grpc 1.42.0 → 1.43.1

data/third_party/boringssl-with-bazel/src/crypto/pool/pool.c

@@ -22,12 +22,9 @@
 #include <openssl/thread.h>
 
 #include "../internal.h"
-#include "../lhash/internal.h"
 #include "internal.h"
 
 
-DEFINE_LHASH_OF(CRYPTO_BUFFER)
-
 static uint32_t CRYPTO_BUFFER_hash(const CRYPTO_BUFFER *buf) {
   return OPENSSL_hash32(buf->data, buf->len);
 }
@@ -73,16 +70,28 @@ void CRYPTO_BUFFER_POOL_free(CRYPTO_BUFFER_POOL *pool) {
   OPENSSL_free(pool);
 }
 
-CRYPTO_BUFFER *CRYPTO_BUFFER_new(const uint8_t *data, size_t len,
-                                 CRYPTO_BUFFER_POOL *pool) {
+static void crypto_buffer_free_object(CRYPTO_BUFFER *buf) {
+  if (!buf->data_is_static) {
+    OPENSSL_free(buf->data);
+  }
+  OPENSSL_free(buf);
+}
+
+static CRYPTO_BUFFER *crypto_buffer_new(const uint8_t *data, size_t len,
+                                        int data_is_static,
+                                        CRYPTO_BUFFER_POOL *pool) {
   if (pool != NULL) {
     CRYPTO_BUFFER tmp;
     tmp.data = (uint8_t *) data;
     tmp.len = len;
 
     CRYPTO_MUTEX_lock_read(&pool->lock);
-    CRYPTO_BUFFER *const duplicate =
-        lh_CRYPTO_BUFFER_retrieve(pool->bufs, &tmp);
+    CRYPTO_BUFFER *duplicate = lh_CRYPTO_BUFFER_retrieve(pool->bufs, &tmp);
+    if (data_is_static && duplicate != NULL && !duplicate->data_is_static) {
+      // If the new |CRYPTO_BUFFER| would have static data, but the duplicate
+      // does not, we replace the old one with the new static version.
+      duplicate = NULL;
+    }
     if (duplicate != NULL) {
       CRYPTO_refcount_inc(&duplicate->references);
     }
@@ -99,10 +108,15 @@ CRYPTO_BUFFER *CRYPTO_BUFFER_new(const uint8_t *data, size_t len,
   }
   OPENSSL_memset(buf, 0, sizeof(CRYPTO_BUFFER));
 
-  buf->data = OPENSSL_memdup(data, len);
-  if (len != 0 && buf->data == NULL) {
-    OPENSSL_free(buf);
-    return NULL;
+  if (data_is_static) {
+    buf->data = (uint8_t *)data;
+    buf->data_is_static = 1;
+  } else {
+    buf->data = OPENSSL_memdup(data, len);
+    if (len != 0 && buf->data == NULL) {
+      OPENSSL_free(buf);
+      return NULL;
+    }
   }
 
   buf->len = len;
@@ -116,11 +130,18 @@ CRYPTO_BUFFER *CRYPTO_BUFFER_new(const uint8_t *data, size_t len,
 
   CRYPTO_MUTEX_lock_write(&pool->lock);
   CRYPTO_BUFFER *duplicate = lh_CRYPTO_BUFFER_retrieve(pool->bufs, buf);
+  if (data_is_static && duplicate != NULL && !duplicate->data_is_static) {
+    // If the new |CRYPTO_BUFFER| would have static data, but the duplicate does
+    // not, we replace the old one with the new static version.
+    duplicate = NULL;
+  }
   int inserted = 0;
   if (duplicate == NULL) {
     CRYPTO_BUFFER *old = NULL;
     inserted = lh_CRYPTO_BUFFER_insert(pool->bufs, &old, buf);
-    assert(old == NULL);
+    // |old| may be non-NULL if a match was found but ignored. |pool->bufs| does
+    // not increment refcounts, so there is no need to clean up after the
+    // replacement.
   } else {
     CRYPTO_refcount_inc(&duplicate->references);
   }
@@ -129,14 +150,18 @@ CRYPTO_BUFFER *CRYPTO_BUFFER_new(const uint8_t *data, size_t len,
   if (!inserted) {
     // We raced to insert |buf| into the pool and lost, or else there was an
     // error inserting.
-    OPENSSL_free(buf->data);
-    OPENSSL_free(buf);
+    crypto_buffer_free_object(buf);
     return duplicate;
   }
 
