Remove all uses of gnutls_alloca/gnutls_afree.

Use normal gnutls_malloc instead.  One reason is increased portability
to Windows, the other is that several of the uses may be unsafe
because the size of data allocated could be large.  Reported by
Massimo Gaspari <massimo.gaspari@alice.it> in
<http://permalink.gmane.org/gmane.network.gnutls.general/1170>.

diff --git a/NEWS b/NEWS
index 7d18c33d7b1d0cd4bd9516b205aee2423875c0f4..2ac7f826ddda4af267bb3d53c483580aab43e5fb 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,13 @@ Based on HPUX build hints in
 Reported by Massimo Gaspari <massimo.gaspari@alice.it> in
 <http://permalink.gmane.org/gmane.network.gnutls.general/1170>.
 
+** Remove all uses of gnutls_alloca/gnutls_afree.
+Use normal gnutls_malloc instead.  One reason is increased portability
+to Windows, the other is that several of the uses may be unsafe
+because the size of data allocated could be large.  Reported by
+Massimo Gaspari <massimo.gaspari@alice.it> in
+<http://permalink.gmane.org/gmane.network.gnutls.general/1170>.
+
 ** API and ABI modifications:
 No changes since last version.
 

diff --git a/lib/gnutls_algorithms.c b/lib/gnutls_algorithms.c
index dc32003016897b6e8ae44896b911bcafc8feb5a7..36dd77da122657aea346242f90622fcbdae94235 100644 (file)
--- a/lib/gnutls_algorithms.c
+++ b/lib/gnutls_algorithms.c
@@ -1701,14 +1701,14 @@ _gnutls_supported_ciphersuites (gnutls_session_t session,
       return 0;
     }
 
-  tmp_ciphers = gnutls_alloca (count * sizeof (cipher_suite_st));
+  tmp_ciphers = gnutls_malloc (count * sizeof (cipher_suite_st));
   if (tmp_ciphers == NULL)
     return GNUTLS_E_MEMORY_ERROR;
 
   ciphers = gnutls_malloc (count * sizeof (cipher_suite_st));
   if (ciphers == NULL)
     {
-      gnutls_afree (tmp_ciphers);
+      gnutls_free (tmp_ciphers);
       return GNUTLS_E_MEMORY_ERROR;
     }
 
@@ -1767,7 +1767,7 @@ _gnutls_supported_ciphersuites (gnutls_session_t session,
     }
 #endif
 
-  gnutls_afree (tmp_ciphers);
+  gnutls_free (tmp_ciphers);
 
   /* This function can no longer return 0 cipher suites.
    * It returns an error code instead.

diff --git a/lib/gnutls_buffers.c b/lib/gnutls_buffers.c
index 689779b4225b137da39ebe3a1b480ed23b7d57c4..2caf266599221995fe0c78d4b658815250f6a81b 100644 (file)
--- a/lib/gnutls_buffers.c
+++ b/lib/gnutls_buffers.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation
  *
  * Author: Nikos Mavrogiannopoulos
  *
@@ -430,7 +430,7 @@ _gnutls_io_clear_peeked_data (gnutls_session_t session)
   if (session->internals.have_peeked_data == 0 || RCVLOWAT == 0)
     return 0;
 
-  peekdata = gnutls_alloca (RCVLOWAT);
+  peekdata = gnutls_malloc (RCVLOWAT);
   if (peekdata == NULL)
     {
       gnutls_assert ();
@@ -448,7 +448,7 @@ _gnutls_io_clear_peeked_data (gnutls_session_t session)
   while (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN
         || sum < RCVLOWAT);
 
