apps/pkcs12.c:395: error: BUFFER_OVERRUN_L2
  Offset added: [50, 8192] Size: 400 by call to `EVP_read_pw_string`.
Showing all 11 steps of the trace


apps/pkcs12.c:94:1: Array declaration
92.   int MAIN(int, char **);
93.   
94. > int MAIN(int argc, char **argv)
95.   {
96.       ENGINE *e = NULL;

apps/pkcs12.c:395:5: Call
393.       CRYPTO_push_info("read MAC password");
394.   #endif
395.   	if(EVP_read_pw_string (macpass, 50, "Enter MAC Password:", export_cert))
           ^
396.   	{
397.       	    BIO_printf (bio_err, "Can't read Password\n");

crypto/evp/evp_key.c:87:1: Parameter `len`
  85.    * in the DES library -- if someone ever wants to disable DES,
  86.    * this function will fail */
  87. > int EVP_read_pw_string(char *buf, int len, const char *prompt, int verify)
  88.   	{
  89.   #ifndef NO_DES

crypto/evp/evp_key.c:92:9: Call
  90.   	if ((prompt == NULL) && (prompt_string[0] != '\0'))
  91.   		prompt=prompt_string;
  92.   	return(des_read_pw_string(buf,len,prompt,verify));
                ^
  93.   #else
  94.   	return -1;

crypto/des/read_pwd.c:208:1: Parameter `*buf`
    206.   static jmp_buf save;
    207.   
    208. > int des_read_pw_string(char *buf, int length, const char *prompt,
    209.   	     int verify)
    210.   	{

crypto/des/read_pwd.c:214:6: Call
    212.   	int ret;
    213.   
    214.   	ret=des_read_pw(buf,buff,(length>BUFSIZ)?BUFSIZ:length,prompt,verify);
                ^
    215.   	memset(buff,0,BUFSIZ);
    216.   	return(ret);

crypto/des/read_pwd.c:233:1: <Offset trace>
231.   
232.   /* return 0 if ok, 1 (or -1) otherwise */
233. > int des_read_pw(char *buf, char *buff, int size, const char *prompt,
234.   	     int verify)
235.   	{

crypto/des/read_pwd.c:233:1: Parameter `size`
      231.   
      232.   /* return 0 if ok, 1 (or -1) otherwise */
      233. > int des_read_pw(char *buf, char *buff, int size, const char *prompt,
      234.   	     int verify)
      235.   	{

crypto/des/read_pwd.c:233:1: <Length trace>
231.   
232.   /* return 0 if ok, 1 (or -1) otherwise */
233. > int des_read_pw(char *buf, char *buff, int size, const char *prompt,
234.   	     int verify)
235.   	{

crypto/des/read_pwd.c:233:1: Parameter `*buf`
      231.   
      232.   /* return 0 if ok, 1 (or -1) otherwise */
      233. > int des_read_pw(char *buf, char *buff, int size, const char *prompt,
      234.   	     int verify)
      235.   	{

crypto/des/read_pwd.c:339:3: Array access: Offset added: [50, 8192] Size: 400 by call to `EVP_read_pw_string` 
      337.   
      338.   		buf[0]='\0';
      339.   		fgets(buf,size,tty);
               ^
      340.   		if (feof(tty)) goto error;
      341.   		if (ferror(tty)) goto error;

int des_read_pw(char *buf, char *buff, int size, const char *prompt,
	     int verify)
	{
#ifdef VMS
	struct IOSB iosb;
	$DESCRIPTOR(terminal,"TT");
	long tty_orig[3], tty_new[3];
	long status;
	unsigned short channel = 0;
#else
#ifndef MSDOS
	TTY_STRUCT tty_orig,tty_new;
#endif
#endif
	int number;
	int ok;
	static int ps;
	int is_a_tty;
	static FILE *tty;
	char *p;
	if (setjmp(save))
		{
		ok=0;
		goto error;
		}
	number=5;
	ok=0;
	ps=0;
	is_a_tty=1;
	tty=NULL;
#ifdef MSDOS
	if ((tty=fopen("con","r")) == NULL)
		tty=stdin;
#elif defined(MAC_OS_pre_X)
	tty=stdin;
#else
#ifndef MPE
	if ((tty=fopen("/dev/tty","r")) == NULL)
#endif
		tty=stdin;
#endif
