added some check for the input parameters.

diff --git a/lib/x509/crl.c b/lib/x509/crl.c
index 7b30cf842ebd1e6f479935e725ed8b8e458adb9e..308cf65ee43c27c3456dc33a11203bb2b9e6cdfc 100644 (file)
--- a/lib/x509/crl.c
+++ b/lib/x509/crl.c
@@ -99,6 +99,11 @@ int gnutls_x509_crl_import(gnutls_x509_crl crl, const gnutls_datum * data,
        int result = 0, need_free = 0;
        gnutls_datum _data = { data->data, data->size };
 
+       if (crl == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        /* If the CRL is in PEM format then decode it
         */
        if (format == GNUTLS_X509_FMT_PEM) {
@@ -161,6 +166,11 @@ int gnutls_x509_crl_import(gnutls_x509_crl crl, const gnutls_datum * data,
 int gnutls_x509_crl_get_issuer_dn(gnutls_x509_crl crl, char *buf,
                                  size_t *sizeof_buf)
 {
+       if (crl == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_parse_dn(crl->crl,
                                     "tbsCertList.issuer.rdnSequence",
                                     buf, sizeof_buf);
@@ -190,6 +200,11 @@ int gnutls_x509_crl_get_issuer_dn_by_oid(gnutls_x509_crl crl,
                                         const char *oid, int indx,
                                         char *buf, size_t *sizeof_buf)
 {
+       if (crl == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_parse_dn_oid(crl->crl,
                                         "tbsCertList.issuer.rdnSequence",
                                         oid, indx, buf, sizeof_buf);
@@ -210,6 +225,11 @@ int gnutls_x509_crl_get_signature_algorithm(gnutls_x509_crl crl)
        int result;
        gnutls_datum sa;
 
+       if (crl == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        /* Read the signature algorithm. Note that parameters are not
         * read. They will be read from the issuer's certificate if needed.
         */
@@ -242,6 +262,11 @@ int gnutls_x509_crl_get_version(gnutls_x509_crl crl)
        opaque version[5];
        int len, result;
 
+       if (crl == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        len = sizeof(version);
        if ((result =
             asn1_read_value(crl->crl, "tbsCertList.version", version,
@@ -264,6 +289,11 @@ int gnutls_x509_crl_get_version(gnutls_x509_crl crl)
   **/
 time_t gnutls_x509_crl_get_this_update(gnutls_x509_crl crl)
 {
+       if (crl == NULL) {
+               gnutls_assert();
+               return (time_t)-1;
+       }
+
        return _gnutls_x509_get_time(crl->crl,
                                     "tbsCertList.thisUpdate");
 }
@@ -281,6 +311,11 @@ time_t gnutls_x509_crl_get_this_update(gnutls_x509_crl crl)
   **/
 time_t gnutls_x509_crl_get_next_update(gnutls_x509_crl crl)
 {
+       if (crl == NULL) {
+               gnutls_assert();
+               return (time_t)-1;
+       }
+
        return _gnutls_x509_get_time(crl->crl,
                                     "tbsCertList.nextUpdate");
 }
@@ -300,6 +335,11 @@ int gnutls_x509_crl_get_certificate_count(gnutls_x509_crl crl)
 
        int count, result;
 
+       if (crl == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        result =
            asn1_number_of_elements(crl->crl,
                                    "tbsCertList.revokedCertificates",
@@ -337,6 +377,11 @@ int gnutls_x509_crl_get_certificate(gnutls_x509_crl crl, int index,
        char serial_name[64];
        char date_name[64];
 
+       if (crl == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        _gnutls_int2str(index + 1, str_index);
        _gnutls_str_cpy(serial_name, sizeof(serial_name),
                        "tbsCertList.revokedCertificates.?");
@@ -388,6 +433,11 @@ int _gnutls_x509_crl_get_raw_issuer_dn(gnutls_x509_crl crl,
        int start1, end1;
        gnutls_datum crl_signed_data;
 
