openssl 3.3.2 → 4.0.0

data/ext/openssl/ossl_pkcs7.c

@@ -28,14 +28,14 @@
     TypedData_Wrap_Struct((klass), &ossl_pkcs7_signer_info_type, 0)
 #define SetPKCS7si(obj, p7si) do { \
     if (!(p7si)) { \
-	ossl_raise(rb_eRuntimeError, "PKCS7si wasn't initialized."); \
+        ossl_raise(rb_eRuntimeError, "PKCS7si wasn't initialized."); \
     } \
     RTYPEDDATA_DATA(obj) = (p7si); \
 } while (0)
 #define GetPKCS7si(obj, p7si) do { \
     TypedData_Get_Struct((obj), PKCS7_SIGNER_INFO, &ossl_pkcs7_signer_info_type, (p7si)); \
     if (!(p7si)) { \
-	ossl_raise(rb_eRuntimeError, "PKCS7si wasn't initialized."); \
+        ossl_raise(rb_eRuntimeError, "PKCS7si wasn't initialized."); \
     } \
 } while (0)
 
@@ -43,14 +43,14 @@
     TypedData_Wrap_Struct((klass), &ossl_pkcs7_recip_info_type, 0)
 #define SetPKCS7ri(obj, p7ri) do { \
     if (!(p7ri)) { \
-	ossl_raise(rb_eRuntimeError, "PKCS7ri wasn't initialized."); \
+        ossl_raise(rb_eRuntimeError, "PKCS7ri wasn't initialized."); \
     } \
     RTYPEDDATA_DATA(obj) = (p7ri); \
 } while (0)
 #define GetPKCS7ri(obj, p7ri) do { \
     TypedData_Get_Struct((obj), PKCS7_RECIP_INFO, &ossl_pkcs7_recip_info_type, (p7ri)); \
     if (!(p7ri)) { \
-	ossl_raise(rb_eRuntimeError, "PKCS7ri wasn't initialized."); \
+        ossl_raise(rb_eRuntimeError, "PKCS7ri wasn't initialized."); \
     } \
 } while (0)
 
@@ -68,6 +68,7 @@ static VALUE cPKCS7;
 static VALUE cPKCS7Signer;
 static VALUE cPKCS7Recipient;
 static VALUE ePKCS7Error;
+static ID id_md_holder, id_cipher_holder;
 
 static void
 ossl_pkcs7_free(void *ptr)
@@ -78,7 +79,7 @@ ossl_pkcs7_free(void *ptr)
 static const rb_data_type_t ossl_pkcs7_type = {
     "OpenSSL/PKCS7",
     {
-	0, ossl_pkcs7_free,
+        0, ossl_pkcs7_free,
     },
     0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
 };
@@ -106,7 +107,7 @@ ossl_pkcs7_signer_info_free(void *ptr)
 static const rb_data_type_t ossl_pkcs7_signer_info_type = {
     "OpenSSL/PKCS7/SIGNER_INFO",
     {
-	0, ossl_pkcs7_signer_info_free,
+        0, ossl_pkcs7_signer_info_free,
     },
     0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
 };
@@ -120,7 +121,7 @@ ossl_pkcs7_recip_info_free(void *ptr)
 static const rb_data_type_t ossl_pkcs7_recip_info_type = {
     "OpenSSL/PKCS7/RECIP_INFO",
     {
-	0, ossl_pkcs7_recip_info_free,
+        0, ossl_pkcs7_recip_info_free,
     },
     0, 0, RUBY_TYPED_FREE_IMMEDIATELY | RUBY_TYPED_WB_PROTECTED,
 };
@@ -143,23 +144,32 @@ ossl_PKCS7_SIGNER_INFO_dup(PKCS7_SIGNER_INFO *si)
 }
 
