grpc 1.54.3 → 1.59.2

data/third_party/boringssl-with-bazel/src/crypto/x509/a_sign.c

@@ -62,6 +62,8 @@
 #include <openssl/obj.h>
 #include <openssl/x509.h>
 
+#include <limits.h>
+
 #include "internal.h"
 
 int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
@@ -83,17 +85,13 @@ int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
 int ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1,
                        X509_ALGOR *algor2, ASN1_BIT_STRING *signature,
                        void *asn, EVP_MD_CTX *ctx) {
-  EVP_PKEY *pkey;
-  unsigned char *buf_in = NULL, *buf_out = NULL;
-  size_t inl = 0, outl = 0;
-
+  int ret = 0;
+  uint8_t *in = NULL, *out = NULL;
   if (signature->type != V_ASN1_BIT_STRING) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_WRONG_TYPE);
     goto err;
   }
 
-  pkey = EVP_PKEY_CTX_get0_pkey(ctx->pctx);
-
   // Write out the requested copies of the AlgorithmIdentifier.
   if (algor1 && !x509_digest_sign_algorithm(ctx, algor1)) {
     goto err;
@@ -102,26 +100,37 @@ int ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1,
     goto err;
   }
 
-  inl = ASN1_item_i2d(asn, &buf_in, it);
-  outl = EVP_PKEY_size(pkey);
-  buf_out = OPENSSL_malloc((unsigned int)outl);
-  if ((buf_in == NULL) || (buf_out == NULL)) {
-    outl = 0;
+  int in_len = ASN1_item_i2d(asn, &in, it);
+  if (in_len < 0) {
+    goto err;
+  }
+
+  EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(ctx->pctx);
+  size_t out_len = EVP_PKEY_size(pkey);
+  if (out_len > INT_MAX) {
+    OPENSSL_PUT_ERROR(X509, ERR_R_OVERFLOW);
     goto err;
   }
 
-  if (!EVP_DigestSign(ctx, buf_out, &outl, buf_in, inl)) {
-    outl = 0;
+  out = OPENSSL_malloc(out_len);
+  if (out == NULL) {
+    goto err;
+  }
+
+  if (!EVP_DigestSign(ctx, out, &out_len, in, in_len)) {
     OPENSSL_PUT_ERROR(X509, ERR_R_EVP_LIB);
     goto err;
   }
-  ASN1_STRING_set0(signature, buf_out, outl);
-  buf_out = NULL;
+
+  ASN1_STRING_set0(signature, out, (int)out_len);
+  out = NULL;
   signature->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
   signature->flags |= ASN1_STRING_FLAG_BITS_LEFT;
+  ret = (int)out_len;
+
 err:
   EVP_MD_CTX_cleanup(ctx);
-  OPENSSL_free(buf_in);
-  OPENSSL_free(buf_out);
-  return outl;
+  OPENSSL_free(in);
+  OPENSSL_free(out);
+  return ret;
 }

data/third_party/boringssl-with-bazel/src/crypto/x509/asn1_gen.c

@@ -509,7 +509,7 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
                CBB_flush(cbb);
       }
       if (format == ASN1_GEN_FORMAT_HEX) {
-        long len;
+        size_t len;
         uint8_t *data = x509v3_hex_to_bytes(value, &len);
         if (data == NULL) {
           OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_HEX);

data/third_party/boringssl-with-bazel/src/crypto/x509/by_dir.c

@@ -64,8 +64,6 @@
 #include <openssl/thread.h>
 #include <openssl/x509.h>
 
-#if !defined(OPENSSL_TRUSTY)
-
 #include "../internal.h"
 #include "internal.h"
 
@@ -81,7 +79,6 @@ typedef struct lookup_dir_entry_st {
 } BY_DIR_ENTRY;
 
 typedef struct lookup_dir_st {
-  BUF_MEM *buffer;
   STACK_OF(BY_DIR_ENTRY) *dirs;
 } BY_DIR;
 