+       if (crl == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        /* get the issuer of 'crl'
         */
        if ((result =
@@ -459,6 +509,11 @@ cleanup:
 int gnutls_x509_crl_export( gnutls_x509_crl crl,
        gnutls_x509_crt_fmt format, unsigned char* output_data, size_t* output_data_size)
 {
+       if (crl == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_export_int( crl->crl, format, PEM_CRL, *output_data_size,
                output_data, output_data_size);
 }

diff --git a/lib/x509/crq.c b/lib/x509/crq.c
index 79a653c0c379d1818d94b158c10566cc737ef3dc..ac04d1c4dafbb30557c91a77aa49e24f954764dd 100644 (file)
--- a/lib/x509/crq.c
+++ b/lib/x509/crq.c
@@ -105,6 +105,11 @@ int gnutls_x509_crq_import(gnutls_x509_crq crq, const gnutls_datum * data,
 {
        int result = 0, need_free = 0;
        gnutls_datum _data;
+
+       if (crq==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
        
        _data.data = data->data;
        _data.size = data->size;
@@ -171,6 +176,11 @@ int gnutls_x509_crq_import(gnutls_x509_crq crq, const gnutls_datum * data,
 int gnutls_x509_crq_get_dn(gnutls_x509_crq crq, char *buf,
                                         size_t *sizeof_buf)
 {
+       if (crq==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_parse_dn( crq->crq, "certificationRequestInfo.subject.rdnSequence",
                buf, sizeof_buf);
 }
@@ -198,6 +208,11 @@ int gnutls_x509_crq_get_dn(gnutls_x509_crq crq, char *buf,
 int gnutls_x509_crq_get_dn_by_oid(gnutls_x509_crq crq, const char* oid, 
        int indx, char *buf, size_t *sizeof_buf)
 {
+       if (crq==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_parse_dn_oid( crq->crq, "certificationRequestInfo.subject.rdnSequence", oid,
                indx, buf, sizeof_buf);
 }
@@ -356,6 +371,11 @@ static int parse_attribute(ASN1_TYPE asn1_struct,
 int gnutls_x509_crq_get_challenge_password(gnutls_x509_crq crq, 
        char* pass, size_t* sizeof_pass)
 {
+       if (crq==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return parse_attribute( crq->crq, "certificationRequestInfo.attributes",
                "1.2.840.113549.1.9.7", 0, pass, sizeof_pass);
 }
@@ -403,6 +423,11 @@ int gnutls_x509_crq_set_version(gnutls_x509_crq crq, unsigned int version)
 int result;
 uint8 null = version;
 
+       if (crq==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        result = asn1_write_value( crq->crq, "certificationRequestInfo.version", &null, 1);
        if (result != ASN1_SUCCESS) {
                gnutls_assert();
@@ -427,6 +452,11 @@ int gnutls_x509_crq_set_key(gnutls_x509_crq crq, gnutls_x509_privkey key)
 {
 int result;
 
+       if (crq==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        result = _gnutls_x509_encode_and_copy_PKI_params( crq->crq,
                "certificationRequestInfo.subjectPKInfo", key->pk_algorithm,
                key->params, key->params_size);
@@ -453,6 +483,11 @@ int gnutls_x509_crq_set_challenge_password(gnutls_x509_crq crq, const char* pass
 {
 int result;
 
+       if (crq==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        /* Add the attribute.
         */
        result = asn1_write_value( crq->crq, "certificationRequestInfo.attributes", "NEW", 1);
@@ -493,6 +528,11 @@ int result;
 gnutls_datum signature;
 const char* pk;
 