 static PKCS7_RECIP_INFO *
-ossl_PKCS7_RECIP_INFO_dup(PKCS7_RECIP_INFO *si)
+ossl_PKCS7_RECIP_INFO_dup(PKCS7_RECIP_INFO *ri)
 {
-    return ASN1_dup((i2d_of_void *)i2d_PKCS7_RECIP_INFO,
-                    (d2i_of_void *)d2i_PKCS7_RECIP_INFO,
-                    si);
+    PKCS7_RECIP_INFO *ri_new = ASN1_dup((i2d_of_void *)i2d_PKCS7_RECIP_INFO,
+                                        (d2i_of_void *)d2i_PKCS7_RECIP_INFO,
+                                        ri);
+    if (ri_new && ri->cert) {
+        if (!X509_up_ref(ri->cert)) {
+            PKCS7_RECIP_INFO_free(ri_new);
+            return NULL;
+        }
+        ri_new->cert = ri->cert;
+    }
+    return ri_new;
 }
 
 static VALUE
 ossl_pkcs7si_new(PKCS7_SIGNER_INFO *p7si)
 {
-    PKCS7_SIGNER_INFO *pkcs7;
+    PKCS7_SIGNER_INFO *p7si_new;
     VALUE obj;
 
     obj = NewPKCS7si(cPKCS7Signer);
-    pkcs7 = p7si ? ossl_PKCS7_SIGNER_INFO_dup(p7si) : PKCS7_SIGNER_INFO_new();
-    if (!pkcs7) ossl_raise(ePKCS7Error, NULL);
-    SetPKCS7si(obj, pkcs7);
+    p7si_new = ossl_PKCS7_SIGNER_INFO_dup(p7si);
+    if (!p7si_new)
+        ossl_raise(ePKCS7Error, "ASN1_dup");
+    SetPKCS7si(obj, p7si_new);
 
     return obj;
 }
@@ -167,13 +177,14 @@ ossl_pkcs7si_new(PKCS7_SIGNER_INFO *p7si)
 static VALUE
 ossl_pkcs7ri_new(PKCS7_RECIP_INFO *p7ri)
 {
-    PKCS7_RECIP_INFO *pkcs7;
+    PKCS7_RECIP_INFO *p7ri_new;
     VALUE obj;
 
     obj = NewPKCS7ri(cPKCS7Recipient);
-    pkcs7 = p7ri ? ossl_PKCS7_RECIP_INFO_dup(p7ri) : PKCS7_RECIP_INFO_new();
-    if (!pkcs7) ossl_raise(ePKCS7Error, NULL);
-    SetPKCS7ri(obj, pkcs7);
+    p7ri_new = ossl_PKCS7_RECIP_INFO_dup(p7ri);
+    if (!p7ri_new)
+        ossl_raise(ePKCS7Error,"ASN1_dup");
+    SetPKCS7ri(obj, p7ri_new);
 