#if defined(TTY_get) && !defined(VMS)
	if (TTY_get(fileno(tty),&tty_orig) == -1)
		{
#ifdef ENOTTY
		if (errno == ENOTTY)
			is_a_tty=0;
		else
#endif
#ifdef EINVAL
		if (errno == EINVAL)
			is_a_tty=0;
		else
#endif
			return(-1);
		}
	memcpy(&(tty_new),&(tty_orig),sizeof(tty_orig));
#endif
#ifdef VMS
	status = sys$assign(&terminal,&channel,0,0);
	if (status != SS$_NORMAL)
		return(-1);
	status=sys$qiow(0,channel,IO$_SENSEMODE,&iosb,0,0,tty_orig,12,0,0,0,0);
	if ((status != SS$_NORMAL) || (iosb.iosb$w_value != SS$_NORMAL))
		return(-1);
#endif
	pushsig();
	ps=1;
#ifdef TTY_FLAGS
	tty_new.TTY_FLAGS &= ~ECHO;
#endif
#if defined(TTY_set) && !defined(VMS)
	if (is_a_tty && (TTY_set(fileno(tty),&tty_new) == -1))
#ifdef MPE
		;
#else
		return(-1);
#endif
#endif
#ifdef VMS
	tty_new[0] = tty_orig[0];
	tty_new[1] = tty_orig[1] | TT$M_NOECHO;
	tty_new[2] = tty_orig[2];
	status = sys$qiow(0,channel,IO$_SETMODE,&iosb,0,0,tty_new,12,0,0,0,0);
	if ((status != SS$_NORMAL) || (iosb.iosb$w_value != SS$_NORMAL))
		return(-1);
#endif
	ps=2;
	while ((!ok) && (number--))
		{
		fputs(prompt,stderr);
		fflush(stderr);
		buf[0]='\0';
		fgets(buf,size,tty);
		if (feof(tty)) goto error;
		if (ferror(tty)) goto error;
		if ((p=(char *)strchr(buf,'\n')) != NULL)
			*p='\0';
		else	read_till_nl(tty);
		if (verify)
			{
			fprintf(stderr,"\nVerifying password - %s",prompt);
			fflush(stderr);
			buff[0]='\0';
			fgets(buff,size,tty);
			if (feof(tty)) goto error;
			if ((p=(char *)strchr(buff,'\n')) != NULL)
				*p='\0';
			else	read_till_nl(tty);
			if (strcmp(buf,buff) != 0)
				{
				fprintf(stderr,"\nVerify failure");
				fflush(stderr);
				break;
				}
			}
		ok=1;
		}
error:
	fprintf(stderr,"\n");
#ifdef DEBUG
	perror("fgets(tty)");
#endif
#if defined(TTY_set) && !defined(VMS)
	if (ps >= 2) TTY_set(fileno(tty),&tty_orig);
#endif
#ifdef VMS
	if (ps >= 2)
		status = sys$qiow(0,channel,IO$_SETMODE,&iosb,0,0
			,tty_orig,12,0,0,0,0);
#endif
	if (ps >= 1) popsig();
	if (stdin != tty) fclose(tty);
#ifdef VMS
	status = sys$dassgn(channel);
#endif
	return(!ok);
	}
['int MAIN(int argc, char **argv)\n{\n    ENGINE *e = NULL;\n    char *infile=NULL, *outfile=NULL, *keyname = NULL;\n    char *certfile=NULL;\n    BIO *in=NULL, *out = NULL, *inkey = NULL, *certsin = NULL;\n    char **args;\n    char *name = NULL;\n    PKCS12 *p12 = NULL;\n    char pass[50], macpass[50];\n    int export_cert = 0;\n    int options = 0;\n    int chain = 0;\n    int badarg = 0;\n    int iter = PKCS12_DEFAULT_ITER;\n    int maciter = PKCS12_DEFAULT_ITER;\n    int twopass = 0;\n    int keytype = 0;\n    int cert_pbe = NID_pbe_WithSHA1And40BitRC2_CBC;\n    int key_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;\n    int ret = 1;\n    int macver = 1;\n    int noprompt = 0;\n    STACK *canames = NULL;\n    char *cpass = NULL, *mpass = NULL;\n    char *passargin = NULL, *passargout = NULL, *passarg = NULL;\n    char *passin = NULL, *passout = NULL;\n    char *inrand = NULL;\n    char *CApath = NULL, *CAfile = NULL;\n    char *engine=NULL;\n    apps_startup();\n    enc = EVP_des_ede3_cbc();\n    if (bio_err == NULL ) bio_err = BIO_new_fp (stderr, BIO_NOCLOSE);\n    args = argv + 1;\n    while (*args) {\n\tif (*args[0] == \'-\') {\n\t\tif (!strcmp (*args, "-nokeys")) options |= NOKEYS;\n\t\telse if (!strcmp (*args, "-keyex")) keytype = KEY_EX;\n\t\telse if (!strcmp (*args, "-keysig")) keytype = KEY_SIG;\n\t\telse if (!strcmp (*args, "-nocerts")) options |= NOCERTS;\n\t\telse if (!strcmp (*args, "-clcerts")) options |= CLCERTS;\n\t\telse if (!strcmp (*args, "-cacerts")) options |= CACERTS;\n\t\telse if (!strcmp (*args, "-noout")) options |= (NOKEYS|NOCERTS);\n\t\telse if (!strcmp (*args, "-info")) options |= INFO;\n\t\telse if (!strcmp (*args, "-chain")) chain = 1;\n\t\telse if (!strcmp (*args, "-twopass")) twopass = 1;\n\t\telse if (!strcmp (*args, "-nomacver")) macver = 0;\n\t\telse if (!strcmp (*args, "-descert"))\n    \t\t\tcert_pbe = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;\n\t\telse if (!strcmp (*args, "-export")) export_cert = 1;\n\t\telse if (!strcmp (*args, "-des")) enc=EVP_des_cbc();\n#ifndef NO_IDEA\n\t\telse if (!strcmp (*args, "-idea")) enc=EVP_idea_cbc();\n#endif\n\t\telse if (!strcmp (*args, "-des3")) enc = EVP_des_ede3_cbc();\n\t\telse if (!strcmp (*args, "-noiter")) iter = 1;\n\t\telse if (!strcmp (*args, "-maciter"))\n\t\t\t\t\t maciter = PKCS12_DEFAULT_ITER;\n\t\telse if (!strcmp (*args, "-nomaciter"))\n\t\t\t\t\t maciter = 1;\n\t\telse if (!strcmp (*args, "-nodes")) enc=NULL;\n\t\telse if (!strcmp (*args, "-certpbe")) {\n\t\t\tif (args[1]) {\n\t\t\t\targs++;\n\t\t\t\tcert_pbe=OBJ_txt2nid(*args);\n\t\t\t\tif(cert_pbe == NID_undef) {\n\t\t\t\t\tBIO_printf(bio_err,\n\t\t\t\t\t\t "Unknown PBE algorithm %s\\n", *args);\n\t\t\t\t\tbadarg = 1;\n\t\t\t\t}\n\t\t\t} else badarg = 1;\n\t\t} else if (!strcmp (*args, "-keypbe")) {\n\t\t\tif (args[1]) {\n\t\t\t\targs++;\n\t\t\t\tkey_pbe=OBJ_txt2nid(*args);\n\t\t\t\tif(key_pbe == NID_undef) {\n\t\t\t\t\tBIO_printf(bio_err,\n\t\t\t\t\t\t "Unknown PBE algorithm %s\\n", *args);\n\t\t\t\t\tbadarg = 1;\n\t\t\t\t}\n\t\t\t} else badarg = 1;\n\t\t} else if (!strcmp (*args, "-rand")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tinrand = *args;\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp (*args, "-inkey")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tkeyname = *args;\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp (*args, "-certfile")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tcertfile = *args;\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp (*args, "-name")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tname = *args;\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp (*args, "-caname")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tif (!canames) canames = sk_new_null();\n\t\t\tsk_push(canames, *args);\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp (*args, "-in")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tinfile = *args;\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp (*args, "-out")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\toutfile = *args;\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp(*args,"-passin")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tpassargin = *args;\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp(*args,"-passout")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tpassargout = *args;\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp (*args, "-password")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tpassarg = *args;\n\t\t    \tnoprompt = 1;\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp(*args,"-CApath")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tCApath = *args;\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp(*args,"-CAfile")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tCAfile = *args;\n\t\t    } else badarg = 1;\n\t\t} else if (!strcmp(*args,"-engine")) {\n\t\t    if (args[1]) {\n\t\t\targs++;\n\t\t\tengine = *args;\n\t\t    } else badarg = 1;\n\t\t} else badarg = 1;\n\t} else badarg = 1;\n\targs++;\n    }\n    if (badarg) {\n\tBIO_printf (bio_err, "Usage: pkcs12 [options]\\n");\n\tBIO_printf (bio_err, "where options are\\n");\n\tBIO_printf (bio_err, "-export       output PKCS12 file\\n");\n\tBIO_printf (bio_err, "-chain        add certificate chain\\n");\n\tBIO_printf (bio_err, "-inkey file   private key if not infile\\n");\n\tBIO_printf (bio_err, "-certfile f   add all certs in f\\n");\n\tBIO_printf (bio_err, "-CApath arg   - PEM format directory of CA\'s\\n");\n\tBIO_printf (bio_err, "-CAfile arg   - PEM format file of CA\'s\\n");\n\tBIO_printf (bio_err, "-name \\"name\\"  use name as friendly name\\n");\n\tBIO_printf (bio_err, "-caname \\"nm\\"  use nm as CA friendly name (can be used more than once).\\n");\n\tBIO_printf (bio_err, "-in  infile   input filename\\n");\n\tBIO_printf (bio_err, "-out outfile  output filename\\n");\n\tBIO_printf (bio_err, "-noout        don\'t output anything, just verify.\\n");\n\tBIO_printf (bio_err, "-nomacver     don\'t verify MAC.\\n");\n\tBIO_printf (bio_err, "-nocerts      don\'t output certificates.\\n");\n\tBIO_printf (bio_err, "-clcerts      only output client certificates.\\n");\n\tBIO_printf (bio_err, "-cacerts      only output CA certificates.\\n");\n\tBIO_printf (bio_err, "-nokeys       don\'t output private keys.\\n");\n\tBIO_printf (bio_err, "-info         give info about PKCS#12 structure.\\n");\n\tBIO_printf (bio_err, "-des          encrypt private keys with DES\\n");\n\tBIO_printf (bio_err, "-des3         encrypt private keys with triple DES (default)\\n");\n#ifndef NO_IDEA\n\tBIO_printf (bio_err, "-idea         encrypt private keys with idea\\n");\n#endif\n\tBIO_printf (bio_err, "-nodes        don\'t encrypt private keys\\n");\n\tBIO_printf (bio_err, "-noiter       don\'t use encryption iteration\\n");\n\tBIO_printf (bio_err, "-maciter      use MAC iteration\\n");\n\tBIO_printf (bio_err, "-twopass      separate MAC, encryption passwords\\n");\n\tBIO_printf (bio_err, "-descert      encrypt PKCS#12 certificates with triple DES (default RC2-40)\\n");\n\tBIO_printf (bio_err, "-certpbe alg  specify certificate PBE algorithm (default RC2-40)\\n");\n\tBIO_printf (bio_err, "-keypbe alg   specify private key PBE algorithm (default 3DES)\\n");\n\tBIO_printf (bio_err, "-keyex        set MS key exchange type\\n");\n\tBIO_printf (bio_err, "-keysig       set MS key signature type\\n");\n\tBIO_printf (bio_err, "-password p   set import/export password source\\n");\n\tBIO_printf (bio_err, "-passin p     input file pass phrase source\\n");\n\tBIO_printf (bio_err, "-passout p    output file pass phrase source\\n");\n\tBIO_printf (bio_err, "-engine e     use engine e, possibly a hardware device.\\n");\n\tBIO_printf(bio_err,  "-rand file%cfile%c...\\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);\n\tBIO_printf(bio_err,  "              load the file (or the files in the directory) into\\n");\n\tBIO_printf(bio_err,  "              the random number generator\\n");\n    \tgoto end;\n    }\n    if (engine != NULL) {\n\tif((e = ENGINE_by_id(engine)) == NULL) {\n\t    BIO_printf(bio_err,"invalid engine \\"%s\\"\\n", engine);\n\t    goto end;\n\t}\n\tif(!