+       if (crq==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if (key->pk_algorithm != GNUTLS_PK_RSA) {
                gnutls_assert();
                return GNUTLS_E_UNIMPLEMENTED_FEATURE;
@@ -568,6 +608,11 @@ const char* pk;
 int gnutls_x509_crq_export( gnutls_x509_crq crq,
        gnutls_x509_crt_fmt format, unsigned char* output_data, size_t* output_data_size)
 {
+       if (crq==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_export_int( crq->crq, format, PEM_CRQ, *output_data_size,
                output_data, output_data_size);
 }
@@ -593,6 +638,11 @@ int gnutls_x509_crq_get_pk_algorithm( gnutls_x509_crq crq, unsigned int* bits)
 {
 int result;
 
+       if (crq==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        result = _gnutls_x509_get_pk_algorithm( crq->crq, "certificationRequestInfo.subjectPKInfo",
                bits);
        if (result < 0) {

diff --git a/lib/x509/pkcs12.c b/lib/x509/pkcs12.c
index 1256b624269f8cbb69762fb4e2ca886a44a5da73..75d04ed27036425a26540d2e425256ed1b89893a 100644 (file)
--- a/lib/x509/pkcs12.c
+++ b/lib/x509/pkcs12.c
@@ -174,6 +174,11 @@ int gnutls_pkcs12_import(gnutls_pkcs12 pkcs12, const gnutls_datum * data,
        int result = 0, need_free = 0;
        gnutls_datum _data = { data->data, data->size };
 
+       if (pkcs12==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        /* If the PKCS12 is in PEM format then decode it
         */
        if (format == GNUTLS_X509_FMT_PEM) {
@@ -233,6 +238,11 @@ int gnutls_pkcs12_import(gnutls_pkcs12 pkcs12, const gnutls_datum * data,
 int gnutls_pkcs12_export( gnutls_pkcs12 pkcs12,
        gnutls_x509_crt_fmt format, unsigned char* output_data, size_t* output_data_size)
 {
+       if (pkcs12==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_export_int( pkcs12->pkcs12, format, PEM_PKCS12, *output_data_size,
                output_data, output_data_size);
 }
@@ -485,6 +495,11 @@ int gnutls_pkcs12_get_bag(gnutls_pkcs12 pkcs12,
        char counter[MAX_INT_DIGITS];
        gnutls_datum tmp = {NULL, 0};
 
+       if (pkcs12==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        /* Step 1. decode the data.
         */
        result = _decode_pkcs12_auth_safe( pkcs12->pkcs12, &c2, NULL);
@@ -617,6 +632,11 @@ int gnutls_pkcs12_set_bag(gnutls_pkcs12 pkcs12, gnutls_pkcs12_bag bag)
        int enc = 0, dum = 1;
        char null;
 
+       if (pkcs12==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        /* Step 1. Check if the pkcs12 structure is empty. In that
         * case generate an empty PFX.
         */
@@ -723,6 +743,11 @@ int gnutls_pkcs12_generate_mac(gnutls_pkcs12 pkcs12, const char* pass)
        gnutls_datum tmp = {NULL, 0};
        opaque sha_mac[20];
 
+       if (pkcs12==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        /* Generate the salt.
         */
        _gnutls_get_random(salt, sizeof(salt), GNUTLS_WEAK_RANDOM);
@@ -826,6 +851,11 @@ int gnutls_pkcs12_verify_mac(gnutls_pkcs12 pkcs12, const char* pass)
        opaque sha_mac[20];
        opaque sha_mac_orig[20];
 
+       if (pkcs12==NULL || pass == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        /* read the iterations
         */
        

diff --git a/lib/x509/pkcs12_bag.c b/lib/x509/pkcs12_bag.c
index affe903b02c2f2bf9e2711e74b0e416d403289fc..39bde9b105f2a3a03e53d0c5c862c3244dde2abd 100644 (file)
--- a/lib/x509/pkcs12_bag.c
+++ b/lib/x509/pkcs12_bag.c
@@ -97,6 +97,11 @@ void gnutls_pkcs12_bag_deinit(gnutls_pkcs12_bag bag)
   **/
 gnutls_pkcs12_bag_type gnutls_pkcs12_bag_get_type(gnutls_pkcs12_bag bag, int indx)
 {
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if (indx >= bag->bag_elements) 
                return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
        return bag->element[indx].type;
@@ -111,6 +116,11 @@ gnutls_pkcs12_bag_type gnutls_pkcs12_bag_get_type(gnutls_pkcs12_bag bag, int ind
   **/
 int gnutls_pkcs12_bag_get_count(gnutls_pkcs12_bag bag)
 {
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return bag->bag_elements;
 }
 
