apps/ca.c:1269: error: BUFFER_OVERRUN_L3
  Offset: [0, 5] Size: [1, +oo] by call to `do_revoke`.
Showing all 11 steps of the trace


apps/ca.c:696:10: Call
694.           goto end;
695.       }
696.       db = load_index(dbfile, &db_attr);
                ^
697.       if (db == NULL)
698.           goto end;

apps/apps.c:1575:18: Call
  1573.           goto err;
  1574.       }
  1575.       if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
                           ^
  1576.           goto err;
  1577.   

crypto/txt_db/txt_db.c:89:5: Assignment
    87.           goto err;
    88.       ret->num_fields = num;
    89.       ret->index = NULL;
              ^
    90.       ret->qual = NULL;
    91.       if ((ret->data = sk_OPENSSL_PSTRING_new_null()) == NULL)

apps/ca.c:1269:17: Call
1267.               if (dorevoke == 2)
1268.                   rev_type = -1;
1269.               j = do_revoke(revcert, db, rev_type, rev_arg);
                        ^
1270.               if (j <= 0)
1271.                   goto end;

apps/ca.c:2099:1: Parameter `*db->db->index`
  2097.   }
  2098.   
  2099. > static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)
  2100.   {
  2101.       ASN1_UTCTIME *tm = NULL;

apps/ca.c:2148:14: Call
  2146.           irow[DB_NUMBER] = NULL;
  2147.   
  2148.           if (!TXT_DB_insert(db->db, irow)) {
                       ^
  2149.               BIO_printf(bio_err, "failed to update database\n");
  2150.               BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);

crypto/txt_db/txt_db.c:278:1: <Offset trace>
276.   }
277.   
278. > int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
279.   {
280.       int i;

crypto/txt_db/txt_db.c:278:1: Parameter `db->num_fields`
    276.   }
    277.   
    278. > int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
    279.   {
    280.       int i;

crypto/txt_db/txt_db.c:278:1: <Length trace>
276.   }
277.   
278. > int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
279.   {
280.       int i;

crypto/txt_db/txt_db.c:278:1: Parameter `*db->index`
    276.   }
    277.   
    278. > int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
    279.   {
    280.       int i;

crypto/txt_db/txt_db.c:284:13: Array access: Offset: [0, 5] Size: [1, +oo] by call to `do_revoke` 
    282.   
    283.       for (i = 0; i < db->num_fields; i++) {
    284.           if (db->index[i] != NULL) {
                       ^
    285.               if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))
    286.                   continue;

int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
{
    int i;
    OPENSSL_STRING *r;
    for (i = 0; i < db->num_fields; i++) {
        if (db->index[i] != NULL) {
            if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))
                continue;
            r = lh_OPENSSL_STRING_retrieve(db->index[i], row);
            if (r != NULL) {
                db->error = DB_ERROR_INDEX_CLASH;
                db->arg1 = i;
                db->arg_row = r;
                goto err;
            }
        }
    }
    if (!sk_OPENSSL_PSTRING_push(db->data, row)) {
        db->error = DB_ERROR_MALLOC;
        goto err;
    }
    for (i = 0; i < db->num_fields; i++) {
        if (db->index[i] != NULL) {
            if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))
                continue;
            (void)lh_OPENSSL_STRING_insert(db->index[i], row);
        }
    }
    return (1);
 err:
    return (0);
}
['int ca_main(int argc, char **argv)\n{\n    ENGINE *e = NULL;\n    BIGNUM *crlnumber = NULL, *serial = NULL;\n    EVP_PKEY *pkey = NULL;\n    BIO *in = NULL, *out = NULL, *Sout = NULL, *Cout = NULL;\n    ASN1_INTEGER *tmpser;\n    ASN1_TIME *tmptm;\n    CA_DB *db = NULL;\n    DB_ATTR db_attr;\n    STACK_OF(CONF_VALUE) *attribs = NULL;\n    STACK_OF(OPENSSL_STRING) *sigopts = NULL;\n    STACK_OF(X509) *cert_sk = NULL;\n    X509_CRL *crl = NULL;\n    const EVP_MD *dgst = NULL;\n    char *configfile = default_config_file;\n    char *md = NULL, *policy = NULL, *keyfile = NULL;\n    char *certfile = NULL, *crl_ext = NULL, *crlnumberfile = NULL;\n    char *infile = NULL, *spkac_file = NULL, *ss_cert_file = NULL;\n    char *extensions = NULL, *extfile = NULL, *key = NULL, *passinarg = NULL;\n    char *outdir = NULL, *outfile = NULL, *rev_arg = NULL, *ser_status = NULL;\n    char *serialfile = NULL, *startdate = NULL, *subj = NULL;\n    char *prog, *enddate = NULL, *tmp_email_dn = NULL;\n    char *dbfile = NULL, *f, *randfile = NULL, *tofree = NULL;\n    char buf[3][BSIZE];\n    char *const *pp;\n    const char *p;\n    int create_ser = 0, free_key = 0, total = 0, total_done = 0;\n    int batch = 0, default_op = 1, doupdatedb = 0, ext_copy = EXT_COPY_NONE;\n    int keyformat = FORMAT_PEM, multirdn = 0, notext = 0, output_der = 0;\n    int ret = 1, email_dn = 1, req = 0, verbose = 0, gencrl = 0, dorevoke = 0;\n    int i, j, rev_type = REV_NONE, selfsign = 0;\n    long crldays = 0, crlhours = 0, crlsec = 0, days = 0;\n    unsigned long chtype = MBSTRING_ASC, nameopt = 0, certopt = 0;\n    X509 *x509 = NULL, *x509p = NULL, *x = NULL;\n    X509_REVOKED *r = NULL;\n    OPTION_CHOICE o;\n    conf = NULL;\n    section = NULL;\n    preserve = 0;\n    msie_hack = 0;\n    prog = opt_init(argc, argv, ca_options);\n    while ((o = opt_next()) != OPT_EOF) {\n        switch (o) {\n            case OPT_EOF:\n            case OPT_ERR:\nopthelp:\n                BIO_printf(bio_err, "%s: Use -help for summary.