     return obj;
 }
@@ -227,7 +238,7 @@ ossl_pkcs7_s_write_smime(int argc, VALUE *argv, VALUE klass)
     if(NIL_P(data)) data = ossl_pkcs7_get_data(pkcs7);
     GetPKCS7(pkcs7, p7);
     if(!NIL_P(data) && PKCS7_is_detached(p7))
-	flg |= PKCS7_DETACHED;
+        flg |= PKCS7_DETACHED;
     in = NIL_P(data) ? NULL : ossl_obj2bio(&data);
     if(!(out = BIO_new(BIO_s_mem()))){
         BIO_free(in);
@@ -268,16 +279,16 @@ ossl_pkcs7_s_sign(int argc, VALUE *argv, VALUE klass)
     in = ossl_obj2bio(&data);
     if(NIL_P(certs)) x509s = NULL;
     else{
-	x509s = ossl_protect_x509_ary2sk(certs, &status);
-	if(status){
-	    BIO_free(in);
-	    rb_jump_tag(status);
-	}
+        x509s = ossl_protect_x509_ary2sk(certs, &status);
+        if(status){
+            BIO_free(in);
+            rb_jump_tag(status);
+        }
     }
     if(!(pkcs7 = PKCS7_sign(x509, pkey, x509s, in, flg))){
-	BIO_free(in);
-	sk_X509_pop_free(x509s, X509_free);
-	ossl_raise(ePKCS7Error, NULL);
+        BIO_free(in);
+        sk_X509_pop_free(x509s, X509_free);
+        ossl_raise(ePKCS7Error, NULL);
     }
     SetPKCS7(ret, pkcs7);
     ossl_pkcs7_set_data(ret, data);
@@ -302,7 +313,7 @@ ossl_pkcs7_s_sign(int argc, VALUE *argv, VALUE klass)
 static VALUE
 ossl_pkcs7_s_encrypt(int argc, VALUE *argv, VALUE klass)
 {
-    VALUE certs, data, cipher, flags;
+    VALUE certs, data, cipher, flags, cipher_holder;
     STACK_OF(X509) *x509s;
     BIO *in;
     const EVP_CIPHER *ciph;
@@ -316,23 +327,24 @@ ossl_pkcs7_s_encrypt(int argc, VALUE *argv, VALUE klass)
                  "cipher must be specified. Before version 3.3, " \
                  "the default cipher was RC2-40-CBC.");
     }
-    ciph = ossl_evp_get_cipherbyname(cipher);
+    ciph = ossl_evp_cipher_fetch(cipher, &cipher_holder);
     flg = NIL_P(flags) ? 0 : NUM2INT(flags);
     ret = NewPKCS7(cPKCS7);
     in = ossl_obj2bio(&data);
     x509s = ossl_protect_x509_ary2sk(certs, &status);
     if(status){
-	BIO_free(in);
-	rb_jump_tag(status);
+        BIO_free(in);
+        rb_jump_tag(status);
     }
-    if(!(p7 = PKCS7_encrypt(x509s, in, (EVP_CIPHER*)ciph, flg))){
-	BIO_free(in);
-	sk_X509_pop_free(x509s, X509_free);
-	ossl_raise(ePKCS7Error, NULL);
+    if (!(p7 = PKCS7_encrypt(x509s, in, ciph, flg))) {
+        BIO_free(in);
+        sk_X509_pop_free(x509s, X509_free);
+        ossl_raise(ePKCS7Error, NULL);
     }
     BIO_free(in);
     SetPKCS7(ret, p7);
     ossl_pkcs7_set_data(ret, data);
+    rb_ivar_set(ret, id_cipher_holder, cipher_holder);
     sk_X509_pop_free(x509s, X509_free);
 
     return ret;
@@ -346,7 +358,7 @@ ossl_pkcs7_alloc(VALUE klass)
 
     obj = NewPKCS7(klass);
     if (!(pkcs7 = PKCS7_new())) {
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     }
     SetPKCS7(obj, pkcs7);
 
@@ -368,7 +380,7 @@ ossl_pkcs7_initialize(int argc, VALUE *argv, VALUE self)
     VALUE arg;
 
     if(rb_scan_args(argc, argv, "01", &arg) == 0)
-	return self;
+        return self;
     arg = ossl_to_der_if_possible(arg);
     in = ossl_obj2bio(&arg);
     p7 = d2i_PKCS7_bio(in, NULL);
@@ -378,10 +390,10 @@ ossl_pkcs7_initialize(int argc, VALUE *argv, VALUE self)
     }
     BIO_free(in);
     if (!p7)
-        ossl_raise(rb_eArgError, "Could not parse the PKCS7");
+        ossl_raise(ePKCS7Error, "Could not parse the PKCS7");
     if (!p7->d.ptr) {
         PKCS7_free(p7);
-        ossl_raise(rb_eArgError, "No content in PKCS7");
+        ossl_raise(ePKCS7Error, "No content in PKCS7");
     }
 
     RTYPEDDATA_DATA(self) = p7;
@@ -392,6 +404,7 @@ ossl_pkcs7_initialize(int argc, VALUE *argv, VALUE self)
     return self;
 }
 