   return buf;
 }
 
+CRYPTO_BUFFER *CRYPTO_BUFFER_new(const uint8_t *data, size_t len,
+                                 CRYPTO_BUFFER_POOL *pool) {
+  return crypto_buffer_new(data, len, /*data_is_static=*/0, pool);
+}
+
 CRYPTO_BUFFER *CRYPTO_BUFFER_alloc(uint8_t **out_data, size_t len) {
   CRYPTO_BUFFER *const buf = OPENSSL_malloc(sizeof(CRYPTO_BUFFER));
   if (buf == NULL) {
@@ -156,10 +181,16 @@ CRYPTO_BUFFER *CRYPTO_BUFFER_alloc(uint8_t **out_data, size_t len) {
   return buf;
 }
 
-CRYPTO_BUFFER* CRYPTO_BUFFER_new_from_CBS(CBS *cbs, CRYPTO_BUFFER_POOL *pool) {
+CRYPTO_BUFFER *CRYPTO_BUFFER_new_from_CBS(const CBS *cbs,
+                                          CRYPTO_BUFFER_POOL *pool) {
   return CRYPTO_BUFFER_new(CBS_data(cbs), CBS_len(cbs), pool);
 }
 
+CRYPTO_BUFFER *CRYPTO_BUFFER_new_from_static_data_unsafe(
+    const uint8_t *data, size_t len, CRYPTO_BUFFER_POOL *pool) {
+  return crypto_buffer_new(data, len, /*data_is_static=*/1, pool);
+}
+
 void CRYPTO_BUFFER_free(CRYPTO_BUFFER *buf) {
   if (buf == NULL) {
     return;
@@ -171,8 +202,7 @@ void CRYPTO_BUFFER_free(CRYPTO_BUFFER *buf) {
       // If a reference count of zero is observed, there cannot be a reference
       // from any pool to this buffer and thus we are able to free this
       // buffer.
-      OPENSSL_free(buf->data);
-      OPENSSL_free(buf);
+      crypto_buffer_free_object(buf);
     }
 
     return;
@@ -188,13 +218,19 @@ void CRYPTO_BUFFER_free(CRYPTO_BUFFER *buf) {
   // find this buffer and increment the reference count. Thus, if the count is
   // zero there are and can never be any more references and thus we can free
   // this buffer.
-  void *found = lh_CRYPTO_BUFFER_delete(pool->bufs, buf);
-  assert(found != NULL);
-  assert(found == buf);
-  (void)found;
+  //
+  // Note it is possible |buf| is no longer in the pool, if it was replaced by a
+  // static version. If that static version was since removed, it is even
+  // possible for |found| to be NULL.
+  CRYPTO_BUFFER *found = lh_CRYPTO_BUFFER_retrieve(pool->bufs, buf);
+  if (found == buf) {
+    found = lh_CRYPTO_BUFFER_delete(pool->bufs, buf);
+    assert(found == buf);
+    (void)found;
+  }
+
   CRYPTO_MUTEX_unlock_write(&buf->pool->lock);
-  OPENSSL_free(buf->data);
-  OPENSSL_free(buf);
+  crypto_buffer_free_object(buf);
 }
 
 int CRYPTO_BUFFER_up_ref(CRYPTO_BUFFER *buf) {

data/third_party/boringssl-with-bazel/src/crypto/x509/asn1_gen.c

@@ -66,6 +66,7 @@
 
 #include "../internal.h"
 #include "../x509v3/internal.h"
+#include "internal.h"
 
 /*
  * Although this file is in crypto/x509 for layering purposes, it emits
@@ -136,17 +137,6 @@ static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf,
 static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype);
 static int asn1_str2tag(const char *tagstr, int len);
 