@@ -141,10 +138,6 @@ static int new_dir(X509_LOOKUP *lu) {
   if ((a = (BY_DIR *)OPENSSL_malloc(sizeof(BY_DIR))) == NULL) {
     return 0;
   }
-  if ((a->buffer = BUF_MEM_new()) == NULL) {
-    OPENSSL_free(a);
-    return 0;
-  }
   a->dirs = NULL;
   lu->method_data = a;
   return 1;
@@ -152,7 +145,8 @@ static int new_dir(X509_LOOKUP *lu) {
 
 static void by_dir_hash_free(BY_DIR_HASH *hash) { OPENSSL_free(hash); }
 
-static int by_dir_hash_cmp(const BY_DIR_HASH **a, const BY_DIR_HASH **b) {
+static int by_dir_hash_cmp(const BY_DIR_HASH *const *a,
+                           const BY_DIR_HASH *const *b) {
   if ((*a)->hash > (*b)->hash) {
     return 1;
   }
@@ -174,7 +168,6 @@ static void free_dir(X509_LOOKUP *lu) {
   BY_DIR *a = lu->method_data;
   if (a != NULL) {
     sk_BY_DIR_ENTRY_pop_free(a->dirs, by_dir_entry_free);
-    BUF_MEM_free(a->buffer);
     OPENSSL_free(a);
   }
 }
@@ -237,7 +230,7 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) {
 
 // g_ent_hashes_lock protects the |hashes| member of all |BY_DIR_ENTRY|
 // objects.
-static struct CRYPTO_STATIC_MUTEX g_ent_hashes_lock = CRYPTO_STATIC_MUTEX_INIT;
+static CRYPTO_MUTEX g_ent_hashes_lock = CRYPTO_MUTEX_INIT;
 
 static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
                                X509_OBJECT *ret) {
@@ -303,7 +296,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
       }
       if (type == X509_LU_CRL && ent->hashes) {
         htmp.hash = h;
-        CRYPTO_STATIC_MUTEX_lock_read(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_lock_read(&g_ent_hashes_lock);
         if (sk_BY_DIR_HASH_find(ent->hashes, &idx, &htmp)) {
           hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
           k = hent->suffix;
@@ -311,14 +304,13 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
           hent = NULL;
           k = 0;
         }
-        CRYPTO_STATIC_MUTEX_unlock_read(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_unlock_read(&g_ent_hashes_lock);
       } else {
         k = 0;
         hent = NULL;
       }
       for (;;) {
-        BIO_snprintf(b->data, b->max, "%s/%08lx.%s%d", ent->dir, h, postfix,
-                     k);
+        snprintf(b->data, b->max, "%s/%08lx.%s%d", ent->dir, h, postfix, k);
 #ifndef OPENSSL_NO_POSIX_IO
 #if defined(_WIN32) && !defined(stat)
 #define stat _stat
@@ -356,7 +348,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
       // If a CRL, update the last file suffix added for this
 
       if (type == X509_LU_CRL) {
-        CRYPTO_STATIC_MUTEX_lock_write(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_lock_write(&g_ent_hashes_lock);
         // Look for entry again in case another thread added an entry
         // first.
         if (!hent) {
@@ -369,14 +361,14 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
         if (!hent) {
           hent = OPENSSL_malloc(sizeof(BY_DIR_HASH));
           if (hent == NULL) {
-            CRYPTO_STATIC_MUTEX_unlock_write(&g_ent_hashes_lock);
+            CRYPTO_MUTEX_unlock_write(&g_ent_hashes_lock);
             ok = 0;
             goto finish;
           }
           hent->hash = h;
           hent->suffix = k;
           if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) {
-            CRYPTO_STATIC_MUTEX_unlock_write(&g_ent_hashes_lock);
+            CRYPTO_MUTEX_unlock_write(&g_ent_hashes_lock);
             OPENSSL_free(hent);
             ok = 0;
             goto finish;
@@ -386,7 +378,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
           hent->suffix = k;
         }
 
-        CRYPTO_STATIC_MUTEX_unlock_write(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_unlock_write(&g_ent_hashes_lock);
       }
 
       if (tmp != NULL) {
@@ -408,5 +400,3 @@ finish:
   BUF_MEM_free(b);
   return ok;
 }
-
-#endif  // OPENSSL_TRUSTY

data/third_party/boringssl-with-bazel/src/crypto/x509/by_file.c

@@ -62,7 +62,6 @@
 
 #include "internal.h"
 