@@ -125,6 +135,11 @@ int gnutls_pkcs12_bag_get_count(gnutls_pkcs12_bag bag)
   **/
 int gnutls_pkcs12_bag_get_data(gnutls_pkcs12_bag bag, int indx, gnutls_const_datum * data)
 {
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if (indx >= bag->bag_elements) 
                return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
 
@@ -281,6 +296,10 @@ int gnutls_pkcs12_bag_set_data(gnutls_pkcs12_bag bag, gnutls_pkcs12_bag_type typ
        const gnutls_datum* data)
 {
 int ret;
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
 
        if (bag->bag_elements == MAX_BAG_ELEMENTS-1) {
                gnutls_assert();
@@ -332,6 +351,11 @@ int gnutls_pkcs12_bag_set_crt(gnutls_pkcs12_bag bag, gnutls_x509_crt crt)
 int ret;
 gnutls_datum data;
 
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        ret = _gnutls_x509_der_encode( crt->cert, "", &data, 0);
        if (ret < 0) {
                gnutls_assert();
@@ -362,6 +386,12 @@ int gnutls_pkcs12_bag_set_crl(gnutls_pkcs12_bag bag, gnutls_x509_crl crl)
 int ret;
 gnutls_datum data;
 
+
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        ret = _gnutls_x509_der_encode( crl->crl, "", &data, 0);
        if (ret < 0) {
                gnutls_assert();
@@ -393,6 +423,12 @@ int gnutls_pkcs12_bag_set_key_id(gnutls_pkcs12_bag bag, int indx,
 {
 int ret;
 
+
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if (indx > bag->bag_elements-1) {
                gnutls_assert();
                return GNUTLS_E_INVALID_REQUEST;
@@ -424,6 +460,10 @@ int ret;
 int gnutls_pkcs12_bag_get_key_id(gnutls_pkcs12_bag bag, int indx, 
        gnutls_datum* id)
 {
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
 
        if (indx > bag->bag_elements-1) {
                gnutls_assert();
@@ -451,6 +491,11 @@ int gnutls_pkcs12_bag_get_key_id(gnutls_pkcs12_bag bag, int indx,
 int gnutls_pkcs12_bag_get_friendly_name(gnutls_pkcs12_bag bag, int indx, 
        char **name)
 {
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if (indx > bag->bag_elements-1) {
                gnutls_assert();
                return GNUTLS_E_INVALID_REQUEST;
@@ -478,6 +523,11 @@ int gnutls_pkcs12_bag_get_friendly_name(gnutls_pkcs12_bag bag, int indx,
 int gnutls_pkcs12_bag_set_friendly_name(gnutls_pkcs12_bag bag, int indx, 
        const char* name)
 {
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if (indx > bag->bag_elements-1) {
                gnutls_assert();
                return GNUTLS_E_INVALID_REQUEST;
@@ -506,6 +556,11 @@ int gnutls_pkcs12_bag_decrypt(gnutls_pkcs12_bag bag, const char* pass)
 {
 int ret;
 gnutls_datum dec;
+
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
        
        if (bag->element[0].type != GNUTLS_BAG_ENCRYPTED) {
                gnutls_assert();
@@ -555,6 +610,11 @@ gnutls_datum der = {NULL, 0};
 gnutls_datum enc = {NULL, 0};
 schema_id id;
 
