static int dane_tlsa_add(
    SSL_DANE *dane,
    uint8_t usage,
    uint8_t selector,
    uint8_t mtype,
    unsigned char *data,
    size_t dlen)
{
    danetls_record *t;
    const EVP_MD *md = NULL;
    int ilen = (int)dlen;
    int i;
    int num;
    if (dane->trecs == NULL) {
        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_NOT_ENABLED);
        return -1;
    }
    if (ilen < 0 || dlen != (size_t)ilen) {
        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DATA_LENGTH);
        return 0;
    }
    if (usage > DANETLS_USAGE_LAST) {
        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE);
        return 0;
    }
    if (selector > DANETLS_SELECTOR_LAST) {
        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_SELECTOR);
        return 0;
    }
    if (mtype != DANETLS_MATCHING_FULL) {
        md = tlsa_md_get(dane, mtype);
        if (md == NULL) {
            SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_MATCHING_TYPE);
            return 0;
        }
    }
    if (md != NULL && dlen != (size_t)EVP_MD_size(md)) {
        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH);
        return 0;
    }
    if (!data) {
        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_NULL_DATA);
        return 0;
    }
    if ((t = OPENSSL_zalloc(sizeof(*t))) == NULL) {
        SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
        return -1;
    }
    t->usage = usage;
    t->selector = selector;
    t->mtype = mtype;
    t->data = OPENSSL_malloc(ilen);
    if (t->data == NULL) {
        tlsa_free(t);
        SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
        return -1;
    }
    memcpy(t->data, data, ilen);
    t->dlen = ilen;
    if (mtype == DANETLS_MATCHING_FULL) {
        const unsigned char *p = data;
        X509 *cert = NULL;
        EVP_PKEY *pkey = NULL;
        switch (selector) {
        case DANETLS_SELECTOR_CERT:
            if (!d2i_X509(&cert, &p, dlen) || p < data ||
                dlen != (size_t)(p - data)) {
                tlsa_free(t);
                SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
                return 0;
            }
            if (X509_get0_pubkey(cert) == NULL) {
                tlsa_free(t);
                SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE);
                return 0;
            }
            if ((DANETLS_USAGE_BIT(usage) & DANETLS_TA_MASK) == 0) {
                X509_free(cert);
                break;
            }
            if ((dane->certs == NULL &&
                 (dane->certs = sk_X509_new_null()) == NULL) ||
                !sk_X509_push(dane->certs, cert)) {
                SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
                X509_free(cert);
                tlsa_free(t);
                return -1;
            }
            break;
        case DANETLS_SELECTOR_SPKI:
            if (!d2i_PUBKEY(&pkey, &p, dlen) || p < data ||
                dlen != (size_t)(p - data)) {
                tlsa_free(t);
                SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_PUBLIC_KEY);
                return 0;
            }
            if (usage == DANETLS_USAGE_DANE_TA)
                t->spki = pkey;
            else
                EVP_PKEY_free(pkey);
            break;
        }
    }
    num = sk_danetls_record_num(dane->trecs);
    for (i = 0; i < num; ++i) {
        danetls_record *rec = sk_danetls_record_value(dane->trecs, i);
        if (rec->usage > usage)
            continue;
        if (rec->usage < usage)
            break;
        if (rec->selector > selector)
            continue;
        if (rec->selector < selector)
            break;
        if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype])
            continue;
        break;
    }
    if (!sk_danetls_record_insert(dane->trecs, t, i)) {
        tlsa_free(t);
        SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);
        return -1;
    }
    dane->umask |= DANETLS_USAGE_BIT(usage);
    return 1;
}