+/* :nodoc: */
 static VALUE
 ossl_pkcs7_copy(VALUE self, VALUE other)
 {
@@ -405,7 +418,7 @@ ossl_pkcs7_copy(VALUE self, VALUE other)
 
     pkcs7 = PKCS7_dup(b);
     if (!pkcs7) {
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     }
     DATA_PTR(self) = pkcs7;
     PKCS7_free(a);
@@ -437,13 +450,13 @@ ossl_pkcs7_sym2typeid(VALUE sym)
     RSTRING_GETMEM(sym, s, l);
 
     for(i = 0; ; i++){
-	if(i == numberof(p7_type_tab))
-	    ossl_raise(ePKCS7Error, "unknown type \"%"PRIsVALUE"\"", sym);
-	if(strlen(p7_type_tab[i].name) != l) continue;
-	if(strcmp(p7_type_tab[i].name, s) == 0){
-	    ret = p7_type_tab[i].nid;
-	    break;
-	}
+        if(i == numberof(p7_type_tab))
+            ossl_raise(ePKCS7Error, "unknown type \"%"PRIsVALUE"\"", sym);
+        if(strlen(p7_type_tab[i].name) != l) continue;
+        if(strcmp(p7_type_tab[i].name, s) == 0){
+            ret = p7_type_tab[i].nid;
+            break;
+        }
     }
 
     return ret;
@@ -460,7 +473,7 @@ ossl_pkcs7_set_type(VALUE self, VALUE type)
 
     GetPKCS7(self, p7);
     if(!PKCS7_set_type(p7, ossl_pkcs7_sym2typeid(type)))
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
 
     return type;
 }
@@ -476,15 +489,15 @@ ossl_pkcs7_get_type(VALUE self)
 
     GetPKCS7(self, p7);
     if(PKCS7_type_is_signed(p7))
-	return ID2SYM(rb_intern("signed"));
+        return ID2SYM(rb_intern("signed"));
     if(PKCS7_type_is_encrypted(p7))
-	return ID2SYM(rb_intern("encrypted"));
+        return ID2SYM(rb_intern("encrypted"));
     if(PKCS7_type_is_enveloped(p7))
-	return ID2SYM(rb_intern("enveloped"));
+        return ID2SYM(rb_intern("enveloped"));
     if(PKCS7_type_is_signedAndEnveloped(p7))
-	return ID2SYM(rb_intern("signedAndEnveloped"));
+        return ID2SYM(rb_intern("signedAndEnveloped"));
     if(PKCS7_type_is_data(p7))
-	return ID2SYM(rb_intern("data"));
+        return ID2SYM(rb_intern("data"));
     return Qnil;
 }
 
@@ -495,9 +508,9 @@ ossl_pkcs7_set_detached(VALUE self, VALUE flag)
 
     GetPKCS7(self, p7);
     if(flag != Qtrue && flag != Qfalse)
-	ossl_raise(ePKCS7Error, "must specify a boolean");
+        ossl_raise(ePKCS7Error, "must specify a boolean");
     if(!PKCS7_set_detached(p7, flag == Qtrue ? 1 : 0))
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
 
     return flag;
 }
@@ -507,6 +520,8 @@ ossl_pkcs7_get_detached(VALUE self)
 {
     PKCS7 *p7;
     GetPKCS7(self, p7);
+    if (!PKCS7_type_is_signed(p7))
+        return Qfalse;
     return PKCS7_get_detached(p7) ? Qtrue : Qfalse;
 }
 
@@ -522,11 +537,14 @@ static VALUE
 ossl_pkcs7_set_cipher(VALUE self, VALUE cipher)
 {
     PKCS7 *pkcs7;
+    const EVP_CIPHER *ciph;
+    VALUE cipher_holder;
 