-ASN1_TYPE *ASN1_generate_nconf(const char *str, CONF *nconf)
-{
-    X509V3_CTX cnf;
-
-    if (!nconf)
-        return ASN1_generate_v3(str, NULL);
-
-    X509V3_set_nconf(&cnf, nconf);
-    return ASN1_generate_v3(str, &cnf);
-}
-
 ASN1_TYPE *ASN1_generate_v3(const char *str, X509V3_CTX *cnf)
 {
     int err = 0;
@@ -225,13 +215,7 @@ static ASN1_TYPE *generate_v3(const char *str, X509V3_CTX *cnf, int depth,
          * For IMPLICIT tagging the length should match the original length
          * and constructed flag should be consistent.
          */
-        if (r & 0x1) {
-            /* Indefinite length constructed */
-            hdr_constructed = 2;
-            hdr_len = 0;
-        } else
-            /* Just retain constructed flag */
-            hdr_constructed = r & V_ASN1_CONSTRUCTED;
+        hdr_constructed = r & V_ASN1_CONSTRUCTED;
         /*
          * Work out new length with IMPLICIT tag: ignore constructed because
          * it will mess up if indefinite length

data/third_party/boringssl-with-bazel/src/crypto/x509/internal.h

@@ -63,6 +63,8 @@
 #include <openssl/evp.h>
 #include <openssl/x509.h>
 
+#include "../asn1/internal.h"
+
 #if defined(__cplusplus)
 extern "C" {
 #endif
@@ -70,10 +72,12 @@ extern "C" {
 
 /* Internal structures. */
 
-struct X509_val_st {
+typedef struct X509_val_st {
   ASN1_TIME *notBefore;
   ASN1_TIME *notAfter;
-} /* X509_VAL */;
+} X509_VAL;
+
+DECLARE_ASN1_FUNCTIONS(X509_VAL)
 
 struct X509_pubkey_st {
   X509_ALGOR *algor;
@@ -354,6 +358,8 @@ struct x509_store_ctx_st {
   CRYPTO_EX_DATA ex_data;
 } /* X509_STORE_CTX */;
 
+ASN1_TYPE *ASN1_generate_v3(const char *str, X509V3_CTX *cnf);
+
 
 /* RSA-PSS functions. */
 

data/third_party/boringssl-with-bazel/src/crypto/x509v3/internal.h

@@ -1,16 +1,60 @@
-/* Copyright (c) 2018, Google Inc.
+/*
+ * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL project
+ * 2004.
+ */
+/* ====================================================================
+ * Copyright (c) 2004 The OpenSSL Project.  All rights reserved.
  *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
  *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
 
 #ifndef OPENSSL_HEADER_X509V3_INTERNAL_H
 #define OPENSSL_HEADER_X509V3_INTERNAL_H
@@ -18,6 +62,8 @@
 #include <openssl/base.h>
 
 #include <openssl/conf.h>
+#include <openssl/stack.h>
+#include <openssl/x509v3.h>
 
 #if defined(__cplusplus)
 extern "C" {
@@ -76,6 +122,165 @@ typedef struct {
 int x509V3_add_value_asn1_string(const char *name, const ASN1_STRING *value,
                                  STACK_OF(CONF_VALUE) **extlist);
 