['static int dane_tlsa_add(\n    SSL_DANE *dane,\n    uint8_t usage,\n    uint8_t selector,\n    uint8_t mtype,\n    unsigned char *data,\n    size_t dlen)\n{\n    danetls_record *t;\n    const EVP_MD *md = NULL;\n    int ilen = (int)dlen;\n    int i;\n    int num;\n    if (dane->trecs == NULL) {\n        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_NOT_ENABLED);\n        return -1;\n    }\n    if (ilen < 0 || dlen != (size_t)ilen) {\n        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DATA_LENGTH);\n        return 0;\n    }\n    if (usage > DANETLS_USAGE_LAST) {\n        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE);\n        return 0;\n    }\n    if (selector > DANETLS_SELECTOR_LAST) {\n        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_SELECTOR);\n        return 0;\n    }\n    if (mtype != DANETLS_MATCHING_FULL) {\n        md = tlsa_md_get(dane, mtype);\n        if (md == NULL) {\n            SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_MATCHING_TYPE);\n            return 0;\n        }\n    }\n    if (md != NULL && dlen != (size_t)EVP_MD_size(md)) {\n        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH);\n        return 0;\n    }\n    if (!data) {\n        SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_NULL_DATA);\n        return 0;\n    }\n    if ((t = OPENSSL_zalloc(sizeof(*t))) == NULL) {\n        SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);\n        return -1;\n    }\n    t->usage = usage;\n    t->selector = selector;\n    t->mtype = mtype;\n    t->data = OPENSSL_malloc(ilen);\n    if (t->data == NULL) {\n        tlsa_free(t);\n        SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);\n        return -1;\n    }\n    memcpy(t->data, data, ilen);\n    t->dlen = ilen;\n    if (mtype == DANETLS_MATCHING_FULL) {\n        const unsigned char *p = data;\n        X509 *cert = NULL;\n        EVP_PKEY *pkey = NULL;\n        switch (selector) {\n        case DANETLS_SELECTOR_CERT:\n            if (!d2i_X509(&cert, &p, dlen) || p < data ||\n                dlen != (size_t)(p - data)) {\n                tlsa_free(t);\n                SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE);\n                return 0;\n            }\n            if (X509_get0_pubkey(cert) == NULL) {\n                tlsa_free(t);\n                SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_CERTIFICATE);\n                return 0;\n            }\n            if ((DANETLS_USAGE_BIT(usage) & DANETLS_TA_MASK) == 0) {\n                X509_free(cert);\n                break;\n            }\n            if ((dane->certs == NULL &&\n                 (dane->certs = sk_X509_new_null()) == NULL) ||\n                !sk_X509_push(dane->certs, cert)) {\n                SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);\n                X509_free(cert);\n                tlsa_free(t);\n                return -1;\n            }\n            break;\n        case DANETLS_SELECTOR_SPKI:\n            if (!d2i_PUBKEY(&pkey, &p, dlen) || p < data ||\n                dlen != (size_t)(p - data)) {\n                tlsa_free(t);\n                SSLerr(SSL_F_DANE_TLSA_ADD, SSL_R_DANE_TLSA_BAD_PUBLIC_KEY);\n                return 0;\n            }\n            if (usage == DANETLS_USAGE_DANE_TA)\n                t->spki = pkey;\n            else\n                EVP_PKEY_free(pkey);\n            break;\n        }\n    }\n    num = sk_danetls_record_num(dane->trecs);\n    for (i = 0; i < num; ++i) {\n        danetls_record *rec = sk_danetls_record_value(dane->trecs, i);\n        if (rec->usage > usage)\n            continue;\n        if (rec->usage < usage)\n            break;\n        if (rec->selector > selector)\n            continue;\n        if (rec->selector < selector)\n            break;\n        if (dane->dctx->mdord[rec->mtype] > dane->dctx->mdord[mtype])\n            continue;\n        break;\n    }\n    if (!sk_danetls_record_insert(dane->trecs, t, i)) {\n        tlsa_free(t);\n        SSLerr(SSL_F_DANE_TLSA_ADD, ERR_R_MALLOC_FAILURE);\n        return -1;\n    }\n    dane->umask |= DANETLS_USAGE_BIT(usage);\n    return 1;\n}', 'static const EVP_MD *tlsa_md_get(SSL_DANE *dane, uint8_t mtype)\n{\n    if (mtype > dane->dctx->mdmax)\n        return NULL;\n    return dane->dctx->mdevp[mtype];\n}', 'int EVP_MD_size(const EVP_MD *md)\n{\n    if (!md) {\n        EVPerr(EVP_F_EVP_MD_SIZE, EVP_R_MESSAGE_DIGEST_IS_NULL);\n        return -1;\n    }\n    return md->md_size;\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']