     GetPKCS7(self, pkcs7);
-    if (!PKCS7_set_cipher(pkcs7, ossl_evp_get_cipherbyname(cipher))) {
-	ossl_raise(ePKCS7Error, NULL);
-    }
+    ciph = ossl_evp_cipher_fetch(cipher, &cipher_holder);
+    if (!PKCS7_set_cipher(pkcs7, ciph))
+        ossl_raise(ePKCS7Error, "PKCS7_set_cipher");
+    rb_ivar_set(self, id_cipher_holder, cipher_holder);
 
     return cipher;
 }
@@ -557,22 +575,17 @@ ossl_pkcs7_get_signer(VALUE self)
 {
     PKCS7 *pkcs7;
     STACK_OF(PKCS7_SIGNER_INFO) *sk;
-    PKCS7_SIGNER_INFO *si;
     int num, i;
     VALUE ary;
 
     GetPKCS7(self, pkcs7);
-    if (!(sk = PKCS7_get_signer_info(pkcs7))) {
-	OSSL_Debug("OpenSSL::PKCS7#get_signer_info == NULL!");
-	return rb_ary_new();
-    }
-    if ((num = sk_PKCS7_SIGNER_INFO_num(sk)) < 0) {
-	ossl_raise(ePKCS7Error, "Negative number of signers!");
-    }
-    ary = rb_ary_new2(num);
+    if (!(sk = PKCS7_get_signer_info(pkcs7)))
+        return rb_ary_new();
+    num = sk_PKCS7_SIGNER_INFO_num(sk);
+    ary = rb_ary_new_capa(num);
     for (i=0; i<num; i++) {
-	si = sk_PKCS7_SIGNER_INFO_value(sk, i);
-	rb_ary_push(ary, ossl_pkcs7si_new(si));
+        PKCS7_SIGNER_INFO *si = sk_PKCS7_SIGNER_INFO_value(sk, i);
+        rb_ary_push(ary, ossl_pkcs7si_new(si));
     }
 
     return ary;
@@ -604,24 +617,21 @@ ossl_pkcs7_get_recipient(VALUE self)
 {
     PKCS7 *pkcs7;
     STACK_OF(PKCS7_RECIP_INFO) *sk;
-    PKCS7_RECIP_INFO *si;
     int num, i;
     VALUE ary;
 
     GetPKCS7(self, pkcs7);
     if (PKCS7_type_is_enveloped(pkcs7))
-	sk = pkcs7->d.enveloped->recipientinfo;
+        sk = pkcs7->d.enveloped->recipientinfo;
     else if (PKCS7_type_is_signedAndEnveloped(pkcs7))
-	sk = pkcs7->d.signed_and_enveloped->recipientinfo;
+        sk = pkcs7->d.signed_and_enveloped->recipientinfo;
     else sk = NULL;
     if (!sk) return rb_ary_new();
-    if ((num = sk_PKCS7_RECIP_INFO_num(sk)) < 0) {
-	ossl_raise(ePKCS7Error, "Negative number of recipient!");
-    }
-    ary = rb_ary_new2(num);
+    num = sk_PKCS7_RECIP_INFO_num(sk);
+    ary = rb_ary_new_capa(num);
     for (i=0; i<num; i++) {
-	si = sk_PKCS7_RECIP_INFO_value(sk, i);
-	rb_ary_push(ary, ossl_pkcs7ri_new(si));
+        PKCS7_RECIP_INFO *ri = sk_PKCS7_RECIP_INFO_value(sk, i);
+        rb_ary_push(ary, ossl_pkcs7ri_new(ri));
     }
 
     return ary;
@@ -636,7 +646,7 @@ ossl_pkcs7_add_certificate(VALUE self, VALUE cert)
     GetPKCS7(self, pkcs7);
     x509 = GetX509CertPtr(cert);  /* NO NEED TO DUP */
     if (!PKCS7_add_certificate(pkcs7, x509)){
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     }
 
     return self;
@@ -652,13 +662,13 @@ pkcs7_get_certs(VALUE self)
     GetPKCS7(self, pkcs7);
     i = OBJ_obj2nid(pkcs7->type);
     switch(i){
-    case NID_pkcs7_signed:
+      case NID_pkcs7_signed:
         certs = pkcs7->d.sign->cert;
         break;
-    case NID_pkcs7_signedAndEnveloped:
+      case NID_pkcs7_signedAndEnveloped:
         certs = pkcs7->d.signed_and_enveloped->cert;
         break;
-    default:
+      default:
         certs = NULL;
     }
 