\\n", prog);\n                goto end;\n            case OPT_HELP:\n                opt_help(ca_options);\n                ret = 0;\n                goto end;\n            case OPT_IN:\n                req = 1;\n                infile = opt_arg();\n                break;\n            case OPT_OUT:\n                outfile = opt_arg();\n                break;\n            case OPT_VERBOSE:\n                verbose = 1;\n                break;\n            case OPT_CONFIG:\n                configfile = opt_arg();\n                break;\n            case OPT_NAME:\n                section = opt_arg();\n                break;\n            case OPT_SUBJ:\n                subj = opt_arg();\n                break;\n            case OPT_UTF8:\n                chtype = MBSTRING_UTF8;\n                break;\n        case OPT_CREATE_SERIAL:\n            create_ser = 1;\n            break;\n        case OPT_MULTIVALUE_RDN:\n            multirdn = 1;\n            break;\n        case OPT_STARTDATE:\n            startdate = opt_arg();\n            break;\n        case OPT_ENDDATE:\n            enddate = opt_arg();\n            break;\n        case OPT_DAYS:\n            days = atoi(opt_arg());\n            break;\n        case OPT_MD:\n            md = opt_arg();\n            break;\n        case OPT_POLICY:\n            policy = opt_arg();\n            break;\n        case OPT_KEYFILE:\n            keyfile = opt_arg();\n            break;\n        case OPT_KEYFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyformat))\n                goto opthelp;\n            break;\n        case OPT_PASSIN:\n            passinarg = opt_arg();\n            break;\n        case OPT_KEY:\n            key = opt_arg();\n            break;\n        case OPT_CERT:\n            certfile = opt_arg();\n            break;\n        case OPT_SELFSIGN:\n            selfsign = 1;\n            break;\n        case OPT_OUTDIR:\n            outdir = opt_arg();\n            break;\n        case OPT_SIGOPT:\n            if (sigopts == NULL)\n                sigopts = sk_OPENSSL_STRING_new_null();\n            if (sigopts == NULL\n                || !sk_OPENSSL_STRING_push(sigopts, opt_arg()))\n                goto end;\n            break;\n        case OPT_NOTEXT:\n            notext = 1;\n            break;\n        case OPT_BATCH:\n            batch = 1;\n            break;\n        case OPT_PRESERVEDN:\n            preserve = 1;\n            break;\n        case OPT_NOEMAILDN:\n            email_dn = 0;\n            break;\n        case OPT_GENCRL:\n            gencrl = 1;\n            break;\n        case OPT_MSIE_HACK:\n            msie_hack = 1;\n            break;\n        case OPT_CRLDAYS:\n            crldays = atol(opt_arg());\n            break;\n        case OPT_CRLHOURS:\n            crlhours = atol(opt_arg());\n            break;\n        case OPT_CRLSEC:\n            crlsec = atol(opt_arg());\n            break;\n        case OPT_INFILES:\n            req = 1;\n            goto end_of_options;\n        case OPT_SS_CERT:\n            ss_cert_file = opt_arg();\n            req = 1;\n            break;\n        case OPT_SPKAC:\n            spkac_file = opt_arg();\n            req = 1;\n            break;\n        case OPT_REVOKE:\n            infile = opt_arg();\n            dorevoke = 1;\n            break;\n        case OPT_VALID:\n            infile = opt_arg();\n            dorevoke = 2;\n            break;\n        case OPT_EXTENSIONS:\n            extensions = opt_arg();\n            break;\n        case OPT_EXTFILE:\n            extfile = opt_arg();\n            break;\n        case OPT_STATUS:\n            ser_status = opt_arg();\n            break;\n        case OPT_UPDATEDB:\n            doupdatedb = 1;\n            break;\n        case OPT_CRLEXTS:\n            crl_ext = opt_arg();\n            break;\n        case OPT_CRL_REASON:\n            rev_arg = opt_arg();\n            rev_type = REV_CRL_REASON;\n            break;\n        case OPT_CRL_HOLD:\n            rev_arg = opt_arg();\n            rev_type = REV_HOLD;\n            break;\n        case OPT_CRL_COMPROMISE:\n            rev_arg = opt_arg();\n            rev_type = REV_KEY_COMPROMISE;\n            break;\n        case OPT_CRL_CA_COMPROMISE:\n            rev_arg = opt_arg();\n            rev_type = REV_CA_COMPROMISE;\n            break;\n        case OPT_ENGINE:\n            e = setup_engine(opt_arg(), 0);\n            break;\n        }\n    }\nend_of_options:\n    argc = opt_num_rest();\n    argv = opt_rest();\n    BIO_printf(bio_err, "Using configuration from %s\\n", configfile);\n    if (configfile != default_config_file) {\n        if ((conf = app_load_config(configfile)) == NULL)\n            goto end;\n        if (!app_load_modules(conf))\n            goto end;\n    }\n    if (section == NULL) {\n        section = NCONF_get_string(conf, BASE_SECTION, ENV_DEFAULT_CA);\n        if (section == NULL) {\n            lookup_fail(BASE_SECTION, ENV_DEFAULT_CA);\n            goto end;\n        }\n    }\n    if (conf != NULL) {\n        p = NCONF_get_string(conf, NULL, "oid_file");\n        if (p == NULL)\n            ERR_clear_error();\n        if (p != NULL) {\n            BIO *oid_bio;\n            oid_bio = BIO_new_file(p, "r");\n            if (oid_bio == NULL) {\n                ERR_clear_error();\n            } else {\n                OBJ_create_objects(oid_bio);\n                