+typedef struct X509_POLICY_DATA_st X509_POLICY_DATA;
+
+DEFINE_STACK_OF(X509_POLICY_DATA)
+
+/* Internal structures */
+
+/*
+ * This structure and the field names correspond to the Policy 'node' of
+ * RFC 3280. NB this structure contains no pointers to parent or child data:
+ * X509_POLICY_NODE contains that. This means that the main policy data can
+ * be kept static and cached with the certificate.
+ */
+
+struct X509_POLICY_DATA_st {
+    unsigned int flags;
+    /* Policy OID and qualifiers for this data */
+    ASN1_OBJECT *valid_policy;
+    STACK_OF(POLICYQUALINFO) *qualifier_set;
+    STACK_OF(ASN1_OBJECT) *expected_policy_set;
+};
+
+/* X509_POLICY_DATA flags values */
+
+/*
+ * This flag indicates the structure has been mapped using a policy mapping
+ * extension. If policy mapping is not active its references get deleted.
+ */
+
+#define POLICY_DATA_FLAG_MAPPED                 0x1
+
+/*
+ * This flag indicates the data doesn't correspond to a policy in Certificate
+ * Policies: it has been mapped to any policy.
+ */
+
+#define POLICY_DATA_FLAG_MAPPED_ANY             0x2
+
+/* AND with flags to see if any mapping has occurred */
+
+#define POLICY_DATA_FLAG_MAP_MASK               0x3
+
+/* qualifiers are shared and shouldn't be freed */
+
+#define POLICY_DATA_FLAG_SHARED_QUALIFIERS      0x4
+
+/* Parent node is an extra node and should be freed */
+
+#define POLICY_DATA_FLAG_EXTRA_NODE             0x8
+
+/* Corresponding CertificatePolicies is critical */
+
+#define POLICY_DATA_FLAG_CRITICAL               0x10
+
+/* This structure is cached with a certificate */
+
+struct X509_POLICY_CACHE_st {
+    /* anyPolicy data or NULL if no anyPolicy */
+    X509_POLICY_DATA *anyPolicy;
+    /* other policy data */
+    STACK_OF(X509_POLICY_DATA) *data;
+    /* If InhibitAnyPolicy present this is its value or -1 if absent. */
+    long any_skip;
+    /*
+     * If policyConstraints and requireExplicitPolicy present this is its
+     * value or -1 if absent.
+     */
+    long explicit_skip;
+    /*
+     * If policyConstraints and policyMapping present this is its value or -1
+     * if absent.
+     */
+    long map_skip;
+};
+
+/*
+ * #define POLICY_CACHE_FLAG_CRITICAL POLICY_DATA_FLAG_CRITICAL
+ */
+
+/* This structure represents the relationship between nodes */
+
+struct X509_POLICY_NODE_st {
+    /* node data this refers to */
+    const X509_POLICY_DATA *data;
+    /* Parent node */
+    X509_POLICY_NODE *parent;
+    /* Number of child nodes */
+    int nchild;
+};
+
+struct X509_POLICY_LEVEL_st {
+    /* Cert for this level */
+    X509 *cert;
+    /* nodes at this level */
+    STACK_OF(X509_POLICY_NODE) *nodes;
+    /* anyPolicy node */
+    X509_POLICY_NODE *anyPolicy;
+    /* Extra data */
+    /*
+     * STACK_OF(X509_POLICY_DATA) *extra_data;
+     */
+    unsigned int flags;
+};
+
+struct X509_POLICY_TREE_st {
+    /* This is the tree 'level' data */
+    X509_POLICY_LEVEL *levels;
+    int nlevel;
+    /*
+     * Extra policy data when additional nodes (not from the certificate) are
+     * required.
+     */
+    STACK_OF(X509_POLICY_DATA) *extra_data;
+    /* This is the authority constained policy set */
+    STACK_OF(X509_POLICY_NODE) *auth_policies;
+    STACK_OF(X509_POLICY_NODE) *user_policies;
+    unsigned int flags;
+};
+
+/* Set if anyPolicy present in user policies */
+#define POLICY_FLAG_ANY_POLICY          0x2
+
+/* Useful macros */
+
+#define node_data_critical(data) ((data)->flags & POLICY_DATA_FLAG_CRITICAL)
+#define node_critical(node) node_data_critical((node)->data)
+
+/* Internal functions */
+
+X509_POLICY_DATA *policy_data_new(POLICYINFO *policy, const ASN1_OBJECT *id,
+                                  int crit);
+void policy_data_free(X509_POLICY_DATA *data);
+
+X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,
+                                         const ASN1_OBJECT *id);
+int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps);
+
+STACK_OF(X509_POLICY_NODE) *policy_node_cmp_new(void);
+
+void policy_cache_init(void);
+
+void policy_cache_free(X509_POLICY_CACHE *cache);
+
+X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
+                                  const X509_POLICY_NODE *parent,
+                                  const ASN1_OBJECT *id);
+
+X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk,
+                               const ASN1_OBJECT *id);
+
+X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
+                                 X509_POLICY_DATA *data,
+                                 X509_POLICY_NODE *parent,
+                                 X509_POLICY_TREE *tree);
+void policy_node_free(X509_POLICY_NODE *node);
+int policy_node_match(const X509_POLICY_LEVEL *lvl,
+                      const X509_POLICY_NODE *node, const ASN1_OBJECT *oid);
+
+const X509_POLICY_CACHE *policy_cache_set(X509 *x);
+
 
