group patch

ssl/ssl_lib.c

@@ -1097,6 +1097,71 @@ int SSL_set1_param(SSL *ssl, X509_VERIFY_PARAM *vpm)
     return X509_VERIFY_PARAM_set1(ssl->param, vpm);
 }
 
+void ssl_cipher_preference_list_free(struct ssl_cipher_preference_list_st
+                                     *cipher_list)
+{
+    sk_SSL_CIPHER_free(cipher_list->ciphers);
+    OPENSSL_free(cipher_list->in_group_flags);
+    OPENSSL_free(cipher_list);
+}
+
+struct ssl_cipher_preference_list_st*
+ssl_cipher_preference_list_dup(struct ssl_cipher_preference_list_st
+                               *cipher_list)
+{
+    struct ssl_cipher_preference_list_st* ret = NULL;
+    size_t n = sk_SSL_CIPHER_num(cipher_list->ciphers);
+
+    ret = OPENSSL_malloc(sizeof(struct ssl_cipher_preference_list_st));
+    if (!ret)
+        goto err;
+    ret->ciphers = NULL;
+    ret->in_group_flags = NULL;
+    ret->ciphers = sk_SSL_CIPHER_dup(cipher_list->ciphers);
+    if (!ret->ciphers)
+        goto err;
+    ret->in_group_flags = OPENSSL_malloc(n);
+    if (!ret->in_group_flags)
+        goto err;
+    memcpy(ret->in_group_flags, cipher_list->in_group_flags, n);
+    return ret;
+
+err:
+   if (ret->ciphers)
+       sk_SSL_CIPHER_free(ret->ciphers);
+   if (ret)
+       OPENSSL_free(ret);
+   return NULL;
+}
+
+struct ssl_cipher_preference_list_st*
+ssl_cipher_preference_list_from_ciphers(STACK_OF(SSL_CIPHER) *ciphers)
+{
+    struct ssl_cipher_preference_list_st* ret = NULL;
+    size_t n = sk_SSL_CIPHER_num(ciphers);
+
+    ret = OPENSSL_malloc(sizeof(struct ssl_cipher_preference_list_st));
+    if (!ret)
+        goto err;
+    ret->ciphers = NULL;
+    ret->in_group_flags = NULL;
+    ret->ciphers = sk_SSL_CIPHER_dup(ciphers);
+    if (!ret->ciphers)
+        goto err;
+    ret->in_group_flags = OPENSSL_malloc(n);
+    if (!ret->in_group_flags)
+        goto err;
+    memset(ret->in_group_flags, 0, n);
+    return ret;
+
+err:
+    if (ret->ciphers)
+        sk_SSL_CIPHER_free(ret->ciphers);
+    if (ret)
+        OPENSSL_free(ret);
+    return NULL;
+}
+
 X509_VERIFY_PARAM *SSL_CTX_get0_param(SSL_CTX *ctx)
 {
     return ctx->param;
@@ -1137,7 +1202,8 @@ void SSL_free(SSL *s)
     BUF_MEM_free(s->init_buf);
 
     /* add extra stuff */
-    sk_SSL_CIPHER_free(s->cipher_list);
+    if (s->cipher_list != NULL)
+        ssl_cipher_preference_list_free(s->cipher_list);
     sk_SSL_CIPHER_free(s->cipher_list_by_id);
 
     /* Make the next call work :-) */
@@ -2094,9 +2160,9 @@ STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s)
 {
     if (s != NULL) {
         if (s->cipher_list != NULL) {
-            return (s->cipher_list);
+            return (s->cipher_list->ciphers);
         } else if ((s->ctx != NULL) && (s->ctx->cipher_list != NULL)) {
-            return (s->ctx->cipher_list);
+            return (s->ctx->cipher_list->ciphers);
         }
     }
     return (NULL);
@@ -2168,8 +2234,8 @@ const char *SSL_get_cipher_list(const SSL *s, int n)
  * preference */
 STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx)
 {
-    if (ctx != NULL)
-        return ctx->cipher_list;
+    if (ctx != NULL && ctx->cipher_list != NULL)
+        return ctx->cipher_list->ciphers;
     return NULL;
 }
 
@@ -2579,7 +2645,7 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
     if (!ssl_create_cipher_list(ret->method,
                                 &ret->cipher_list, &ret->cipher_list_by_id,
                                 SSL_DEFAULT_CIPHER_LIST, ret->cert)
-        || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {
+        || sk_SSL_CIPHER_num(ret->cipher_list->ciphers) <= 0) {
         SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS);
         goto err2;
     }
@@ -2710,7 +2776,7 @@ void SSL_CTX_free(SSL_CTX *a)
 #ifndef OPENSSL_NO_CT
     CTLOG_STORE_free(a->ctlog_store);
 #endif
-    sk_SSL_CIPHER_free(a->cipher_list);
+    ssl_cipher_preference_list_free(a->cipher_list);
     sk_SSL_CIPHER_free(a->cipher_list_by_id);
     ssl_cert_free(a->cert);
     sk_X509_NAME_pop_free(a->client_CA, X509_NAME_free);
@@ -3388,13 +3454,15 @@ SSL *SSL_dup(SSL *s)
 
     /* dup the cipher_list and cipher_list_by_id stacks */
     if (s->cipher_list != NULL) {
-        if ((ret->cipher_list = sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
+        ret->cipher_list = ssl_cipher_preference_list_dup(s->cipher_list);
+        if (ret->cipher_list == NULL)
             goto err;
     }
-    if (s->cipher_list_by_id != NULL)
-        if ((ret->cipher_list_by_id = sk_SSL_CIPHER_dup(s->cipher_list_by_id))
-            == NULL)
+    if (s->cipher_list_by_id != NULL) {
+        ret->cipher_list_by_id = sk_SSL_CIPHER_dup(s->cipher_list_by_id);
+        if (ret->cipher_list_by_id == NULL)
             goto err;
+    }
 
     /* Dup the client_CA list */
     if (s->client_CA != NULL) {