BIO_free(oid_bio);\n            }\n        }\n        if (!add_oid_section(conf)) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    randfile = NCONF_get_string(conf, BASE_SECTION, "RANDFILE");\n    if (randfile == NULL)\n        ERR_clear_error();\n    app_RAND_load_file(randfile, 0);\n    f = NCONF_get_string(conf, section, STRING_MASK);\n    if (!f)\n        ERR_clear_error();\n    if (f && !ASN1_STRING_set_default_mask_asc(f)) {\n        BIO_printf(bio_err, "Invalid global string mask setting %s\\n", f);\n        goto end;\n    }\n    if (chtype != MBSTRING_UTF8) {\n        f = NCONF_get_string(conf, section, UTF8_IN);\n        if (!f)\n            ERR_clear_error();\n        else if (strcmp(f, "yes") == 0)\n            chtype = MBSTRING_UTF8;\n    }\n    db_attr.unique_subject = 1;\n    p = NCONF_get_string(conf, section, ENV_UNIQUE_SUBJECT);\n    if (p) {\n        db_attr.unique_subject = parse_yesno(p, 1);\n    } else\n        ERR_clear_error();\n    if (ser_status) {\n        if ((dbfile = NCONF_get_string(conf, section, ENV_DATABASE)) == NULL) {\n            lookup_fail(section, ENV_DATABASE);\n            goto end;\n        }\n        db = load_index(dbfile, &db_attr);\n        if (db == NULL)\n            goto end;\n        if (!index_index(db))\n            goto end;\n        if (get_certificate_status(ser_status, db) != 1)\n            BIO_printf(bio_err, "Error verifying serial %s!\\n", ser_status);\n        goto end;\n    }\n    if ((keyfile == NULL) && ((keyfile = NCONF_get_string(conf,\n                                                          section,\n                                                          ENV_PRIVATE_KEY)) ==\n                              NULL)) {\n        lookup_fail(section, ENV_PRIVATE_KEY);\n        goto end;\n    }\n    if (!key) {\n        free_key = 1;\n        if (!app_passwd(passinarg, NULL, &key, NULL)) {\n            BIO_printf(bio_err, "Error getting password\\n");\n            goto end;\n        }\n    }\n    pkey = load_key(keyfile, keyformat, 0, key, e, "CA private key");\n    if (key)\n        OPENSSL_cleanse(key, strlen(key));\n    if (pkey == NULL) {\n        goto end;\n    }\n    if (!selfsign || spkac_file || ss_cert_file || gencrl) {\n        if ((certfile == NULL)\n            && ((certfile = NCONF_get_string(conf,\n                                             section,\n                                             ENV_CERTIFICATE)) == NULL)) {\n            lookup_fail(section, ENV_CERTIFICATE);\n            goto end;\n        }\n        x509 = load_cert(certfile, FORMAT_PEM, NULL, e, "CA certificate");\n        if (x509 == NULL)\n            goto end;\n        if (!X509_check_private_key(x509, pkey)) {\n            BIO_printf(bio_err,\n                       "CA certificate and CA private key do not match\\n");\n            goto end;\n        }\n    }\n    if (!selfsign)\n        x509p = x509;\n    f = NCONF_get_string(conf, BASE_SECTION, ENV_PRESERVE);\n    if (f == NULL)\n        ERR_clear_error();\n    if ((f != NULL) && ((*f == \'y\') || (*f == \'Y\')))\n        preserve = 1;\n    f = NCONF_get_string(conf, BASE_SECTION, ENV_MSIE_HACK);\n    if (f == NULL)\n        ERR_clear_error();\n    if ((f != NULL) && ((*f == \'y\') || (*f == \'Y\')))\n        msie_hack = 1;\n    f = NCONF_get_string(conf, section, ENV_NAMEOPT);\n    if (f) {\n        if (!set_name_ex(&nameopt, f)) {\n            BIO_printf(bio_err, "Invalid name options: \\"%s\\"\\n", f);\n            goto end;\n        }\n        default_op = 0;\n    } else {\n        nameopt = XN_FLAG_ONELINE;\n        ERR_clear_error();\n    }\n    f = NCONF_get_string(conf, section, ENV_CERTOPT);\n    if (f) {\n        if (!set_cert_ex(&certopt, f)) {\n            BIO_printf(bio_err, "Invalid certificate options: \\"%s\\"\\n", f);\n            goto end;\n        }\n        default_op = 0;\n    } else\n        ERR_clear_error();\n    f = NCONF_get_string(conf, section, ENV_EXTCOPY);\n    if (f) {\n        if (!set_ext_copy(&ext_copy, f)) {\n            BIO_printf(bio_err, "Invalid extension copy option: \\"%s\\"\\n", f);\n            goto end;\n        }\n    } else\n        ERR_clear_error();\n    if ((outdir == NULL) && (req)) {\n        if ((outdir = NCONF_get_string(conf, section, ENV_NEW_CERTS_DIR))\n            == NULL) {\n            BIO_printf(bio_err,\n                       "there needs to be defined a directory for new certificate to be placed in\\n");\n            goto end;\n        }\n#ifndef OPENSSL_SYS_VMS\n        if (app_isdir(outdir) <= 0) {\n            BIO_printf(bio_err, "%s: %s is not a directory\\n", prog, outdir);\n            perror(outdir);\n            goto end;\n        }\n#endif\n    }\n    if ((dbfile = NCONF_get_string(conf, section, ENV_DATABASE)) == NULL) {\n        lookup_fail(section, ENV_DATABASE);\n        goto end;\n    }\n    db = load_index(dbfile, &db_attr);\n    if (db == NULL)\n        goto end;\n    for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {\n        pp = sk_OPENSSL_PSTRING_value(db->db->data, i);\n        if ((pp[DB_type][0] != DB_TYPE_REV) && (pp[DB_rev_date][0] != \'\\0\')) {\n            BIO_printf(bio_err,\n                       "entry %d: not revoked yet, but has a revocation date\\n",\n                       i + 1);\n            goto end;\n        }\n        if ((pp[DB_type][0] == DB_TYPE_REV) &&\n            !make_revoked(NULL, pp[DB_rev_date])) {\n            BIO_printf(bio_err, " in entry %d\\n", i + 1);\n            