-  gnutls_afree (peekdata);
+  gnutls_free (peekdata);
 
   if (ret < 0)
     {

diff --git a/lib/gnutls_constate.c b/lib/gnutls_constate.c
index cbe7a15e74aef7cfac769fedcb29df3240b8aa20..b929483ae2fa2f6abb0db170bbca87cc10645a1d 100644 (file)
--- a/lib/gnutls_constate.c
+++ b/lib/gnutls_constate.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006  Free Software Foundation
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006, 2008  Free Software Foundation
  *
  * Author: Nikos Mavrogiannopoulos
  *
@@ -315,7 +315,7 @@ _gnutls_set_keys (gnutls_session_t session, int hash_size, int IV_size,
     }
   else if (IV_size > 0 && export_flag != 0)
     {
-      opaque *iv_block = gnutls_alloca (IV_size * 2);
+      opaque *iv_block = gnutls_malloc (IV_size * 2);
       if (iv_block == NULL)
        {
          gnutls_assert ();
@@ -333,7 +333,7 @@ _gnutls_set_keys (gnutls_session_t session, int hash_size, int IV_size,
            {
              gnutls_assert ();
              gnutls_free (key_block);
-             gnutls_afree (iv_block);
+             gnutls_free (iv_block);
              return ret;
            }
 
@@ -352,7 +352,7 @@ _gnutls_set_keys (gnutls_session_t session, int hash_size, int IV_size,
       if (ret < 0)
        {
          gnutls_assert ();
-         gnutls_afree (iv_block);
+         gnutls_free (iv_block);
          gnutls_free (key_block);
          return ret;
        }
@@ -360,7 +360,7 @@ _gnutls_set_keys (gnutls_session_t session, int hash_size, int IV_size,
       if (_gnutls_sset_datum
          (&session->cipher_specs.client_write_IV, iv_block, IV_size) < 0)
        {
-         gnutls_afree (iv_block);
+         gnutls_free (iv_block);
          gnutls_free (key_block);
          return GNUTLS_E_MEMORY_ERROR;
        }
@@ -369,12 +369,12 @@ _gnutls_set_keys (gnutls_session_t session, int hash_size, int IV_size,
          (&session->cipher_specs.server_write_IV,
           &iv_block[IV_size], IV_size) < 0)
        {
-         gnutls_afree (iv_block);
+         gnutls_free (iv_block);
          gnutls_free (key_block);
          return GNUTLS_E_MEMORY_ERROR;
        }
 
-      gnutls_afree (iv_block);
+      gnutls_free (iv_block);
     }
 
   gnutls_free (key_block);

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 100900d4132ef03b021b8135c6364d3ef42a7957..98aa86cb8fccb4faf2bd07e76dd60176838c9d12 100644 (file)
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -933,7 +933,7 @@ _gnutls_send_handshake (gnutls_session_t session, void *i_data,
 
   /* first run */
   datasize = i_datasize + HANDSHAKE_HEADER_SIZE;
-  data = gnutls_alloca (datasize);
+  data = gnutls_malloc (datasize);
   if (data == NULL)
     {
       gnutls_assert ();
@@ -958,7 +958,7 @@ _gnutls_send_handshake (gnutls_session_t session, void *i_data,
         _gnutls_handshake_hash_add_sent (session, type, data, datasize)) < 0)
       {
        gnutls_assert ();
-       gnutls_afree (data);
+       gnutls_free (data);
        return ret;
       }
 
@@ -968,7 +968,7 @@ _gnutls_send_handshake (gnutls_session_t session, void *i_data,
     _gnutls_handshake_io_send_int (session, GNUTLS_HANDSHAKE, type,
                                   data, datasize);
 
-  gnutls_afree (data);
+  gnutls_free (data);
 
   return ret;
 }
@@ -1918,7 +1918,7 @@ _gnutls_send_server_hello (gnutls_session_t session, int again)
          return extdatalen;
        }
 
-      data = gnutls_alloca (datalen + extdatalen);
+      data = gnutls_malloc (datalen + extdatalen);
       if (data == NULL)
        {
          gnutls_assert ();
@@ -1966,7 +1966,7 @@ _gnutls_send_server_hello (gnutls_session_t session, int again)
   ret =
     _gnutls_send_handshake (session, data, datalen,
                            GNUTLS_HANDSHAKE_SERVER_HELLO);
-  gnutls_afree (data);
+  gnutls_free (data);
 
   return ret;
 }

diff --git a/lib/gnutls_mem.h b/lib/gnutls_mem.h
index f76081e566a1c5039f5a662f6f06860530308363..9af8543f3c83dbd1a9008c92bfa3b99083f19aea 100644 (file)
--- a/lib/gnutls_mem.h
+++ b/lib/gnutls_mem.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2008 Free Software Foundation
  *
  * Author: Nikos Mavrogiannopoulos
  *
@@ -31,30 +31,6 @@
 
 typedef void svoid;            /* for functions that allocate using gnutls_secure_malloc */
 
