From: Neil Horman Date: Mon, 15 Jun 2026 18:01:37 +0000 (-0400) Subject: fix type casting in ossl_cmp_mock_srv_set1 functions X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3989ab04c6061d62382fb7d4b03ec6ed7601160e;p=thirdparty%2Fopenssl.git fix type casting in ossl_cmp_mock_srv_set1 functions newer versions of clang trigger ubsan warnings on the following functions: ossl_cmp_mock_srv_set1_refCert ossl_cmp_mock_srv_set1_chainOut ossl_cmp_mock_srv_set1_certOut ossl_cmp_mock_srv_set1_newWithNew ossl_cmp_mock_srv_set1_newWithOld ossl_cmp_mock_srv_set1_oldWithNew ossl_cmp_mock_srv_set1_caPubsOut Due to the fact that the respective function prototypes don't match the callback function pointer prototypes (the former use concrete strucuture types while the latter uses a void pointer). Fix it by bifurcating setup_cert[s] (the call-in fuctions) to have variants that accept the expected type and corresponding callback signature so that the above functions can be used without thunking Fixes openssl/project#1969 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky MergeDate: Thu Jun 18 14:03:41 2026 (Merged from https://github.com/openssl/openssl/pull/31526) --- diff --git a/apps/cmp.c b/apps/cmp.c index a5d5f0d9e62..a0770dcb97a 100644 --- a/apps/cmp.c +++ b/apps/cmp.c @@ -1129,6 +1129,22 @@ static int setup_cert(void *ctx, const char *file, const char *pass, return ok; } +typedef int (*add_X509_fn_srv_t)(OSSL_CMP_SRV_CTX *ctx, X509 *cert); +static int setup_cert_srv(OSSL_CMP_SRV_CTX *ctx, const char *file, const char *pass, + const char *desc, add_X509_fn_srv_t set1_fn) +{ + X509 *cert; + int ok; + + if (file == NULL) + return 1; + if ((cert = load_cert_pwd(file, pass, desc)) == NULL) + return 0; + ok = (*set1_fn)(ctx, cert); + X509_free(cert); + return ok; +} + typedef int (*add_X509_stack_fn_t)(void *ctx, const STACK_OF(X509) *certs); static int setup_certs(char *files, const char *desc, void *ctx, add_X509_stack_fn_t set1_fn) @@ -1145,6 +1161,22 @@ static int setup_certs(char *files, const char *desc, void *ctx, return ok; } +typedef int (*add_X509_stack_fn_srv_t)(OSSL_CMP_SRV_CTX *ctx, STACK_OF(X509) *certs); +static int setup_certs_srv(char *files, const char *desc, OSSL_CMP_SRV_CTX *ctx, + add_X509_stack_fn_srv_t set1_fn) +{ + STACK_OF(X509) *certs; + int ok; + + if (files == NULL) + return 1; + if ((certs = load_certs_multifile(files, opt_otherpass, desc, vpm)) == NULL) + return 0; + ok = (*set1_fn)(ctx, certs); + OSSL_STACK_OF_X509_free(certs); + return ok; +} + static int setup_mock_crlout(void *ctx, const char *file, const char *desc) { X509_CRL *crl; @@ -1288,16 +1320,16 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(void) (add_X509_stack_fn_t)OSSL_CMP_CTX_set1_untrusted)) goto err; - if (!setup_cert(srv_ctx, opt_ref_cert, opt_otherpass, + if (!setup_cert_srv(srv_ctx, opt_ref_cert, opt_otherpass, "reference cert to be expected by the mock server", - (add_X509_fn_t)ossl_cmp_mock_srv_set1_refCert)) + ossl_cmp_mock_srv_set1_refCert)) goto err; if (opt_rsp_cert == NULL) { CMP_warn("no -rsp_cert given for mock server"); } else { - if (!setup_cert(srv_ctx, opt_rsp_cert, opt_rsp_keypass, + if (!setup_cert_srv(srv_ctx, opt_rsp_cert, opt_rsp_keypass, "cert the mock server returns on certificate requests", - (add_X509_fn_t)ossl_cmp_mock_srv_set1_certOut)) + ossl_cmp_mock_srv_set1_certOut)) goto err; } if (opt_rsp_key != NULL) { @@ -1317,22 +1349,22 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(void) if (!setup_mock_crlout(srv_ctx, opt_rsp_crl, "CRL to be returned by the mock server")) goto err; - if (!setup_certs(opt_rsp_extracerts, + if (!setup_certs_srv(opt_rsp_extracerts, "CMP extra certificates for mock server", srv_ctx, - (add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_chainOut)) + ossl_cmp_mock_srv_set1_chainOut)) goto err; - if (!setup_certs(opt_rsp_capubs, "caPubs for mock server", srv_ctx, - (add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_caPubsOut)) + if (!setup_certs_srv(opt_rsp_capubs, "caPubs for mock server", srv_ctx, + ossl_cmp_mock_srv_set1_caPubsOut)) goto err; - if (!setup_cert(srv_ctx, opt_rsp_newwithnew, opt_otherpass, + if (!setup_cert_srv(srv_ctx, opt_rsp_newwithnew, opt_otherpass, "NewWithNew cert the mock server returns in rootCaKeyUpdate", - (add_X509_fn_t)ossl_cmp_mock_srv_set1_newWithNew) - || !setup_cert(srv_ctx, opt_rsp_newwithold, opt_otherpass, + ossl_cmp_mock_srv_set1_newWithNew) + || !setup_cert_srv(srv_ctx, opt_rsp_newwithold, opt_otherpass, "NewWithOld cert the mock server returns in rootCaKeyUpdate", - (add_X509_fn_t)ossl_cmp_mock_srv_set1_newWithOld) - || !setup_cert(srv_ctx, opt_rsp_oldwithnew, opt_otherpass, + ossl_cmp_mock_srv_set1_newWithOld) + || !setup_cert_srv(srv_ctx, opt_rsp_oldwithnew, opt_otherpass, "OldWithNew cert the mock server returns in rootCaKeyUpdate", - (add_X509_fn_t)ossl_cmp_mock_srv_set1_oldWithNew)) + ossl_cmp_mock_srv_set1_oldWithNew)) goto err; (void)ossl_cmp_mock_srv_set_pollCount(srv_ctx, opt_poll_count); (void)ossl_cmp_mock_srv_set_checkAfterTime(srv_ctx, opt_check_after);