commit 58c35646df15ebf27d5452f699ab75bbdc3a60be
author Hanno Becker <hanno.becker@arm.com> Mon Feb 25 18:13:46 2019 +0000
committer Hanno Becker <hanno.becker@arm.com> Tue Jun 25 09:06:26 2019 +0100
tree 3bb2db5bc0c4e6fd6df7f5a9011e48813ecee6c7
parent bb26613d32db21a0e7601d7c77d3871252448a61

Make use of CRT acquire/release in CRT chain verification #2

library/x509_crt.c

diff --git a/library/x509_crt.c b/library/x509_crt.c
index 3c1221c..2a0bde0 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -2785,7 +2785,7 @@
     uint32_t *flags;
     mbedtls_x509_crt_verify_chain_item *cur;
     mbedtls_x509_crt *child_crt;
-    mbedtls_x509_crt *parent;
+    mbedtls_x509_crt *parent_crt;
     int parent_is_trusted;
     int child_is_trusted;
     int signature_is_good;
@@ -2889,7 +2889,7 @@
 
             /* Look for a parent in trusted CAs or up the chain */
             ret = x509_crt_find_parent( &child_sig, child_crt->next,
-                                        trust_ca, &parent,
+                                        trust_ca, &parent_crt,
                                         &parent_is_trusted, &signature_is_good,
                                         ver_chain->len - 1, self_cnt, rs_ctx );
 
@@ -2910,7 +2910,7 @@
 #endif
 
         /* No parent? We're done here */
-        if( parent == NULL )
+        if( parent_crt == NULL )
         {
             *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED;
             return( 0 );
@@ -2935,22 +2935,31 @@
         if( ! signature_is_good )
             *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED;
 
-        /* check size of signing key */
-        if( x509_profile_check_key( profile, &parent->pk ) != 0 )
-            *flags |= MBEDTLS_X509_BADCERT_BAD_KEY;
+        {
+            mbedtls_pk_context *parent_pk;
+            ret = x509_crt_pk_acquire( parent_crt, &parent_pk );
+            if( ret != 0 )
+                return( MBEDTLS_ERR_X509_FATAL_ERROR );
+
+            /* check size of signing key */
+            if( x509_profile_check_key( profile, parent_pk ) != 0 )
+                *flags |= MBEDTLS_X509_BADCERT_BAD_KEY;
+
+            x509_crt_pk_release( parent_crt, parent_pk );
+        }
 
 #if defined(MBEDTLS_X509_CRL_PARSE_C)
         /* Check trusted CA's CRL for the given crt */
         *flags |= x509_crt_verifycrl( child_serial.p,
                                       child_serial.len,
-                                      parent, ca_crl, profile );
+                                      parent_crt, ca_crl, profile );
 #else
         (void) ca_crl;
 #endif
 
         /* prepare for next iteration */
-        child_crt = parent;
-        parent = NULL;
+        child_crt = parent_crt;
+        parent_crt = NULL;
         child_is_trusted = parent_is_trusted;
         signature_is_good = 0;
     }