-/* Use gnutls_afree() when calling alloca, or
- * memory leaks may occur in systems which do not
- * support alloca.
- */
-#ifdef USE_EFENCE
-# define gnutls_alloca gnutls_malloc
-# define gnutls_afree gnutls_free
-#endif
-
-#ifdef HAVE_ALLOCA
-# ifdef HAVE_ALLOCA_H
-#  include <alloca.h>
-# endif
-# ifndef gnutls_alloca
-#  define gnutls_alloca alloca
-#  define gnutls_afree(x)
-# endif
-#else
-# ifndef gnutls_alloca
-#  define gnutls_alloca gnutls_malloc
-#  define gnutls_afree gnutls_free
-# endif
-#endif /* HAVE_ALLOCA */
-
 extern int (*_gnutls_is_secure_memory) (const void *);
 
 /* this realloc function will return ptr if size==0, and

diff --git a/lib/gnutls_mpi.c b/lib/gnutls_mpi.c
index 0d807a186425d4fa88de8794fb8f3f916fffdbb3..eec2c1be786f1b4e2aa35c95a58699cdede24040 100644 (file)
--- a/lib/gnutls_mpi.c
+++ b/lib/gnutls_mpi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2008 Free Software Foundation
  *
  * Author: Nikos Mavrogiannopoulos
  *
@@ -209,7 +209,7 @@ _gnutls_x509_read_int (ASN1_TYPE node, const char *value, mpi_t * ret_mpi)
       return _gnutls_asn2err (result);
     }
 
-  tmpstr = gnutls_alloca (tmpstr_size);
+  tmpstr = gnutls_malloc (tmpstr_size);
   if (tmpstr == NULL)
     {
       gnutls_assert ();
@@ -220,7 +220,7 @@ _gnutls_x509_read_int (ASN1_TYPE node, const char *value, mpi_t * ret_mpi)
   if (result != ASN1_SUCCESS)
     {
       gnutls_assert ();
-      gnutls_afree (tmpstr);
+      gnutls_free (tmpstr);
       return _gnutls_asn2err (result);
     }
 
@@ -228,11 +228,11 @@ _gnutls_x509_read_int (ASN1_TYPE node, const char *value, mpi_t * ret_mpi)
   if (_gnutls_mpi_scan (ret_mpi, tmpstr, &s_len) != 0)
     {
       gnutls_assert ();
-      gnutls_afree (tmpstr);
+      gnutls_free (tmpstr);
       return GNUTLS_E_MPI_SCAN_FAILED;
     }
 
-  gnutls_afree (tmpstr);
+  gnutls_free (tmpstr);
 
   return 0;
 }
@@ -252,7 +252,7 @@ _gnutls_x509_write_int (ASN1_TYPE node, const char *value, mpi_t mpi, int lz)
   else
     result = _gnutls_mpi_print (NULL, &s_len, mpi);
 
-  tmpstr = gnutls_alloca (s_len);
+  tmpstr = gnutls_malloc (s_len);
   if (tmpstr == NULL)
     {
       gnutls_assert ();
@@ -267,13 +267,13 @@ _gnutls_x509_write_int (ASN1_TYPE node, const char *value, mpi_t mpi, int lz)
   if (result != 0)
     {
       gnutls_assert ();
-      gnutls_afree (tmpstr);
+      gnutls_free (tmpstr);
       return GNUTLS_E_MPI_PRINT_FAILED;
     }
 
   result = asn1_write_value (node, value, tmpstr, s_len);
 
-  gnutls_afree (tmpstr);
+  gnutls_free (tmpstr);
 
   if (result != ASN1_SUCCESS)
     {

diff --git a/lib/gnutls_pk.c b/lib/gnutls_pk.c
index f9f4d4d499d08c14ace54922d232bd2fb7bb9bf0..5e31804419d52e5f525595b0eb83204754bb5511 100644 (file)
--- a/lib/gnutls_pk.c
+++ b/lib/gnutls_pk.c
@@ -75,7 +75,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
       return GNUTLS_E_PK_ENCRYPTION_FAILED;
     }
 