+       if (bag == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if (bag->element[0].type == GNUTLS_BAG_ENCRYPTED) {
                gnutls_assert();
                return GNUTLS_E_INVALID_REQUEST;

diff --git a/lib/x509/privkey.c b/lib/x509/privkey.c
index 3cf6ed9313279bc0a88da270f22af7726e45bbfe..a470dcae4b444a95f22d288b7fdc251a0c63474f 100644 (file)
--- a/lib/x509/privkey.c
+++ b/lib/x509/privkey.c
@@ -269,6 +269,11 @@ int gnutls_x509_privkey_import(gnutls_x509_privkey key, const gnutls_datum * dat
 {
        int result = 0, need_free = 0;
        gnutls_datum _data;
+
+       if (key == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
        
        _data.data = data->data;
        _data.size = data->size;
@@ -374,6 +379,11 @@ int gnutls_x509_privkey_import_rsa_raw(gnutls_x509_privkey key,
        int i = 0, ret;
        size_t siz = 0;
 
+       if (key == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        siz = m->size;
        if (_gnutls_mpi_scan(&key->params[0], m->data, &siz)) {
                gnutls_assert();
@@ -444,6 +454,11 @@ int gnutls_x509_privkey_import_rsa_raw(gnutls_x509_privkey key,
   **/
 int gnutls_x509_privkey_get_pk_algorithm( gnutls_x509_privkey key)
 {
+       if (key == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
         return key->pk_algorithm;
 }
 
@@ -473,6 +488,11 @@ int gnutls_x509_privkey_export( gnutls_x509_privkey key,
        gnutls_x509_crt_fmt format, unsigned char* output_data, size_t* output_data_size)
 {
        char * msg;
+
+       if (key == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
                
        if (key->pk_algorithm == GNUTLS_PK_RSA)
                msg = PEM_KEY_RSA;
@@ -506,6 +526,11 @@ int gnutls_x509_privkey_export_rsa_raw(gnutls_x509_privkey key,
 {
        size_t siz;
 
+       if (key == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        siz = 0;
        _gnutls_mpi_print(NULL, &siz, key->params[0]);
 
@@ -813,6 +838,11 @@ int gnutls_x509_privkey_generate( gnutls_x509_privkey key, gnutls_pk_algorithm a
 {
 int ret;
 
+       if (key == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        switch( algo) {
                case GNUTLS_PK_DSA:
                        return GNUTLS_E_UNIMPLEMENTED_FEATURE;
@@ -879,8 +909,14 @@ int result;
 GNUTLS_HASH_HANDLE hd;
 gnutls_datum der = { NULL, 0 };
 
+       if (key == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if (*output_data_size < 20) {
                gnutls_assert();
+               *output_data_size = 20;
                return GNUTLS_E_SHORT_MEMORY_BUFFER;
        }
 

diff --git a/lib/x509/privkey_pkcs8.c b/lib/x509/privkey_pkcs8.c
index 894accea21086bb4dece5de28a32f7e96bb28b70..b8316779df34bdacfa60a933f8bd15cab962fb68 100644 (file)
--- a/lib/x509/privkey_pkcs8.c
+++ b/lib/x509/privkey_pkcs8.c
@@ -407,6 +407,11 @@ int gnutls_x509_privkey_export_pkcs8(gnutls_x509_privkey key,
        gnutls_datum tmp;
        schema_id schema;
 
+       if (key == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        /* Get the private key info
         * tmp holds the DER encoding.
         */
@@ -824,6 +829,11 @@ int gnutls_x509_privkey_import_pkcs8(gnutls_x509_privkey key,
        gnutls_datum _data;
        int encrypted;
 