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {\n\t    BIO_printf(bio_err,"can\'t use that engine\\n");\n\t    goto end;\n\t}\n\tBIO_printf(bio_err,"engine \\"%s\\" set.\\n", engine);\n\tENGINE_free(e);\n    }\n    if(passarg) {\n\tif(export_cert) passargout = passarg;\n\telse passargin = passarg;\n    }\n    if(!app_passwd(bio_err, passargin, passargout, &passin, &passout)) {\n\tBIO_printf(bio_err, "Error getting passwords\\n");\n\tgoto end;\n    }\n    if(!cpass) {\n    \tif(export_cert) cpass = passout;\n    \telse cpass = passin;\n    }\n    if(cpass) {\n\tmpass = cpass;\n\tnoprompt = 1;\n    } else {\n\tcpass = pass;\n\tmpass = macpass;\n    }\n    if(export_cert || inrand) {\n    \tapp_RAND_load_file(NULL, bio_err, (inrand != NULL));\n        if (inrand != NULL)\n\t\tBIO_printf(bio_err,"%ld semi-random bytes loaded\\n",\n\t\t\tapp_RAND_load_files(inrand));\n    }\n    ERR_load_crypto_strings();\n#ifdef CRYPTO_MDEBUG\n    CRYPTO_push_info("read files");\n#endif\n    if (!infile) in = BIO_new_fp(stdin, BIO_NOCLOSE);\n    else in = BIO_new_file(infile, "rb");\n    if (!in) {\n\t    BIO_printf(bio_err, "Error opening input file %s\\n",\n\t\t\t\t\t\tinfile ? infile : "<stdin>");\n\t    perror (infile);\n\t    goto end;\n   }\n   if (certfile) {\n    \tif(!(certsin = BIO_new_file(certfile, "r"))) {\n\t    BIO_printf(bio_err, "Can\'t open certificate file %s\\n", certfile);\n\t    perror (certfile);\n\t    goto end;\n\t}\n    }\n    if (keyname) {\n    \tif(!(inkey = BIO_new_file(keyname, "r"))) {\n\t    BIO_printf(bio_err, "Can\'t key certificate file %s\\n", keyname);\n\t    perror (keyname);\n\t    goto end;\n\t}\n     }\n#ifdef CRYPTO_MDEBUG\n    CRYPTO_pop_info();\n    CRYPTO_push_info("write files");\n#endif\n    if (!outfile) {\n\tout = BIO_new_fp(stdout, BIO_NOCLOSE);\n#ifdef VMS\n\t{\n\t    BIO *tmpbio = BIO_new(BIO_f_linebuffer());\n\t    out = BIO_push(tmpbio, out);\n\t}\n#endif\n    } else out = BIO_new_file(outfile, "wb");\n    if (!out) {\n\tBIO_printf(bio_err, "Error opening output file %s\\n",\n\t\t\t\t\t\toutfile ? outfile : "<stdout>");\n\tperror (outfile);\n\tgoto end;\n    }\n    if (twopass) {\n#ifdef CRYPTO_MDEBUG\n    CRYPTO_push_info("read MAC password");\n#endif\n\tif(EVP_read_pw_string (macpass, 50, "Enter MAC Password:", export_cert))\n\t{\n    \t    BIO_printf (bio_err, "Can\'t read Password\\n");\n    \t    goto end;\n       \t}\n#ifdef CRYPTO_MDEBUG\n    CRYPTO_pop_info();\n#endif\n    }\n    if (export_cert) {\n\tEVP_PKEY *key = NULL;\n\tSTACK_OF(PKCS12_SAFEBAG) *bags = NULL;\n\tSTACK_OF(PKCS7) *safes = NULL;\n\tPKCS12_SAFEBAG *bag = NULL;\n\tPKCS8_PRIV_KEY_INFO *p8 = NULL;\n\tPKCS7 *authsafe = NULL;\n\tX509 *ucert = NULL;\n\tSTACK_OF(X509) *certs=NULL;\n\tchar *catmp = NULL;\n\tint i;\n\tunsigned char keyid[EVP_MAX_MD_SIZE];\n\tunsigned int keyidlen = 0;\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_push_info("process -export_cert");\n\tCRYPTO_push_info("reading private key");\n#endif\n\tkey = PEM_read_bio_PrivateKey(inkey ? inkey : in, NULL, NULL, passin);\n\tif (!inkey) (void) BIO_reset(in);\n\telse BIO_free(inkey);\n\tif (!key) {\n\t\tBIO_printf (bio_err, "Error loading private key\\n");\n\t\tERR_print_errors(bio_err);\n\t\tgoto