-  edata = gnutls_alloca (k);
+  edata = gnutls_malloc (k);
   if (edata == NULL)
     {
       gnutls_assert ();
@@ -98,7 +98,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
       if (params_len < RSA_PUBLIC_PARAMS)
        {
          gnutls_assert ();
-         gnutls_afree (edata);
+         gnutls_free (edata);
          return GNUTLS_E_INTERNAL_ERROR;
        }
 
@@ -106,7 +106,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
       if ( ret < 0)
        {
          gnutls_assert ();
-         gnutls_afree (edata);
+         gnutls_free (edata);
          return ret;
        }
       for (i = 0; i < psize; i++)
@@ -116,7 +116,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
            if (ret < 0)
              {
                gnutls_assert ();
-               gnutls_afree (edata);
+               gnutls_free (edata);
                return ret;
              }
          }
@@ -127,7 +127,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
       if (params_len < RSA_PRIVATE_PARAMS)
        {
          gnutls_assert ();
-         gnutls_afree (edata);
+         gnutls_free (edata);
          return GNUTLS_E_INTERNAL_ERROR;
        }
 
@@ -136,7 +136,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
       break;
     default:
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       return GNUTLS_E_INTERNAL_ERROR;
     }
 
@@ -146,10 +146,10 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
   if (_gnutls_mpi_scan_nz (&m, edata, &k) != 0)
     {
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       return GNUTLS_E_MPI_SCAN_FAILED;
     }
-  gnutls_afree (edata);
+  gnutls_free (edata);
 
   if (btype == 2)              /* encrypt */
     ret = _gnutls_pk_encrypt (GCRY_PK_RSA, &res, m, params, params_len);
@@ -256,7 +256,7 @@ _gnutls_pkcs1_rsa_decrypt (gnutls_datum_t * plaintext,
     }
 
   _gnutls_mpi_print (NULL, &esize, res);
-  edata = gnutls_alloca (esize + 1);
+  edata = gnutls_malloc (esize + 1);
   if (edata == NULL)
     {
       gnutls_assert ();
@@ -283,7 +283,7 @@ _gnutls_pkcs1_rsa_decrypt (gnutls_datum_t * plaintext,
   if (edata[0] != 0 || edata[1] != btype)
     {
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       return GNUTLS_E_DECRYPTION_FAILED;
     }
 
@@ -319,7 +319,7 @@ _gnutls_pkcs1_rsa_decrypt (gnutls_datum_t * plaintext,
       break;
     default:
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       break;
     }
   i++;
@@ -327,18 +327,18 @@ _gnutls_pkcs1_rsa_decrypt (gnutls_datum_t * plaintext,
   if (ret < 0)
     {
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       return GNUTLS_E_DECRYPTION_FAILED;
     }
 
   if (_gnutls_sset_datum (plaintext, &edata[i], esize - i) < 0)
     {
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       return GNUTLS_E_MEMORY_ERROR;
     }
 
-  gnutls_afree (edata);
+  gnutls_free (edata);
 
   return 0;
 }

diff --git a/lib/x509/crl.c b/lib/x509/crl.c
index 4beea257adc100691f4116696485fc24d5c06ce5..5f130c1ec0cf0ac1b17d2b3fe1b9cea9ff9fa163 100644 (file)
--- a/lib/x509/crl.c
+++ b/lib/x509/crl.c
@@ -669,7 +669,7 @@ _gnutls_x509_crl_cpy (gnutls_x509_crl_t dest, gnutls_x509_crl_t src)
       return ret;
     }
 
-  der = gnutls_alloca (der_size);
+  der = gnutls_malloc (der_size);
   if (der == NULL)
     {
       gnutls_assert ();
@@ -680,7 +680,7 @@ _gnutls_x509_crl_cpy (gnutls_x509_crl_t dest, gnutls_x509_crl_t src)
   if (ret < 0)
     {
       gnutls_assert ();
-      gnutls_afree (der);
+      gnutls_free (der);
       return ret;
     }
 