+       if (key == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        _data.data = data->data;
        _data.size = data->size;
 

diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index 7df61d07bdd642cbe2d4e6ddb858735422aad864..5ed50f5d09d536a907d59c20d137c4bd9e883100 100644 (file)
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -152,6 +152,11 @@ int gnutls_x509_crt_import(gnutls_x509_crt cert, const gnutls_datum * data,
        int result = 0, need_free = 0;
        gnutls_datum _data;
        opaque *signature = NULL;
+
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
        
        _data.data = data->data;
        _data.size = data->size;
@@ -223,6 +228,11 @@ int gnutls_x509_crt_import(gnutls_x509_crt cert, const gnutls_datum * data,
 int gnutls_x509_crt_get_issuer_dn(gnutls_x509_crt cert, char *buf,
                                         size_t *sizeof_buf)
 {
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_parse_dn( cert->cert, "tbsCertificate.issuer.rdnSequence",
                buf, sizeof_buf);
 }
@@ -250,6 +260,11 @@ int gnutls_x509_crt_get_issuer_dn(gnutls_x509_crt cert, char *buf,
 int gnutls_x509_crt_get_issuer_dn_by_oid(gnutls_x509_crt cert, const char* oid, 
        int indx, char *buf, size_t *sizeof_buf)
 {
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_parse_dn_oid( cert->cert, "tbsCertificate.issuer.rdnSequence", oid,
                indx, buf, sizeof_buf);
 }
@@ -273,6 +288,11 @@ int gnutls_x509_crt_get_issuer_dn_by_oid(gnutls_x509_crt cert, const char* oid,
 int gnutls_x509_crt_get_dn(gnutls_x509_crt cert, char *buf,
                                         size_t *sizeof_buf)
 {
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_parse_dn( cert->cert, "tbsCertificate.subject.rdnSequence",
                buf, sizeof_buf);
 }
@@ -300,6 +320,11 @@ int gnutls_x509_crt_get_dn(gnutls_x509_crt cert, char *buf,
 int gnutls_x509_crt_get_dn_by_oid(gnutls_x509_crt cert, const char* oid, 
        int indx, char *buf, size_t *sizeof_buf)
 {
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_parse_dn_oid( cert->cert, "tbsCertificate.subject.rdnSequence", oid,
                indx, buf, sizeof_buf);
 }
@@ -319,6 +344,11 @@ int gnutls_x509_crt_get_signature_algorithm(gnutls_x509_crt cert)
        int result;
        gnutls_datum sa;
 
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        /* Read the signature algorithm. Note that parameters are not
         * read. They will be read from the issuer's certificate if needed.
         */
@@ -349,7 +379,12 @@ int gnutls_x509_crt_get_version(gnutls_x509_crt cert)
 {
        opaque version[5];
        int len, result;
-       
+
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        len = sizeof(version);
        if ((result = asn1_read_value(cert->cert, "tbsCertificate.version", version, &len)) !=
                ASN1_SUCCESS) {
@@ -373,6 +408,11 @@ int gnutls_x509_crt_get_version(gnutls_x509_crt cert)
   **/
 time_t gnutls_x509_crt_get_activation_time(gnutls_x509_crt cert)
 {
+       if (cert==NULL) {
+               gnutls_assert();
+               return (time_t)-1;
+       }
+
        return _gnutls_x509_get_time( cert->cert, "tbsCertificate.validity.notBefore");
 }
 
@@ -387,6 +427,11 @@ time_t gnutls_x509_crt_get_activation_time(gnutls_x509_crt cert)
   **/
 time_t gnutls_x509_crt_get_expiration_time(gnutls_x509_crt cert)
 {
+       if (cert==NULL) {
+               gnutls_assert();
+               return (time_t)-1;
+       }
+
        return _gnutls_x509_get_time( cert->cert, "tbsCertificate.validity.notAfter");
 }
 
@@ -410,6 +455,11 @@ int gnutls_x509_crt_get_serial(gnutls_x509_crt cert, char* result,
 {
        int ret;
 