 #if defined(__cplusplus)
 }  /* extern C */

data/third_party/boringssl-with-bazel/src/crypto/x509v3/pcy_cache.c

@@ -60,9 +60,9 @@
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
-#include "pcy_int.h"
 #include "../internal.h"
 #include "../x509/internal.h"
+#include "internal.h"
 
 static int policy_data_cmp(const X509_POLICY_DATA **a,
                            const X509_POLICY_DATA **b);

data/third_party/boringssl-with-bazel/src/crypto/x509v3/pcy_data.c

@@ -62,7 +62,7 @@
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
-#include "pcy_int.h"
+#include "internal.h"
 
 /* Policy Node routines */
 

data/third_party/boringssl-with-bazel/src/crypto/x509v3/pcy_lib.c

@@ -58,7 +58,7 @@
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
-#include "pcy_int.h"
+#include "internal.h"
 
 /* accessor functions */
 

data/third_party/boringssl-with-bazel/src/crypto/x509v3/pcy_map.c

@@ -61,8 +61,8 @@
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
-#include "pcy_int.h"
 #include "../x509/internal.h"
+#include "internal.h"
 
 /*
  * Set policy mapping entries in cache. Note: this modifies the passed

data/third_party/boringssl-with-bazel/src/crypto/x509v3/pcy_node.c

@@ -61,7 +61,7 @@
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
-#include "pcy_int.h"
+#include "internal.h"
 
 static int node_cmp(const X509_POLICY_NODE **a, const X509_POLICY_NODE **b)
 {

data/third_party/boringssl-with-bazel/src/crypto/x509v3/pcy_tree.c

@@ -65,9 +65,9 @@
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
-#include "pcy_int.h"
 #include "../internal.h"
 #include "../x509/internal.h"
+#include "internal.h"
 
 /*
  * Enable this to print out the complete policy tree at various point during

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_alt.c

@@ -64,6 +64,7 @@
 #include <openssl/obj.h>
 #include <openssl/x509v3.h>
 
+#include "../x509/internal.h"
 #include "internal.h"
 
 

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_cpols.c

@@ -70,7 +70,6 @@
 #include <openssl/x509v3.h>
 
 #include "internal.h"
-#include "pcy_int.h"
 
 /* Certificate policies extension support: this one is a bit complex... */
 

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_lib.c

@@ -213,10 +213,27 @@ void *X509V3_EXT_d2i(const X509_EXTENSION *ext)
     if (!(method = X509V3_EXT_get(ext)))
         return NULL;
     p = ext->value->data;
-    if (method->it)
-        return ASN1_item_d2i(NULL, &p, ext->value->length,
-                             ASN1_ITEM_ptr(method->it));
-    return method->d2i(NULL, &p, ext->value->length);
+    void *ret;
+    if (method->it) {
+        ret = ASN1_item_d2i(NULL, &p, ext->value->length,
+                            ASN1_ITEM_ptr(method->it));
+    } else {
+        ret = method->d2i(NULL, &p, ext->value->length);
+    }
+    if (ret == NULL) {
+        return NULL;
+    }
+    /* Check for trailing data. */
+    if (p != ext->value->data + ext->value->length) {
+        if (method->it) {
+            ASN1_item_free(ret, ASN1_ITEM_ptr(method->it));
+        } else {
+            method->ext_free(ret);
+        }
+        OPENSSL_PUT_ERROR(X509V3, X509V3_R_TRAILING_DATA_IN_EXTENSION);
+        return NULL;
+    }
+    return ret;
 }
 
 void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *extensions, int nid,