@@ -688,7 +688,7 @@ _gnutls_x509_crl_cpy (gnutls_x509_crl_t dest, gnutls_x509_crl_t src)
   tmp.size = der_size;
   ret = gnutls_x509_crl_import (dest, &tmp, GNUTLS_X509_FMT_DER);
 
-  gnutls_afree (der);
+  gnutls_free (der);
 
   if (ret < 0)
     {

diff --git a/lib/x509/mpi.c b/lib/x509/mpi.c
index 74334aa1e8d06ba9c56083d29148005b386b1ad1..247ea543c1d8fbfa15f76a24048d7323880a28dc 100644 (file)
--- a/lib/x509/mpi.c
+++ b/lib/x509/mpi.c
@@ -588,7 +588,7 @@ _gnutls_x509_read_uint (ASN1_TYPE node, const char *value, unsigned int *ret)
       return _gnutls_asn2err (result);
     }
 
-  tmpstr = gnutls_alloca (len);
+  tmpstr = gnutls_malloc (len);
   if (tmpstr == NULL)
     {
       gnutls_assert ();
@@ -600,7 +600,7 @@ _gnutls_x509_read_uint (ASN1_TYPE node, const char *value, unsigned int *ret)
   if (result != ASN1_SUCCESS)
     {
       gnutls_assert ();
-      gnutls_afree (tmpstr);
+      gnutls_free (tmpstr);
       return _gnutls_asn2err (result);
     }
 
@@ -615,11 +615,11 @@ _gnutls_x509_read_uint (ASN1_TYPE node, const char *value, unsigned int *ret)
   else
     {
       gnutls_assert ();
-      gnutls_afree (tmpstr);
+      gnutls_free (tmpstr);
       return GNUTLS_E_INTERNAL_ERROR;
     }
 
-  gnutls_afree (tmpstr);
+  gnutls_free (tmpstr);
 
   return 0;
 }

diff --git a/lib/x509/privkey_pkcs8.c b/lib/x509/privkey_pkcs8.c
index ec5e7ea3367362d9edd7402491404d1c3b711bdb..0f5989d47a32c629d255e5eb8a22c8732866ff0d 100644 (file)
--- a/lib/x509/privkey_pkcs8.c
+++ b/lib/x509/privkey_pkcs8.c
@@ -1477,7 +1477,7 @@ decrypt_data (schema_id schema, ASN1_TYPE pkcs8_asn,
   else
     key_size = kdf_params->key_size;
 
-  key = gnutls_alloca (key_size);
+  key = gnutls_malloc (key_size);
   if (key == NULL)
     {
       gnutls_assert ();
@@ -1524,7 +1524,7 @@ decrypt_data (schema_id schema, ASN1_TYPE pkcs8_asn,
   d_iv.size = enc_params->iv_size;
   result = _gnutls_cipher_init (&ch, enc_params->cipher, &dkey, &d_iv);
 
-  gnutls_afree (key);
+  gnutls_free (key);
   key = NULL;
 
   if (result < 0)
@@ -1555,7 +1555,7 @@ decrypt_data (schema_id schema, ASN1_TYPE pkcs8_asn,
 
 error:
   gnutls_free (data);
-  gnutls_afree (key);
+  gnutls_free (key);
   if (ch_init != 0)
     _gnutls_cipher_deinit (&ch);
   return result;

diff --git a/lib/x509/sign.c b/lib/x509/sign.c
index ff875736141a641b0696d891b11a71670356881b..0337ffdb2b6cfc79a8cc985dd26828ca9b2e6df6 100644 (file)
--- a/lib/x509/sign.c
+++ b/lib/x509/sign.c
@@ -268,7 +268,7 @@ _gnutls_x509_sign_tbs (ASN1_TYPE cert, const char *tbs_name,
   buf_size = 0;
   asn1_der_coding (cert, tbs_name, NULL, &buf_size, NULL);
 