goto end;\n        }\n        if (!check_time_format((char *)pp[DB_exp_date])) {\n            BIO_printf(bio_err, "entry %d: invalid expiry date\\n", i + 1);\n            goto end;\n        }\n        p = pp[DB_serial];\n        j = strlen(p);\n        if (*p == \'-\') {\n            p++;\n            j--;\n        }\n        if ((j & 1) || (j < 2)) {\n            BIO_printf(bio_err, "entry %d: bad serial number length (%d)\\n",\n                       i + 1, j);\n            goto end;\n        }\n        for ( ; *p; p++) {\n            if (!isxdigit(*p)) {\n                BIO_printf(bio_err,\n                           "entry %d: bad char 0%o \'%c\' in serial number\\n",\n                           i + 1, *p, *p);\n                goto end;\n            }\n        }\n    }\n    if (verbose) {\n        TXT_DB_write(bio_out, db->db);\n        BIO_printf(bio_err, "%d entries loaded from the database\\n",\n                   sk_OPENSSL_PSTRING_num(db->db->data));\n        BIO_printf(bio_err, "generating index\\n");\n    }\n    if (!index_index(db))\n        goto end;\n    if (doupdatedb) {\n        if (verbose)\n            BIO_printf(bio_err, "Updating %s ...\\n", dbfile);\n        i = do_updatedb(db);\n        if (i == -1) {\n            BIO_printf(bio_err, "Malloc failure\\n");\n            goto end;\n        } else if (i == 0) {\n            if (verbose)\n                BIO_printf(bio_err, "No entries found to mark expired\\n");\n        } else {\n            if (!save_index(dbfile, "new", db))\n                goto end;\n            if (!rotate_index(dbfile, "new", "old"))\n                goto end;\n            if (verbose)\n                BIO_printf(bio_err,\n                           "Done. %d entries marked as expired\\n", i);\n        }\n    }\n    if (extfile) {\n        if ((extconf = app_load_config(extfile)) == NULL) {\n            ret = 1;\n            goto end;\n        }\n        if (verbose)\n            BIO_printf(bio_err, "Successfully loaded extensions file %s\\n",\n                       extfile);\n        if (!extensions\n            && !(extensions =\n                 NCONF_get_string(extconf, "default", "extensions")))\n            extensions = "default";\n    }\n    if (req || gencrl) {\n        Sout = bio_open_default(outfile, \'w\', FORMAT_TEXT);\n        if (Sout == NULL)\n            goto end;\n    }\n    if ((md == NULL) && ((md = NCONF_get_string(conf,\n                                                section,\n                                                ENV_DEFAULT_MD)) == NULL)) {\n        lookup_fail(section, ENV_DEFAULT_MD);\n        goto end;\n    }\n    if (strcmp(md, "default") == 0) {\n        int def_nid;\n        if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) {\n            BIO_puts(bio_err, "no default digest\\n");\n            goto end;\n        }\n        md = (char *)OBJ_nid2sn(def_nid);\n    }\n    if (!opt_md(md, &dgst)) {\n        goto end;\n    }\n    if (req) {\n        if ((email_dn == 1) && ((tmp_email_dn = NCONF_get_string(conf,\n                                                                 section,\n                                                                 ENV_DEFAULT_EMAIL_DN))\n                                != NULL)) {\n            if (strcmp(tmp_email_dn, "no") == 0)\n                email_dn = 0;\n        }\n        if (verbose)\n            BIO_printf(bio_err, "message digest is %s\\n",\n                       OBJ_nid2ln(EVP_MD_type(dgst)));\n        if ((policy == NULL) && ((policy = NCONF_get_string(conf,\n                                                            section,\n                                                            ENV_POLICY)) ==\n                                 NULL)) {\n            lookup_fail(section, ENV_POLICY);\n            goto end;\n        }\n        if (verbose)\n            BIO_printf(bio_err, "policy is %s\\n", policy);\n        if ((serialfile = NCONF_get_string(conf, section, ENV_SERIAL))\n            == NULL) {\n            lookup_fail(section, ENV_SERIAL);\n            goto end;\n        }\n        if (!extconf) {\n            if (!extensions) {\n                extensions = NCONF_get_string(conf, section, ENV_EXTENSIONS);\n                if (!extensions)\n                    ERR_clear_error();\n            }\n            if (extensions) {\n                X509V3_CTX ctx;\n                X509V3_set_ctx_test(&ctx);\n                X509V3_set_nconf(&ctx, conf);\n                if (!X509V3_EXT_add_nconf(conf, &ctx, extensions, NULL)) {\n                    BIO_printf(bio_err,\n                               "Error Loading extension section %s\\n",\n                               extensions);\n                    ret = 1;\n                    goto end;\n                }\n            }\n        }\n        if (startdate == NULL) {\n            startdate = NCONF_get_string(conf, section,\n                                         ENV_DEFAULT_STARTDATE);\n            if (startdate == NULL)\n                ERR_clear_error();\n        }\n        if (startdate && !ASN1_TIME_set_string(NULL, startdate)) {\n            BIO_printf(bio_err,\n                       "start date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\\n");\n            goto end;\n        }\n        if (startdate == NULL)\n            startdate = "today";\n        if (enddate == NULL) {\n            enddate = NCONF_get_string(conf, section, ENV_DEFAULT_ENDDATE);\n            if (enddate == NULL)\n                ERR_clear_error();\n        }\n        if (enddate && !ASN1_TIME_set_string(NULL, enddate)) {\n            BIO_printf(bio_err,\n                       "end date is invalid, it should be YYMMDDHHMMSSZ or YYYYMMDDHHMMSSZ\\n");\n            goto end;\n        }\n        if (days == 0) {\n            if (!NCONF_get_number(conf, section, ENV_DEFAULT_DAYS, &days))\n                days = 0;\n        }\n        if (!enddate && (days == 0)) {\n            BIO_printf(bio_err,\n                       "cannot lookup how many days to certify for\\n");\n            goto end;\n        }\n        if ((serial = load_serial(serialfile, create_ser, NULL)) == NULL) {\n            BIO_printf(bio_err, "error while loading serial number\\n");\n            goto end;\n        }\n        if (verbose) {\n            if (BN_is_zero(serial))\n                BIO_printf(bio_err, "next serial number is 00\\n");\n            else {\n                if ((f = BN_bn2hex(serial)) == NULL)\n                    goto end;\n                BIO_printf(bio_err, "next serial number is %s\\n", f);\n                OPENSSL_free(f);\n            }\n        }\n        if ((attribs = NCONF_get_section(conf, policy)) == NULL) {\n            BIO_printf(bio_err, "unable to find \'section\' for %s\\n", policy);\n            goto end;\n        }\n        if ((cert_sk = sk_X509_new_null()) == NULL) {\n            BIO_printf(bio_err, "Memory allocation failure\\n");\n            goto end;\n        }\n        if (spkac_file != NULL) {\n            total++;\n            j = certify_spkac(&x, spkac_file, pkey, x509, dgst, sigopts,\n                              attribs, db, serial, subj, chtype, multirdn,\n                              email_dn, startdate, enddate, days, extensions,\n                              conf, verbose, certopt, nameopt, default_op,\n                              ext_copy);\n            if (j < 0)\n                goto end;\n            if (j > 0) {\n                total_done++;\n                BIO_printf(bio_err, "\\n");\n                if (!BN_add_word(serial, 1))\n                    goto end;\n                if (!sk_X509_push(cert_sk, x)) {\n                    BIO_printf(bio_err, "Memory allocation failure\\n");\n                    goto end;\n                }\n                if (outfile) {\n                    output_der = 1;\n                    batch = 1;\n                }\n            }\n        }\n        if (ss_cert_file != NULL) {\n            total++;\n            j = certify_cert(&x, ss_cert_file, pkey, x509, dgst, sigopts,\n                             attribs,\n                             db, serial, subj, chtype, multirdn, email_dn,\n                             startdate, enddate, days, batch, extensions,\n                             conf, verbose, certopt, nameopt, default_op,\n                             ext_copy, e);\n            if (j < 0)\n                goto end;\n            if (j > 0) {\n                total_done++;\n                BIO_printf(bio_err, "\\n");\n                if (!BN_add_word(serial, 1))\n                    goto end;\n                if (!sk_X509_push(cert_sk, x)) {\n                    BIO_printf(bio_err, "Memory allocation failure\\n");\n                    goto end;\n                }\n            }\n        }\n        if (infile != NULL) {\n            total++;\n            j = certify(&x, infile, pkey, x509p, dgst, sigopts, attribs, db,\n                        serial, subj, chtype, multirdn, email_dn, startdate,\n                        enddate, days, batch, extensions, conf, verbose,\n                        certopt, nameopt, default_op, ext_copy, selfsign);\n            if (j < 0)\n                goto end;\n            if (j > 0) {\n                total_done++;\n                BIO_printf(bio_err, "\\n");\n                if (!BN_add_word(serial, 1))\n                    goto end;\n                if (!sk_X509_push(cert_sk, x)) {\n                    BIO_printf(bio_err, "Memory allocation failure\\n");\n                    goto end;\n                }\n            }\n        }\n        for (i = 0; i < argc; i++) {\n            total++;\n            j = certify(&x, argv[i], pkey, x509p, dgst, sigopts, attribs, db,\n                        serial, subj, chtype, multirdn, email_dn, startdate,\n                        enddate, days, batch, extensions, conf, verbose,\n                        certopt, nameopt, default_op, ext_copy, selfsign);\n            if (j < 0)\n                goto end;\n            if (j > 0) {\n                total_done++;\n                BIO_printf(bio_err, "\\n");\n                if (!BN_add_word(serial, 1))\n                    goto end;\n                if (!sk_X509_push(cert_sk, x)) {\n                    BIO_printf(bio_err, "Memory allocation failure\\n");\n                    goto end;\n                }\n            }\n        }\n        if (sk_X509_num(cert_sk) > 0) {\n            if (!batch) {\n                BIO_printf(bio_err,\n                           "\\n%d out of %d certificate requests certified, commit? [y/n]",\n                           total_done, total);\n                (void)BIO_flush(bio_err);\n                buf[0][0] = \'\\0\';\n                if (!fgets(buf[0], 10, stdin)) {\n                    BIO_printf(bio_err,\n                               "CERTIFICATION CANCELED: I/O error\\n");\n                    ret = 0;\n                    goto end;\n                }\n                if ((buf[0][0] != \'y\') && (buf[0][0] != \'Y\')) {\n                    BIO_printf(bio_err, "CERTIFICATION CANCELED\\n");\n                    ret = 0;\n                    goto end;\n                }\n            }\n            BIO_printf(bio_err, "Write out database with %d new entries\\n",\n                       sk_X509_num(cert_sk));\n            if (!save_serial(serialfile, "new", serial, NULL))\n                goto end;\n            if (!save_index(dbfile, "new", db))\n                goto end;\n        }\n        if (verbose)\n            BIO_printf(bio_err, "writing new certificates\\n");\n        for (i = 0; i < sk_X509_num(cert_sk); i++) {\n            ASN1_INTEGER *serialNumber = X509_get_serialNumber(x);\n            int k;\n            char *n;\n            x = sk_X509_value(cert_sk, i);\n            j = ASN1_STRING_length(serialNumber);\n            p = (const char *)ASN1_STRING_data(serialNumber);\n            if (strlen(outdir) >= (size_t)(j ? BSIZE - j * 2 - 6 : BSIZE - 8)) {\n                BIO_printf(bio_err, "certificate file name too long\\n");\n                goto end;\n            }\n            strcpy(buf[2], outdir);\n#ifndef OPENSSL_SYS_VMS\n            OPENSSL_strlcat(buf[2], "/", sizeof(buf[2]));\n#endif\n            n = (char *)&(buf[2][strlen(buf[2])]);\n            if (j > 0) {\n                for (k = 0; k < j; k++) {\n                    if (n >= &(buf[2][sizeof(buf[2])]))\n                        break;\n                    BIO_snprintf(n,\n                                 &buf[2][0] + sizeof(buf[2]) - n,\n                                 "%02X", (unsigned char)*(p++));\n                    n += 2;\n                }\n            } else {\n                *(n++) = \'0\';\n                *(n++) = \'0\';\n            }\n            *(n++) = \'.\';\n            *(n++) = \'p\';\n            *(n++) = \'e\';\n            *(n++) = \'m\';\n            *n = \'\\0\';\n            if (verbose)\n                BIO_printf(bio_err, "writing %s\\n", buf[2]);\n            Cout = BIO_new_file(buf[2], "w");\n            if (Cout == NULL) {\n                perror(buf[2]);\n                goto end;\n            }\n            write_new_certificate(Cout, x, 0, notext);\n            write_new_certificate(Sout, x, output_der, notext);\n        }\n        if (sk_X509_num(cert_sk)) {\n            if (!rotate_serial(serialfile, "new", "old"))\n                goto end;\n            if (!rotate_index(dbfile, "new", "old"))\n                goto end;\n            BIO_printf(bio_err, "Data Base Updated\\n");\n        }\n    }\n    if (gencrl) {\n        int crl_v2 = 0;\n        if (!crl_ext) {\n            crl_ext = NCONF_get_string(conf, section, ENV_CRLEXT);\n            if (!crl_ext)\n                ERR_clear_error();\n        }\n        if (crl_ext) {\n            X509V3_CTX ctx;\n            X509V3_set_ctx_test(&ctx);\n            X509V3_set_nconf(&ctx, conf);\n            if (!X509V3_EXT_add_nconf(conf, &ctx, crl_ext, NULL)) {\n                BIO_printf(bio_err,\n                           "Error Loading CRL extension section %s\\n",\n                           crl_ext);\n                ret = 1;\n                goto end;\n            }\n        }\n        if ((crlnumberfile = NCONF_get_string(conf, section, ENV_CRLNUMBER))\n            != NULL)\n            if ((crlnumber = load_serial(crlnumberfile, 0, NULL)) == NULL) {\n                BIO_printf(bio_err, "error while loading CRL number\\n");\n                goto end;\n            }\n        if (!crldays && !crlhours && !crlsec) {\n            if (!NCONF_get_number(conf, section,\n                                  ENV_DEFAULT_CRL_DAYS, &crldays))\n                crldays = 0;\n            if (!NCONF_get_number(conf, section,\n                                  ENV_DEFAULT_CRL_HOURS, &crlhours))\n                crlhours = 0;\n            ERR_clear_error();\n        }\n        if ((crldays == 0) && (crlhours == 0) && (crlsec == 0)) {\n            BIO_printf(bio_err,\n                       "cannot lookup how long until the next CRL is issued\\n");\n            goto end;\n        }\n        if (verbose)\n            BIO_printf(bio_err, "making CRL\\n");\n        if ((crl = X509_CRL_new()) == NULL)\n            goto end;\n        if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509)))\n            goto end;\n        tmptm = ASN1_TIME_new();\n        if (tmptm == NULL)\n            goto end;\n        X509_gmtime_adj(tmptm, 0);\n        X509_CRL_set_lastUpdate(crl, tmptm);\n        if (!X509_time_adj_ex(tmptm, crldays, crlhours * 60 * 60 + crlsec,\n                              NULL)) {\n            BIO_puts(bio_err, "error setting CRL nextUpdate\\n");\n            goto end;\n        }\n        X509_CRL_set_nextUpdate(crl, tmptm);\n        ASN1_TIME_free(tmptm);\n        for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++) {\n            pp = sk_OPENSSL_PSTRING_value(db->db->data, i);\n            if (pp[DB_type][0] == DB_TYPE_REV) {\n                if ((r = X509_REVOKED_new()) == NULL)\n                    goto end;\n                j = make_revoked(r, pp[DB_rev_date]);\n                if (!j)\n                    goto end;\n                if (j == 2)\n                    crl_v2 = 1;\n                if (!BN_hex2bn(&serial, pp[DB_serial]))\n                    goto end;\n                tmpser = BN_to_ASN1_INTEGER(serial, NULL);\n                BN_free(serial);\n                