-#ifndef OPENSSL_NO_STDIO
 
 static int by_file_ctrl(X509_LOOKUP *ctx, int cmd, const char *argc, long argl,
                         char **ret);
@@ -278,5 +277,3 @@ err:
   sk_X509_INFO_pop_free(inf, X509_INFO_free);
   return count;
 }
-
-#endif  // OPENSSL_NO_STDIO

data/third_party/boringssl-with-bazel/src/crypto/x509/internal.h

@@ -64,6 +64,7 @@
 #include <openssl/x509.h>
 
 #include "../asn1/internal.h"
+#include "../internal.h"
 
 #if defined(__cplusplus)
 extern "C" {
@@ -274,7 +275,6 @@ struct x509_lookup_method_st {
 // function is then called to actually check the cert chain.
 struct x509_store_st {
   // The following is a cache of trusted certs
-  int cache;                    // if true, stash any hits
   STACK_OF(X509_OBJECT) *objs;  // Cache of all objects
   CRYPTO_MUTEX objs_lock;
 
@@ -404,7 +404,8 @@ int x509_digest_verify_init(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
 // Path-building functions.
 
 // X509_policy_check checks certificate policies in |certs|. |user_policies| is
-// the user-initial-policy-set. |flags| is a set of |X509_V_FLAG_*| values to
+// the user-initial-policy-set. If |user_policies| is NULL or empty, it is
+// interpreted as anyPolicy. |flags| is a set of |X509_V_FLAG_*| values to
 // apply. It returns |X509_V_OK| on success and |X509_V_ERR_*| on error. It
 // additionally sets |*out_current_cert| to the certificate where the error
 // occurred. If the function succeeded, or the error applies to the entire

data/third_party/boringssl-with-bazel/src/crypto/x509/name_print.c

@@ -56,6 +56,7 @@
 
 #include <openssl/x509.h>
 
+#include <assert.h>
 #include <inttypes.h>
 #include <string.h>
 
@@ -84,8 +85,7 @@ static int do_indent(BIO *out, int indent) {
 
 static int do_name_ex(BIO *out, const X509_NAME *n, int indent,
                       unsigned long flags) {
-  int i, prev = -1, orflags, cnt;
-  int fn_opt, fn_nid;
+  int prev = -1, orflags;
   char objtmp[80];
   const char *objbuf;
   int outlen, len;
@@ -142,10 +142,8 @@ static int do_name_ex(BIO *out, const X509_NAME *n, int indent,
     sep_eq_len = 1;
   }
 
-  fn_opt = flags & XN_FLAG_FN_MASK;
-
-  cnt = X509_NAME_entry_count(n);
-  for (i = 0; i < cnt; i++) {
+  int cnt = X509_NAME_entry_count(n);
+  for (int i = 0; i < cnt; i++) {
     const X509_NAME_ENTRY *ent;
     if (flags & XN_FLAG_DN_REV) {
       ent = X509_NAME_get_entry(n, cnt - i - 1);
@@ -172,40 +170,20 @@ static int do_name_ex(BIO *out, const X509_NAME *n, int indent,
     prev = X509_NAME_ENTRY_set(ent);
     const ASN1_OBJECT *fn = X509_NAME_ENTRY_get_object(ent);
     const ASN1_STRING *val = X509_NAME_ENTRY_get_data(ent);
-    fn_nid = OBJ_obj2nid(fn);
-    if (fn_opt != XN_FLAG_FN_NONE) {
-      int objlen, fld_len;
-      if ((fn_opt == XN_FLAG_FN_OID) || (fn_nid == NID_undef)) {
-        OBJ_obj2txt(objtmp, sizeof objtmp, fn, 1);
-        fld_len = 0;  // XXX: what should this be?
-        objbuf = objtmp;
-      } else {
-        if (fn_opt == XN_FLAG_FN_SN) {
-          fld_len = FN_WIDTH_SN;
-          objbuf = OBJ_nid2sn(fn_nid);
-        } else if (fn_opt == XN_FLAG_FN_LN) {
-          fld_len = FN_WIDTH_LN;
-          objbuf = OBJ_nid2ln(fn_nid);
-        } else {
-          fld_len = 0;  // XXX: what should this be?
-          objbuf = "";
-        }
-      }
-      objlen = strlen(objbuf);
-      if (!maybe_write(out, objbuf, objlen)) {
-        return -1;
-      }
-      if ((objlen < fld_len) && (flags & XN_FLAG_FN_ALIGN)) {
-        if (!do_indent(out, fld_len - objlen)) {
-          return -1;
-        }
-        outlen += fld_len - objlen;
-      }
-      if (!maybe_write(out, sep_eq, sep_eq_len)) {
-        return -1;
-      }
-      outlen += objlen + sep_eq_len;
+    assert((flags & XN_FLAG_FN_MASK) == XN_FLAG_FN_SN);
+    int fn_nid = OBJ_obj2nid(fn);
+    if (fn_nid == NID_undef) {
+      OBJ_obj2txt(objtmp, sizeof(objtmp), fn, 1);
+      objbuf = objtmp;
+    } else {
+      objbuf = OBJ_nid2sn(fn_nid);
+    }
+    int objlen = strlen(objbuf);
+    if (!maybe_write(out, objbuf, objlen) ||
+        !maybe_write(out, sep_eq, sep_eq_len)) {
+      return -1;
     }
+    outlen += objlen + sep_eq_len;
     // If the field name is unknown then fix up the DER dump flag. We
     // might want to limit this further so it will DER dump on anything
     // other than a few 'standard' fields.