-  buf = gnutls_alloca (buf_size);
+  buf = gnutls_malloc (buf_size);
   if (buf == NULL)
     {
       gnutls_assert ();
@@ -280,7 +280,7 @@ _gnutls_x509_sign_tbs (ASN1_TYPE cert, const char *tbs_name,
   if (result != ASN1_SUCCESS)
     {
       gnutls_assert ();
-      gnutls_afree (buf);
+      gnutls_free (buf);
       return _gnutls_asn2err (result);
     }
 
@@ -288,7 +288,7 @@ _gnutls_x509_sign_tbs (ASN1_TYPE cert, const char *tbs_name,
   tbs.size = buf_size;
 
   result = _gnutls_x509_sign (&tbs, hash, signer, signature);
-  gnutls_afree (buf);
+  gnutls_free (buf);
 
   return result;
 }

diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index 6b79560d275192d234cc5bff55b12ef78561548e..572dd667c092bd0d9b27d4d28bf16398ef9e1acd 100644 (file)
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -92,7 +92,7 @@ _gnutls_x509_crt_cpy (gnutls_x509_crt_t dest, gnutls_x509_crt_t src)
       return ret;
     }
 
-  der = gnutls_alloca (der_size);
+  der = gnutls_malloc (der_size);
   if (der == NULL)
     {
       gnutls_assert ();
@@ -103,7 +103,7 @@ _gnutls_x509_crt_cpy (gnutls_x509_crt_t dest, gnutls_x509_crt_t src)
   if (ret < 0)
     {
       gnutls_assert ();
-      gnutls_afree (der);
+      gnutls_free (der);
       return ret;
     }
 
@@ -111,7 +111,7 @@ _gnutls_x509_crt_cpy (gnutls_x509_crt_t dest, gnutls_x509_crt_t src)
   tmp.size = der_size;
   ret = gnutls_x509_crt_import (dest, &tmp, GNUTLS_X509_FMT_DER);
 
-  gnutls_afree (der);
+  gnutls_free (der);
 
   if (ret < 0)
     {
@@ -1962,7 +1962,7 @@ gnutls_x509_crt_get_fingerprint (gnutls_x509_crt_t cert,
   cert_buf_size = 0;
   asn1_der_coding (cert->cert, "", NULL, &cert_buf_size, NULL);
 
-  cert_buf = gnutls_alloca (cert_buf_size);
+  cert_buf = gnutls_malloc (cert_buf_size);
   if (cert_buf == NULL)
     {
       gnutls_assert ();
@@ -1974,7 +1974,7 @@ gnutls_x509_crt_get_fingerprint (gnutls_x509_crt_t cert,
   if (result != ASN1_SUCCESS)
     {
       gnutls_assert ();
-      gnutls_afree (cert_buf);
+      gnutls_free (cert_buf);
       return _gnutls_asn2err (result);
     }
 
@@ -1982,7 +1982,7 @@ gnutls_x509_crt_get_fingerprint (gnutls_x509_crt_t cert,
   tmp.size = cert_buf_size;
 
   result = gnutls_fingerprint (algo, &tmp, buf, sizeof_buf);
-  gnutls_afree (cert_buf);
+  gnutls_free (cert_buf);
 
   return result;
 }
@@ -2157,7 +2157,7 @@ gnutls_x509_crt_get_key_id (gnutls_x509_crt_t crt, unsigned int flags,
       return _gnutls_asn2err (result);
     }
 
-  pubkey.data = gnutls_alloca (pubkey.size);
+  pubkey.data = gnutls_malloc (pubkey.size);
   if (pubkey.data == NULL)
     {
       gnutls_assert ();
@@ -2169,14 +2169,14 @@ gnutls_x509_crt_get_key_id (gnutls_x509_crt_t crt, unsigned int flags,
   if (result != ASN1_SUCCESS)
     {
       gnutls_assert ();
-      gnutls_afree (pubkey.data);
+      gnutls_free (pubkey.data);
       return _gnutls_asn2err (result);
     }
 
   result = gnutls_fingerprint (GNUTLS_DIG_SHA1, &pubkey,
                               output_data, output_data_size);
 
-  gnutls_afree (pubkey.data);
+  gnutls_free (pubkey.data);
 
   return result;
 }