serial = NULL;\n                if (!tmpser)\n                    goto end;\n                X509_REVOKED_set_serialNumber(r, tmpser);\n                ASN1_INTEGER_free(tmpser);\n                X509_CRL_add0_revoked(crl, r);\n            }\n        }\n        X509_CRL_sort(crl);\n        if (verbose)\n            BIO_printf(bio_err, "signing CRL\\n");\n        if (crl_ext || crlnumberfile != NULL) {\n            X509V3_CTX crlctx;\n            X509V3_set_ctx(&crlctx, x509, NULL, NULL, crl, 0);\n            X509V3_set_nconf(&crlctx, conf);\n            if (crl_ext)\n                if (!X509V3_EXT_CRL_add_nconf(conf, &crlctx, crl_ext, crl))\n                    goto end;\n            if (crlnumberfile != NULL) {\n                tmpser = BN_to_ASN1_INTEGER(crlnumber, NULL);\n                if (!tmpser)\n                    goto end;\n                X509_CRL_add1_ext_i2d(crl, NID_crl_number, tmpser, 0, 0);\n                ASN1_INTEGER_free(tmpser);\n                crl_v2 = 1;\n                if (!BN_add_word(crlnumber, 1))\n                    goto end;\n            }\n        }\n        if (crl_ext || crl_v2) {\n            if (!X509_CRL_set_version(crl, 1))\n                goto end;\n        }\n        if (crlnumberfile != NULL)\n            if (!save_serial(crlnumberfile, "new", crlnumber, NULL))\n                goto end;\n        BN_free(crlnumber);\n        crlnumber = NULL;\n        if (!do_X509_CRL_sign(crl, pkey, dgst, sigopts))\n            goto end;\n        PEM_write_bio_X509_CRL(Sout, crl);\n        if (crlnumberfile != NULL)\n            if (!rotate_serial(crlnumberfile, "new", "old"))\n                goto end;\n    }\n    if (dorevoke) {\n        if (infile == NULL) {\n            BIO_printf(bio_err, "no input files\\n");\n            goto end;\n        } else {\n            X509 *revcert;\n            revcert = load_cert(infile, FORMAT_PEM, NULL, e, infile);\n            if (revcert == NULL)\n                goto end;\n            if (dorevoke == 2)\n                rev_type = -1;\n            j = do_revoke(revcert, db, rev_type, rev_arg);\n            if (j <= 0)\n                goto end;\n            X509_free(revcert);\n            if (!save_index(dbfile, "new", db))\n                goto end;\n            if (!rotate_index(dbfile, "new", "old"))\n                goto end;\n            BIO_printf(bio_err, "Data Base Updated\\n");\n        }\n    }\n    ret = 0;\n end:\n    OPENSSL_free(tofree);\n    BIO_free_all(Cout);\n    BIO_free_all(Sout);\n    BIO_free_all(out);\n    BIO_free_all(in);\n    sk_X509_pop_free(cert_sk, X509_free);\n    if (ret)\n        ERR_print_errors(bio_err);\n    app_RAND_write_file(randfile);\n    if (free_key)\n        OPENSSL_free(key);\n    BN_free(serial);\n    BN_free(crlnumber);\n    free_index(db);\n    sk_OPENSSL_STRING_free(sigopts);\n    EVP_PKEY_free(pkey);\n    X509_free(x509);\n    X509_CRL_free(crl);\n    NCONF_free(conf);\n    NCONF_free(extconf);\n    OBJ_cleanup();\n    return (ret);\n}', 'CA_DB *load_index(char *dbfile, DB_ATTR *db_attr)\n{\n    CA_DB *retdb = NULL;\n    TXT_DB *tmpdb = NULL;\n    BIO *in;\n    CONF *dbattr_conf = NULL;\n    char buf[BSIZE];\n    in = BIO_new_file(dbfile, "r");\n    if (in == NULL) {\n        ERR_print_errors(bio_err);\n        goto err;\n    }\n    if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)\n        goto err;\n#ifndef OPENSSL_SYS_VMS\n    BIO_snprintf(buf, sizeof buf, "%s.attr", dbfile);\n#else\n    BIO_snprintf(buf, sizeof buf, "%s-attr", dbfile);\n#endif\n    dbattr_conf = app_load_config(buf);\n    retdb = app_malloc(sizeof(*retdb), "new DB");\n    retdb->db = tmpdb;\n    tmpdb = NULL;\n    if (db_attr)\n        retdb->attributes = *db_attr;\n    else {\n        retdb->attributes.unique_subject = 1;\n    }\n    if (dbattr_conf) {\n        char *p = NCONF_get_string(dbattr_conf, NULL, "unique_subject");\n        if (p) {\n#ifdef RL_DEBUG\n            BIO_printf(bio_err,\n                       "DEBUG[load_index]: unique_subject = \\"%s\\"\\n", p);\n#endif\n            retdb->attributes.unique_subject = parse_yesno(p, 1);\n        }\n    }\n err:\n    NCONF_free(dbattr_conf);\n    TXT_DB_free(tmpdb);\n    BIO_free_all(in);\n    return retdb;\n}', "TXT_DB *TXT_DB_read(BIO *in, int num)\n{\n    TXT_DB *ret = NULL;\n    int esc = 0;\n    long ln = 0;\n    int i, add, n;\n    int size = BUFSIZE;\n    int offset = 0;\n    char *p, *f;\n    OPENSSL_STRING *pp;\n    BUF_MEM *buf = NULL;\n    if ((buf = BUF_MEM_new()) == NULL)\n        goto err;\n    if (!BUF_MEM_grow(buf, size))\n        goto err;\n    if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL)\n        goto err;\n    ret->num_fields = num;\n    ret->index = NULL;\n    ret->qual = NULL;\n    if ((ret->data = sk_OPENSSL_PSTRING_new_null()) == NULL)\n        goto err;\n    if ((ret->index = OPENSSL_malloc(sizeof(*ret->index) * num)) == NULL)\n        goto err;\n    if ((ret->qual = OPENSSL_malloc(sizeof(*(ret->qual)) * num)) == NULL)\n        goto err;\n    for (i = 0; i < num; i++) {\n        ret->index[i] = NULL;\n        ret->qual[i] = NULL;\n    }\n    add = (num + 1) * sizeof(char *);\n    buf->data[size - 1] = '\\0';\n    offset = 0;\n    for (;;) {\n        if (offset != 0) {\n            size += BUFSIZE;\n            if (!BUF_MEM_grow_clean(buf, size))\n                goto err;\n        }\n        buf->data[offset] = '\\0';\n        BIO_gets(in, &(buf->data[offset]), size - offset);\n        