data/third_party/boringssl-with-bazel/src/crypto/x509/policy.c

@@ -121,8 +121,8 @@ static X509_POLICY_NODE *x509_policy_node_new(const ASN1_OBJECT *policy) {
   return node;
 }
 
-static int x509_policy_node_cmp(const X509_POLICY_NODE **a,
-                                const X509_POLICY_NODE **b) {
+static int x509_policy_node_cmp(const X509_POLICY_NODE *const *a,
+                                const X509_POLICY_NODE *const *b) {
   return OBJ_cmp((*a)->policy, (*b)->policy);
 }
 
@@ -201,7 +201,8 @@ static int x509_policy_level_add_nodes(X509_POLICY_LEVEL *level,
   return 1;
 }
 
-static int policyinfo_cmp(const POLICYINFO **a, const POLICYINFO **b) {
+static int policyinfo_cmp(const POLICYINFO *const *a,
+                          const POLICYINFO *const *b) {
   return OBJ_cmp((*a)->policyid, (*b)->policyid);
 }
 
@@ -312,13 +313,13 @@ err:
   return ret;
 }
 
-static int compare_issuer_policy(const POLICY_MAPPING **a,
-                                 const POLICY_MAPPING **b) {
+static int compare_issuer_policy(const POLICY_MAPPING *const *a,
+                                 const POLICY_MAPPING *const *b) {
   return OBJ_cmp((*a)->issuerDomainPolicy, (*b)->issuerDomainPolicy);
 }
 
-static int compare_subject_policy(const POLICY_MAPPING **a,
-                                  const POLICY_MAPPING **b) {
+static int compare_subject_policy(const POLICY_MAPPING *const *a,
+                                  const POLICY_MAPPING *const *b) {
   return OBJ_cmp((*a)->subjectDomainPolicy, (*b)->subjectDomainPolicy);
 }
 
@@ -578,7 +579,7 @@ static int process_policy_constraints(const X509 *x509, size_t *explicit_policy,
 // evaluation.
 static int has_explicit_policy(STACK_OF(X509_POLICY_LEVEL) *levels,
                                const STACK_OF(ASN1_OBJECT) *user_policies) {
-  assert(sk_ASN1_OBJECT_is_sorted(user_policies));
+  assert(user_policies == NULL || sk_ASN1_OBJECT_is_sorted(user_policies));
 
   // Step (g.i). If the policy graph is empty, the intersection is empty.
   size_t num_levels = sk_X509_POLICY_LEVEL_num(levels);
@@ -651,7 +652,8 @@ static int has_explicit_policy(STACK_OF(X509_POLICY_LEVEL) *levels,
   return 0;
 }
 
-static int asn1_object_cmp(const ASN1_OBJECT **a, const ASN1_OBJECT **b) {
+static int asn1_object_cmp(const ASN1_OBJECT *const *a,
+                           const ASN1_OBJECT *const *b) {
   return OBJ_cmp(*a, *b);
 }
 