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if ((ret = asn1_read_value(cert->cert, "tbsCertificate.serialNumber", result, result_size)) < 0) {
                gnutls_assert();
                return _gnutls_asn2err(ret);
@@ -440,6 +490,11 @@ int gnutls_x509_crt_get_pk_algorithm( gnutls_x509_crt cert, unsigned int* bits)
 {
        int result;
 
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        result = _gnutls_x509_get_pk_algorithm( cert->cert, "tbsCertificate.subjectPublicKeyInfo",
                bits);
 
@@ -487,7 +542,13 @@ int gnutls_x509_crt_get_subject_alt_name(gnutls_x509_crt cert,
        char num[MAX_INT_DIGITS];
        gnutls_x509_subject_alt_name type;
 
-       memset(ret, 0, *ret_size);
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
+       if (ret) memset(ret, 0, *ret_size);
+       else *ret_size = 0;
 
        if ((result =
             _gnutls_x509_crt_get_extension(cert, "2.5.29.17", 0, &dnsname, critical)) < 0) {
@@ -551,12 +612,12 @@ int gnutls_x509_crt_get_subject_alt_name(gnutls_x509_crt cert,
        _gnutls_str_cat( nptr, sizeof(nptr), ".");
        _gnutls_str_cat( nptr, sizeof(nptr), ext_data);
 
-       len = sizeof(ext_data);
-
+       len = *ret_size;
        result =
-            asn1_read_value(c2, nptr, ret, ret_size);
+            asn1_read_value(c2, nptr, ret, &len);
        asn1_delete_structure(&c2);
-       
+       *ret_size = len;
+
        if (result==ASN1_MEM_ERROR)
                return GNUTLS_E_SHORT_MEMORY_BUFFER;
        
@@ -589,6 +650,11 @@ int gnutls_x509_crt_get_ca_status(gnutls_x509_crt cert, unsigned int* critical)
        gnutls_datum basicConstraints;
        int ca;
 
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if ((result =
             _gnutls_x509_crt_get_extension(cert, "2.5.29.19", 0, &basicConstraints, critical)) < 0) {
                gnutls_assert();
@@ -638,6 +704,11 @@ int gnutls_x509_crt_get_key_usage(gnutls_x509_crt cert, unsigned int *key_usage,
        gnutls_datum keyUsage;
        uint16 _usage;
 
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if ((result =
             _gnutls_x509_crt_get_extension(cert, "2.5.29.15", 0, &keyUsage, critical)) < 0) {
                return result;
@@ -686,6 +757,11 @@ int gnutls_x509_crt_get_extension_by_oid(gnutls_x509_crt cert, const char* oid,
        int result;
        gnutls_datum output;
 
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if ((result =
             _gnutls_x509_crt_get_extension(cert, oid, indx, &output, critical)) < 0) {
                gnutls_assert();
@@ -884,6 +960,11 @@ gnutls_datum tmp;
 int gnutls_x509_crt_export( gnutls_x509_crt cert,
        gnutls_x509_crt_fmt format, unsigned char* output_data, size_t* output_data_size)
 {
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        return _gnutls_x509_export_int( cert->cert, format, "CERTIFICATE", *output_data_size,
                output_data, output_data_size);
 }
@@ -917,8 +998,14 @@ int i, pk, result = 0;
 gnutls_datum der = { NULL, 0 };
 GNUTLS_HASH_HANDLE hd;
 
+       if (crt==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        if (*output_data_size < 20) {
                gnutls_assert();
+               *output_data_size = 20;
                return GNUTLS_E_SHORT_MEMORY_BUFFER;
        }
 
@@ -1002,6 +1089,11 @@ int gnutls_x509_crt_check_revocation(gnutls_x509_crt cert,
        int ncerts, ret, i, j;
        gnutls_datum dn1, dn2;
 
+       if (cert==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INVALID_REQUEST;
+       }
+
        for (j = 0; j < crl_list_length; j++) { /* do for all the crls */
 
                /* Step 1. check if issuer's DN match