ln++;\n        if (buf->data[offset] == '\\0')\n            break;\n        if ((offset == 0) && (buf->data[0] == '#'))\n            continue;\n        i = strlen(&(buf->data[offset]));\n        offset += i;\n        if (buf->data[offset - 1] != '\\n')\n            continue;\n        else {\n            buf->data[offset - 1] = '\\0';\n            if ((p = OPENSSL_malloc(add + offset)) == NULL)\n                goto err;\n            offset = 0;\n        }\n        pp = (char **)p;\n        p += add;\n        n = 0;\n        pp[n++] = p;\n        i = 0;\n        f = buf->data;\n        esc = 0;\n        for (;;) {\n            if (*f == '\\0')\n                break;\n            if (*f == '\\t') {\n                if (esc)\n                    p--;\n                else {\n                    *(p++) = '\\0';\n                    f++;\n                    if (n >= num)\n                        break;\n                    pp[n++] = p;\n                    continue;\n                }\n            }\n            esc = (*f == '\\\\');\n            *(p++) = *(f++);\n        }\n        *(p++) = '\\0';\n        if ((n != num) || (*f != '\\0')) {\n            ret->error = DB_ERROR_WRONG_NUM_FIELDS;\n            goto err;\n        }\n        pp[n] = p;\n        if (!sk_OPENSSL_PSTRING_push(ret->data, pp))\n            goto err;\n    }\n    BUF_MEM_free(buf);\n    return ret;\n err:\n    BUF_MEM_free(buf);\n    if (ret != NULL) {\n        sk_OPENSSL_PSTRING_free(ret->data);\n        OPENSSL_free(ret->index);\n        OPENSSL_free(ret->qual);\n        OPENSSL_free(ret);\n    }\n    return (NULL);\n}", 'static int do_revoke(X509 *x509, CA_DB *db, int type, char *value)\n{\n    ASN1_UTCTIME *tm = NULL;\n    char *row[DB_NUMBER], **rrow, **irow;\n    char *rev_str = NULL;\n    BIGNUM *bn = NULL;\n    int ok = -1, i;\n    for (i = 0; i < DB_NUMBER; i++)\n        row[i] = NULL;\n    row[DB_name] = X509_NAME_oneline(X509_get_subject_name(x509), NULL, 0);\n    bn = ASN1_INTEGER_to_BN(X509_get_serialNumber(x509), NULL);\n    if (!bn)\n        goto end;\n    if (BN_is_zero(bn))\n        row[DB_serial] = OPENSSL_strdup("00");\n    else\n        row[DB_serial] = BN_bn2hex(bn);\n    BN_free(bn);\n    if ((row[DB_name] == NULL) || (row[DB_serial] == NULL)) {\n        BIO_printf(bio_err, "Memory allocation failure\\n");\n        goto end;\n    }\n    rrow = TXT_DB_get_by_index(db->db, DB_serial, row);\n    if (rrow == NULL) {\n        BIO_printf(bio_err,\n                   "Adding Entry with serial number %s to DB for %s\\n",\n                   row[DB_serial], row[DB_name]);\n        row[DB_type] = OPENSSL_strdup("V");\n        tm = X509_get_notAfter(x509);\n        row[DB_exp_date] = app_malloc(tm->length + 1, "row exp_data");\n        memcpy(row[DB_exp_date], tm->data, tm->length);\n        row[DB_exp_date][tm->length] = \'\\0\';\n        row[DB_rev_date] = NULL;\n        row[DB_file] = OPENSSL_strdup("unknown");\n        irow = app_malloc(sizeof(*irow) * (DB_NUMBER + 1), "row ptr");\n        for (i = 0; i < DB_NUMBER; i++) {\n            irow[i] = row[i];\n            row[i] = NULL;\n        }\n        irow[DB_NUMBER] = NULL;\n        if (!TXT_DB_insert(db->db, irow)) {\n            BIO_printf(bio_err, "failed to update database\\n");\n            BIO_printf(bio_err, "TXT_DB error number %ld\\n", db->db->error);\n            goto end;\n        }\n        if (type == -1)\n            ok = 1;\n        else\n            ok = do_revoke(x509, db, type, value);\n        goto end;\n    } else if (index_name_cmp_noconst(row, rrow)) {\n        BIO_printf(bio_err, "ERROR:name does not match %s\\n", row[DB_name]);\n        goto end;\n    } else if (type == -1) {\n        BIO_printf(bio_err, "ERROR:Already present, serial number %s\\n",\n                   row[DB_serial]);\n        goto end;\n    } else if (rrow[DB_type][0] == \'R\') {\n        BIO_printf(bio_err, "ERROR:Already revoked, serial number %s\\n",\n                   row[DB_serial]);\n        goto end;\n    } else {\n        BIO_printf(bio_err, "Revoking Certificate %s.\\n", rrow[DB_serial]);\n        rev_str = make_revocation_str(type, value);\n        if (!rev_str) {\n            BIO_printf(bio_err, "Error in revocation arguments\\n");\n            goto end;\n        }\n        rrow[DB_type][0] = \'R\';\n        rrow[DB_type][1] = \'\\0\';\n        rrow[DB_rev_date] = rev_str;\n    }\n    ok = 1;\n end:\n    for (i = 0; i < DB_NUMBER; i++) {\n        OPENSSL_free(row[i]);\n    }\n    return (ok);\n}', 'int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)\n{\n    int i;\n    OPENSSL_STRING *r;\n    for (i = 0; i < db->num_fields; i++) {\n        if (db->index[i] != NULL) {\n            if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))\n                continue;\n            r = lh_OPENSSL_STRING_retrieve(db->index[i], row);\n            if (r != NULL) {\n                db->error = DB_ERROR_INDEX_CLASH;\n                db->arg1 = i;\n                db->arg_row = r;\n                goto err;\n            }\n        }\n    }\n    if (!sk_OPENSSL_PSTRING_push(db->data, row)) {\n        db->error = DB_ERROR_MALLOC;\n        goto err;\n    }\n    for (i = 0; i < db->num_fields; i++) {\n        if (db->index[i] != NULL) {\n            if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))\n                continue;\n            (void)lh_OPENSSL_STRING_insert(db->index[i], row);\n        }\n    }\n    return (1);\n err:\n    return (0);\n}']