@@ -761,12 +763,14 @@ int X509_policy_check(const STACK_OF(X509) *certs,
   // is only necessary to check if the user-constrained-policy-set is not empty.
   if (explicit_policy == 0) {
     // Build a sorted copy of |user_policies| for more efficient lookup.
-    user_policies_sorted = sk_ASN1_OBJECT_dup(user_policies);
-    if (user_policies_sorted == NULL) {
-      goto err;
+    if (user_policies != NULL) {
+      user_policies_sorted = sk_ASN1_OBJECT_dup(user_policies);
+      if (user_policies_sorted == NULL) {
+        goto err;
+      }
+      sk_ASN1_OBJECT_set_cmp_func(user_policies_sorted, asn1_object_cmp);
+      sk_ASN1_OBJECT_sort(user_policies_sorted);
     }
-    sk_ASN1_OBJECT_set_cmp_func(user_policies_sorted, asn1_object_cmp);
-    sk_ASN1_OBJECT_sort(user_policies_sorted);
 
     if (!has_explicit_policy(levels, user_policies_sorted)) {
       ret = X509_V_ERR_NO_EXPLICIT_POLICY;

data/third_party/boringssl-with-bazel/src/crypto/x509/t_x509.c

@@ -91,14 +91,8 @@ int X509_print(BIO *bp, X509 *x) {
 
 int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags,
                   unsigned long cflag) {
-  long l;
-  int ret = 0, i;
-  char *m = NULL, mlch = ' ';
+  char mlch = ' ';
   int nmindent = 0;
-  X509_CINF *ci;
-  EVP_PKEY *pkey = NULL;
-  const char *neg;
-
   if ((nmflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) {
     mlch = '\n';
     nmindent = 12;
@@ -108,26 +102,26 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags,
     nmindent = 16;
   }
 
-  ci = x->cert_info;
+  const X509_CINF *ci = x->cert_info;
   if (!(cflag & X509_FLAG_NO_HEADER)) {
     if (BIO_write(bp, "Certificate:\n", 13) <= 0) {
-      goto err;
+      return 0;
     }
     if (BIO_write(bp, "    Data:\n", 10) <= 0) {
-      goto err;
+      return 0;
     }
   }
   if (!(cflag & X509_FLAG_NO_VERSION)) {
-    l = X509_get_version(x);
+    long l = X509_get_version(x);
     assert(X509_VERSION_1 <= l && l <= X509_VERSION_3);
     if (BIO_printf(bp, "%8sVersion: %ld (0x%lx)\n", "", l + 1,
                    (unsigned long)l) <= 0) {
-      goto err;
+      return 0;
     }
   }
   if (!(cflag & X509_FLAG_NO_SERIAL)) {
     if (BIO_write(bp, "        Serial Number:", 22) <= 0) {
-      goto err;
+      return 0;
     }
 
     const ASN1_INTEGER *serial = X509_get0_serialNumber(x);
@@ -136,19 +130,20 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags,
       assert(serial->type != V_ASN1_NEG_INTEGER);
       if (BIO_printf(bp, " %" PRIu64 " (0x%" PRIx64 ")\n", serial_u64,
                      serial_u64) <= 0) {
-        goto err;
+        return 0;
       }
     } else {
       ERR_clear_error();  // Clear |ASN1_INTEGER_get_uint64|'s error.
-      neg = (serial->type == V_ASN1_NEG_INTEGER) ? " (Negative)" : "";
+      const char *neg =
+          (serial->type == V_ASN1_NEG_INTEGER) ? " (Negative)" : "";
       if (BIO_printf(bp, "\n%12s%s", "", neg) <= 0) {
-        goto err;
+        return 0;
       }
 
