cb *cb,
+                                              void *u);
 OPENSSL_EXPORT int PEM_write_PKCS8PrivateKey_nid(FILE *fp, const EVP_PKEY *x,
-                                                 int nid, char *kstr, int klen,
+                                                 int nid, const char *pass,
+                                                 int pass_len,
                                                  pem_password_cb *cb, void *u);
 
 OPENSSL_EXPORT EVP_PKEY *d2i_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY **x,
                                                 pem_password_cb *cb, void *u);
 
 OPENSSL_EXPORT int PEM_write_PKCS8PrivateKey(FILE *fp, const EVP_PKEY *x,
-                                             const EVP_CIPHER *enc, char *kstr,
-                                             int klen, pem_password_cb *cd,
-                                             void *u);
+                                             const EVP_CIPHER *enc,
+                                             const char *pass, int pass_len,
+                                             pem_password_cb *cd, void *u);
 
 
 #ifdef __cplusplus