Un-constify X509_OBJECT_get0_X509 and X509_OBJECT_set1_X509

This partially reverts commit 367c54ef1105 "Constify
X509_OBJECT_[get0|set1]_X509 and friends", as well as removes them from
the list added in c0f82d915f38 "Describe X509 constification and ASN1_STRING
changes".  Constification of X509_get_pubkey() arguments remains in place.

Resolves: https://github.com/openssl/project/issues/1892
Complements: 367c54ef1105 "Constify X509_OBJECT_[get0|set1]_X509 and friends"
Complements: c0f82d915f38 "Describe X509 constification and ASN1_STRING changes"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri Mar  6 18:36:10 2026
(Merged from https://github.com/openssl/openssl/pull/30276)

diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c
index fa0414cd94ba8e6570bc95b21688c7e90277994f..073be0dc6d0e560460be92ac8250a73341e2bed6 100644 (file)
--- a/crypto/x509/x509_lu.c
+++ b/crypto/x509/x509_lu.c
@@ -412,7 +412,7 @@ static int obj_ht_foreach_certs(HT_VALUE *v, void *arg)
     int i, r;
 
     for (i = 0; i < sk_X509_OBJECT_num(objs); i++) {
-        const X509 *cert = X509_OBJECT_get0_X509(sk_X509_OBJECT_value(objs, i));
+        X509 *cert = X509_OBJECT_get0_X509(sk_X509_OBJECT_value(objs, i));
 
         if (cert == NULL)
             continue;
@@ -613,7 +613,7 @@ int X509_OBJECT_up_ref_count(X509_OBJECT *a)
     return 1;
 }
 
-const X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a)
+X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a)
 {
     if (a == NULL || a->type != X509_LU_X509)
         return NULL;
@@ -658,14 +658,14 @@ static void x509_object_free_internal(X509_OBJECT *a)
     }
 }
 
-int X509_OBJECT_set1_X509(X509_OBJECT *a, const X509 *obj)
+int X509_OBJECT_set1_X509(X509_OBJECT *a, X509 *obj)
 {
-    if (a == NULL || !X509_up_ref((X509 *)obj))
+    if (a == NULL || !X509_up_ref(obj))
         return 0;
 
     x509_object_free_internal(a);
     a->type = X509_LU_X509;
-    a->data.x509 = (X509 *)obj;
+    a->data.x509 = obj;
     return 1;
 }
 
@@ -830,7 +830,7 @@ STACK_OF(X509) *X509_STORE_get1_all_certs(X509_STORE *store)
         ossl_ht_foreach_until(store->objs_ht, obj_ht_foreach_certs, &sk);
     } else {
         for (int i = 0; i < sk_X509_OBJECT_num(store->objs); i++) {
-            const X509 *cert = X509_OBJECT_get0_X509(sk_X509_OBJECT_value(store->objs, i));
+            X509 *cert = X509_OBJECT_get0_X509(sk_X509_OBJECT_value(store->objs, i));
 
             if (cert != NULL
                 && !X509_add_cert(sk, cert, X509_ADD_FLAG_UP_REF))

diff --git a/doc/man7/ossl-guide-migration.pod b/doc/man7/ossl-guide-migration.pod
index f8fd53982554d2c34ada56fa0da5f03f144a33bb..b8e3352c471c238527481ed0e1aa72673cdd16da 100644 (file)
--- a/doc/man7/ossl-guide-migration.pod
+++ b/doc/man7/ossl-guide-migration.pod
@@ -149,8 +149,6 @@ X509_issuer_name_hash
 X509_issuer_name_hash_old
 X509_keyid_get0
 X509_load_http
-X509_OBJECT_get0_X509
-X509_OBJECT_set1_X509
 X509_print_ex_fp
 X509_print_fp
 X509_REQ_get1_email

diff --git a/include/openssl/x509_vfy.h.in b/include/openssl/x509_vfy.h.in
index 3d1fe26e0f74bc086868c2ec54a2c29b1d323da6..81bdb6df915bbbf38402ffea55e4a0f06784f8be 100644 (file)
--- a/include/openssl/x509_vfy.h.in
+++ b/include/openssl/x509_vfy.h.in
@@ -416,8 +416,8 @@ int X509_OBJECT_up_ref_count(X509_OBJECT *a);
 X509_OBJECT *X509_OBJECT_new(void);
 void X509_OBJECT_free(X509_OBJECT *a);
 X509_LOOKUP_TYPE X509_OBJECT_get_type(const X509_OBJECT *a);
-const X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a);
-int X509_OBJECT_set1_X509(X509_OBJECT *a, const X509 *obj);
+X509 *X509_OBJECT_get0_X509(const X509_OBJECT *a);
+int X509_OBJECT_set1_X509(X509_OBJECT *a, X509 *obj);
 X509_CRL *X509_OBJECT_get0_X509_CRL(const X509_OBJECT *a);
 int X509_OBJECT_set1_X509_CRL(X509_OBJECT *a, X509_CRL *obj);
 X509_STORE *X509_STORE_new(void);