-      for (i = 0; i < serial->length; i++) {
+      for (int i = 0; i < serial->length; i++) {
         if (BIO_printf(bp, "%02x%c", serial->data[i],
                        ((i + 1 == serial->length) ? '\n' : ':')) <= 0) {
-          goto err;
+          return 0;
         }
       }
     }
@@ -156,69 +151,69 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags,
 
   if (!(cflag & X509_FLAG_NO_SIGNAME)) {
     if (X509_signature_print(bp, ci->signature, NULL) <= 0) {
-      goto err;
+      return 0;
     }
   }
 
   if (!(cflag & X509_FLAG_NO_ISSUER)) {
     if (BIO_printf(bp, "        Issuer:%c", mlch) <= 0) {
-      goto err;
+      return 0;
     }
     if (X509_NAME_print_ex(bp, X509_get_issuer_name(x), nmindent, nmflags) <
         0) {
-      goto err;
+      return 0;
     }
     if (BIO_write(bp, "\n", 1) <= 0) {
-      goto err;
+      return 0;
     }
   }
   if (!(cflag & X509_FLAG_NO_VALIDITY)) {
     if (BIO_write(bp, "        Validity\n", 17) <= 0) {
-      goto err;
+      return 0;
     }
     if (BIO_write(bp, "            Not Before: ", 24) <= 0) {
-      goto err;
+      return 0;
     }
     if (!ASN1_TIME_print(bp, X509_get_notBefore(x))) {
-      goto err;
+      return 0;
     }
     if (BIO_write(bp, "\n            Not After : ", 25) <= 0) {
-      goto err;
+      return 0;
     }
     if (!ASN1_TIME_print(bp, X509_get_notAfter(x))) {
-      goto err;
+      return 0;
     }
     if (BIO_write(bp, "\n", 1) <= 0) {
-      goto err;
+      return 0;
     }
   }
   if (!(cflag & X509_FLAG_NO_SUBJECT)) {
     if (BIO_printf(bp, "        Subject:%c", mlch) <= 0) {
-      goto err;
+      return 0;
     }
     if (X509_NAME_print_ex(bp, X509_get_subject_name(x), nmindent, nmflags) <
         0) {
-      goto err;
+      return 0;
     }
     if (BIO_write(bp, "\n", 1) <= 0) {
-      goto err;
+      return 0;
     }
   }
   if (!(cflag & X509_FLAG_NO_PUBKEY)) {
     if (BIO_write(bp, "        Subject Public Key Info:\n", 33) <= 0) {
-      goto err;
+      return 0;
     }
     if (BIO_printf(bp, "%12sPublic Key Algorithm: ", "") <= 0) {
-      goto err;
+      return 0;
     }
     if (i2a_ASN1_OBJECT(bp, ci->key->algor->algorithm) <= 0) {
-      goto err;
+      return 0;
     }
     if (BIO_puts(bp, "\n") <= 0) {
-      goto err;
+      return 0;
     }
 
-    pkey = X509_get_pubkey(x);
+    EVP_PKEY *pkey = X509_get_pubkey(x);
     if (pkey == NULL) {
       BIO_printf(bp, "%12sUnable to load Public Key\n", "");
       ERR_print_errors(bp);
@@ -231,18 +226,18 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags,
   if (!(cflag & X509_FLAG_NO_IDS)) {
     if (ci->issuerUID) {
       if (BIO_printf(bp, "%8sIssuer Unique ID: ", "") <= 0) {
-        goto err;
+        return 0;
       }
       if (!X509_signature_dump(bp, ci->issuerUID, 12)) {
-        goto err;
+        return 0;
       }
     }
     if (ci->subjectUID) {
       if (BIO_printf(bp, "%8sSubject Unique ID: ", "") <= 0) {
-        goto err;
+        return 0;
       }
       if (!X509_signature_dump(bp, ci->subjectUID, 12)) {
-        goto err;
+        return 0;
       }
     }
   }
@@ -253,20 +248,16 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags,
 
   if (!(cflag & X509_FLAG_NO_SIGDUMP)) {
     if (X509_signature_print(bp, x->sig_alg, x->signature) <= 0) {
-      goto err;
+      return 0;
     }
   }
   if (!(cflag & X509_FLAG_NO_AUX)) {
     if (!X509_CERT_AUX_print(bp, x->aux, 0)) {
-      goto err;
+      return 0;
     }
   }
-  ret = 1;
-err:
-  if (m != NULL) {
-    OPENSSL_free(m);
-  }
-  return ret;
+
+  return 1;
 }
 
 int X509_signature_print(BIO *bp, const X509_ALGOR *sigalg,