export_end;\n\t}\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n\tCRYPTO_push_info("reading certs from input");\n#endif\n\tcerts = sk_X509_new_null();\n\tif(!cert_load(in, certs)) {\n\t\tBIO_printf(bio_err, "Error loading certificates from input\\n");\n\t\tERR_print_errors(bio_err);\n\t\tgoto export_end;\n\t}\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n\tCRYPTO_push_info("reading certs from input 2");\n#endif\n\tfor(i = 0; i < sk_X509_num(certs); i++) {\n\t\tucert = sk_X509_value(certs, i);\n\t\tif(X509_check_private_key(ucert, key)) {\n\t\t\tX509_digest(ucert, EVP_sha1(), keyid, &keyidlen);\n\t\t\tbreak;\n\t\t}\n\t}\n\tif(!keyidlen) {\n\t\tucert = NULL;\n\t\tBIO_printf(bio_err, "No certificate matches private key\\n");\n\t\tgoto export_end;\n\t}\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n\tCRYPTO_push_info("reading certs from certfile");\n#endif\n\tbags = sk_PKCS12_SAFEBAG_new_null ();\n\tif (certsin) {\n\t\tif(!cert_load(certsin, certs)) {\n\t\t\tBIO_printf(bio_err, "Error loading certificates from certfile\\n");\n\t\t\tERR_print_errors(bio_err);\n\t\t\tgoto export_end;\n\t\t}\n\t    \tBIO_free(certsin);\n \t}\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n\tCRYPTO_push_info("building chain");\n#endif\n\tif (chain) {\n        \tint vret;\n\t\tSTACK_OF(X509) *chain2;\n\t\tX509_STORE *store = X509_STORE_new();\n\t\tif (!store)\n\t\t\t{\n\t\t\tBIO_printf (bio_err, "Memory allocation error\\n");\n\t\t\tgoto export_end;\n\t\t\t}\n\t\tif (!X509_STORE_load_locations(store, CAfile, CApath))\n\t\t\tX509_STORE_set_default_paths (store);\n\t\tvret = get_cert_chain (ucert, store, &chain2);\n\t\tX509_STORE_free(store);\n\t\tif (!vret) {\n\t\t    for (i = 1; i < sk_X509_num (chain2) ; i++)\n\t\t\tsk_X509_push(certs, sk_X509_value (chain2, i));\n\t\t}\n\t\tsk_X509_free(chain2);\n\t\tif (vret) {\n\t\t\tBIO_printf (bio_err, "Error %s getting chain.\\n",\n\t\t\t\t\tX509_verify_cert_error_string(vret));\n\t\t\tgoto export_end;\n\t\t}\n    \t}\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n\tCRYPTO_push_info("building bags");\n#endif\n\tfor(i = 0; i < sk_X509_num(certs); i++) {\n\t\tX509 *cert = NULL;\n\t\tcert = sk_X509_value(certs, i);\n\t\tbag = M_PKCS12_x5092certbag(cert);\n\t\tif(cert == ucert) {\n\t\t\tif(name) PKCS12_add_friendlyname(bag, name, -1);\n\t\t\tPKCS12_add_localkeyid(bag, keyid, keyidlen);\n\t\t} else if((catmp = sk_shift(canames)))\n\t\t\t\tPKCS12_add_friendlyname(bag, catmp, -1);\n\t\tsk_PKCS12_SAFEBAG_push(bags, bag);\n\t}\n\tsk_X509_pop_free(certs, X509_free);\n\tcerts = NULL;\n\tucert = NULL;\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n\tCRYPTO_push_info("encrypting bags");\n#endif\n\tif(!noprompt &&\n\t\tEVP_read_pw_string(pass, 50, "Enter Export Password:", 1)) {\n\t    BIO_printf (bio_err, "Can\'t read Password\\n");\n\t    goto export_end;\n        }\n\tif (!twopass) strcpy(macpass, pass);\n\tauthsafe = PKCS12_pack_p7encdata(cert_pbe, cpass, -1, NULL, 0,\n\t\t\t\t\t\t\t\t iter, bags);\n\tsk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);\n\tbags = NULL;\n\tif (!authsafe) {\n\t\tERR_print_errors (bio_err);\n\t\tgoto export_end;\n\t}\n\tsafes = sk_PKCS7_new_null ();\n\tsk_PKCS7_push (safes, authsafe);\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n\tCRYPTO_push_info("building shrouded key bag");\n#endif\n\tp8 = EVP_PKEY2PKCS8 (key);\n\tif(keytype) PKCS8_add_keyusage(p8, keytype);\n\tbag = PKCS12_MAKE_SHKEYBAG(key_pbe, cpass, -1, NULL, 0, iter, p8);\n\tPKCS8_PRIV_KEY_INFO_free(p8);\n\tp8 = NULL;\n        if (name) PKCS12_add_friendlyname (bag, name, -1);\n\tPKCS12_add_localkeyid (bag, keyid, keyidlen);\n\tbags = sk_PKCS12_SAFEBAG_new_null();\n\tsk_PKCS12_SAFEBAG_push (bags, bag);\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n\tCRYPTO_push_info("encrypting shrouded key bag");\n#endif\n\tauthsafe = PKCS12_pack_p7data (bags);\n\tsk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);\n\tbags = NULL;\n\tsk_PKCS7_push (safes, authsafe);\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n\tCRYPTO_push_info("building pkcs12");\n#endif\n\tp12 = PKCS12_init (NID_pkcs7_data);\n\tM_PKCS12_pack_authsafes (p12, safes);\n\tsk_PKCS7_pop_free(safes, PKCS7_free);\n\tsafes = NULL;\n\tPKCS12_set_mac (p12, mpass, -1, NULL, 0, maciter, NULL);\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n\tCRYPTO_push_info("writing pkcs12");\n#endif\n\ti2d_PKCS12_bio (out, p12);\n\tret = 0;\n    export_end:\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n\tCRYPTO_pop_info();\n\tCRYPTO_push_info("process -export_cert: freeing");\n#endif\n\tif (key) EVP_PKEY_free(key);\n\tif (certs) sk_X509_pop_free(certs, X509_free);\n\tif (safes) sk_PKCS7_pop_free(safes, PKCS7_free);\n\tif (bags) sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);\n\tif (ucert) X509_free(ucert);\n#ifdef CRYPTO_MDEBUG\n\tCRYPTO_pop_info();\n#endif\n\tgoto end;\n    }\n    if (!(p12 = d2i_PKCS12_bio (in, NULL))) {\n\tERR_print_errors(bio_err);\n\tgoto end;\n    }\n#ifdef CRYPTO_MDEBUG\n    CRYPTO_push_info("read import password");\n#endif\n    if(!noprompt && EVP_read_pw_string(pass, 50, "Enter Import Password:", 0)) {\n\tBIO_printf (bio_err, "Can\'t read Password\\n");\n\tgoto end;\n    }\n#ifdef CRYPTO_MDEBUG\n    CRYPTO_pop_info();\n#endif\n    if (!twopass) strcpy(macpass, pass);\n    if (options & INFO) BIO_printf (bio_err, "MAC Iteration %ld\\n", p12->mac->iter ? ASN1_INTEGER_get (p12->mac->iter) : 1);\n    if(macver) {\n#ifdef CRYPTO_MDEBUG\n    CRYPTO_push_info("verify MAC");\n#endif\n\tif(!macpass[0] && PKCS12_verify_mac(p12, NULL, 0)) {\n\t\tif(!twopass) cpass = NULL;\n\t} else if (!PKCS12_verify_mac(p12, mpass, -1)) {\n\t    BIO_printf (bio_err, "Mac verify error: invalid password?\\n");\n\t    ERR_print_errors (bio_err);\n\t    goto end;\n\t}\n\tBIO_printf (bio_err, "MAC verified OK\\n");\n#ifdef CRYPTO_MDEBUG\n    CRYPTO_pop_info();\n#endif\n    }\n#ifdef CRYPTO_MDEBUG\n    CRYPTO_push_info("output keys and certificates");\n#endif\n    if (!dump_certs_keys_p12 (out, p12, cpass, -1, options, passout)) {\n\tBIO_printf(bio_err, "Error outputting keys and certificates\\n");\n\tERR_print_errors (bio_err);\n\tgoto end;\n    }\n#ifdef CRYPTO_MDEBUG\n    CRYPTO_pop_info();\n#endif\n    ret = 0;\n end:\n    if (p12) PKCS12_free(p12);\n    if(export_cert || inrand) app_RAND_write_file(NULL, bio_err);\n#ifdef CRYPTO_MDEBUG\n    CRYPTO_remove_all_info();\n#endif\n    BIO_free(in);\n    BIO_free_all(out);\n    if (canames) sk_free(canames);\n    if(passin) OPENSSL_free(passin);\n    if(passout) OPENSSL_free(passout);\n    EXIT(ret);\n}', "int EVP_read_pw_string(char *buf, int len, const char *prompt, int verify)\n\t{\n#ifndef NO_DES\n\tif ((prompt == NULL) && (prompt_string[0] != '\\0'))\n\t\tprompt=prompt_string;\n\treturn(des_read_pw_string(buf,len,prompt,verify));\n#else\n\treturn -1;\n#endif\n\t}", 'int des_read_pw_string(char *buf, int length, const char *prompt,\n\t     int verify)\n\t{\n\tchar buff[BUFSIZ];\n\tint ret;\n\tret=des_read_pw(buf,buff,(length>BUFSIZ)?BUFSIZ:length,prompt,verify);\n\tmemset(buff,0,BUFSIZ);\n\treturn(ret);\n\t}', 'int des_read_pw(char *buf, char *buff, int size, const char *prompt,\n\t     int verify)\n\t{\n#ifdef VMS\n\tstruct IOSB iosb;\n\t$DESCRIPTOR(terminal,"TT");\n\tlong tty_orig[3], tty_new[3];\n\tlong status;\n\tunsigned short channel = 0;\n#else\n#ifndef MSDOS\n\tTTY_STRUCT tty_orig,tty_new;\n#endif\n#endif\n\tint number;\n\tint ok;\n\tstatic int ps;\n\tint is_a_tty;\n\tstatic FILE *tty;\n\tchar *p;\n\tif (setjmp(save))\n\t\t{\n\t\tok=0;\n\t\tgoto error;\n\t\t}\n\tnumber=5;\n\tok=0;\n\tps=0;\n\tis_a_tty=1;\n\ttty=NULL;\n#ifdef MSDOS\n\tif ((tty=fopen("con","r")) == NULL)\n\t\ttty=stdin;\n#elif defined(MAC_OS_pre_X)\n\ttty=stdin;\n#else\n#ifndef MPE\n\tif ((tty=fopen("/dev/tty","r")) == NULL)\n#endif\n\t\ttty=stdin;\n#endif\n#if defined(TTY_get) && !defined(VMS)\n\tif (TTY_get(fileno(tty),&tty_orig) == -1)\n\t\t{\n#ifdef ENOTTY\n\t\tif (errno == ENOTTY)\n\t\t\tis_a_tty=0;\n\t\telse\n#endif\n#ifdef EINVAL\n\t\tif (errno == EINVAL)\n\t\t\tis_a_tty=0;\n\t\telse\n#endif\n\t\t\treturn(-1);\n\t\t}\n\tmemcpy(&(tty_new),&(tty_orig),sizeof(tty_orig));\n#endif\n#ifdef VMS\n\tstatus = sys$assign(&terminal,&channel,0,0);\n\tif (status != SS$_NORMAL)\n\t\treturn(-1);\n\tstatus=sys$qiow(0,channel,IO$_SENSEMODE,&iosb,0,0,tty_orig,12,0,0,0,0);\n\tif ((status != SS$_NORMAL) || (iosb.iosb$w_value != SS$_NORMAL))\n\t\treturn(-1);\n#endif\n\tpushsig();\n\tps=1;\n#ifdef TTY_FLAGS\n\ttty_new.TTY_FLAGS &= ~ECHO;\n#endif\n#if defined(TTY_set) && !defined(VMS)\n\tif (is_a_tty && (TTY_set(fileno(tty),&tty_new) == -1))\n#ifdef MPE\n\t\t;\n#else\n\t\treturn(-1);\n#endif\n#endif\n#ifdef VMS\n\ttty_new[0] = tty_orig[0];\n\ttty_new[1] = tty_orig[1] | TT$M_NOECHO;\n\ttty_new[2] = tty_orig[2];\n\tstatus = sys$qiow(0,channel,IO$_SETMODE,&iosb,0,0,tty_new,12,0,0,0,0);\n\tif ((status != SS$_NORMAL) || (iosb.iosb$w_value != SS$_NORMAL))\n\t\treturn(-1);\n#endif\n\tps=2;\n\twhile ((!ok) && (number--))\n\t\t{\n\t\tfputs(prompt,stderr);\n\t\tfflush(stderr);\n\t\tbuf[0]=\'\\0\';\n\t\tfgets(buf,size,tty);\n\t\tif (feof(tty)) goto error;\n\t\tif (ferror(tty)) goto error;\n\t\tif ((p=(char *)strchr(buf,\'\\n\')) != NULL)\n\t\t\t*p=\'\\0\';\n\t\telse\tread_till_nl(tty);\n\t\tif (verify)\n\t\t\t{\n\t\t\tfprintf(stderr,"\\nVerifying password - %s",prompt);\n\t\t\tfflush(stderr);\n\t\t\tbuff[0]=\'\\0\';\n\t\t\tfgets(buff,size,tty);\n\t\t\tif (feof(tty)) goto error;\n\t\t\tif ((p=(char *)strchr(buff,\'\\n\')) != NULL)\n\t\t\t\t*p=\'\\0\';\n\t\t\telse\tread_till_nl(tty);\n\t\t\tif (strcmp(buf,buff) != 0)\n\t\t\t\t{\n\t\t\t\tfprintf(stderr,"\\nVerify failure");\n\t\t\t\tfflush(stderr);\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\tok=1;\n\t\t}\nerror:\n\tfprintf(stderr,"\\n");\n#ifdef DEBUG\n\tperror("fgets(tty)");\n#endif\n#if defined(TTY_set) && !defined(VMS)\n\tif (ps >= 2) TTY_set(fileno(tty),&tty_orig);\n#endif\n#ifdef VMS\n\tif (ps >= 2)\n\t\tstatus = sys$qiow(0,channel,IO$_SETMODE,&iosb,0,0\n\t\t\t,tty_orig,12,0,0,0,0);\n#endif\n\tif (ps >= 1) popsig();\n\tif (stdin != tty) fclose(tty);\n#ifdef VMS\n\tstatus = sys$dassgn(channel);\n#endif\n\treturn(!ok);\n\t}']