@@ -675,13 +685,13 @@ pkcs7_get_crls(VALUE self)
     GetPKCS7(self, pkcs7);
     i = OBJ_obj2nid(pkcs7->type);
     switch(i){
-    case NID_pkcs7_signed:
+      case NID_pkcs7_signed:
         crls = pkcs7->d.sign->crl;
         break;
-    case NID_pkcs7_signedAndEnveloped:
+      case NID_pkcs7_signedAndEnveloped:
         crls = pkcs7->d.signed_and_enveloped->crl;
         break;
-    default:
+      default:
         crls = NULL;
     }
 
@@ -701,7 +711,10 @@ ossl_pkcs7_set_certificates(VALUE self, VALUE ary)
     X509 *cert;
 
     certs = pkcs7_get_certs(self);
-    while((cert = sk_X509_pop(certs))) X509_free(cert);
+    if (certs) {
+        while ((cert = sk_X509_pop(certs)))
+            X509_free(cert);
+    }
     rb_block_call(ary, rb_intern("each"), 0, 0, ossl_pkcs7_set_certs_i, self);
 
     return ary;
@@ -710,7 +723,10 @@ ossl_pkcs7_set_certificates(VALUE self, VALUE ary)
 static VALUE
 ossl_pkcs7_get_certificates(VALUE self)
 {
-    return ossl_x509_sk2ary(pkcs7_get_certs(self));
+    STACK_OF(X509) *certs = pkcs7_get_certs(self);
+    if (!certs)
+        return Qnil;
+    return ossl_x509_sk2ary(certs);
 }
 
 static VALUE
@@ -722,7 +738,7 @@ ossl_pkcs7_add_crl(VALUE self, VALUE crl)
     GetPKCS7(self, pkcs7); /* NO DUP needed! */
     x509crl = GetX509CRLPtr(crl);
     if (!PKCS7_add_crl(pkcs7, x509crl)) {
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     }
 
     return self;
@@ -741,7 +757,10 @@ ossl_pkcs7_set_crls(VALUE self, VALUE ary)
     X509_CRL *crl;
 
     crls = pkcs7_get_crls(self);
-    while((crl = sk_X509_CRL_pop(crls))) X509_CRL_free(crl);
+    if (crls) {
+        while ((crl = sk_X509_CRL_pop(crls)))
+            X509_CRL_free(crl);
+    }
     rb_block_call(ary, rb_intern("each"), 0, 0, ossl_pkcs7_set_crls_i, self);
 
     return ary;
@@ -750,7 +769,10 @@ ossl_pkcs7_set_crls(VALUE self, VALUE ary)
 static VALUE
 ossl_pkcs7_get_crls(VALUE self)
 {
-    return ossl_x509crl_sk2ary(pkcs7_get_crls(self));
+    STACK_OF(X509_CRL) *crls = pkcs7_get_crls(self);
+    if (!crls)
+        return Qnil;
+    return ossl_x509crl_sk2ary(crls);
 }
 
 static VALUE
@@ -763,7 +785,6 @@ ossl_pkcs7_verify(int argc, VALUE *argv, VALUE self)
     BIO *in, *out;
     PKCS7 *p7;
     VALUE data;
-    const char *msg;
 
     GetPKCS7(self, p7);
     rb_scan_args(argc, argv, "22", &certs, &store, &indata, &flags);
@@ -773,28 +794,30 @@ ossl_pkcs7_verify(int argc, VALUE *argv, VALUE self)
     in = NIL_P(indata) ? NULL : ossl_obj2bio(&indata);
     if(NIL_P(certs)) x509s = NULL;
     else{
-	x509s = ossl_protect_x509_ary2sk(certs, &status);
-	if(status){
-	    BIO_free(in);
-	    rb_jump_tag(status);
-	}
+        x509s = ossl_protect_x509_ary2sk(certs, &status);
+        if(status){
+            BIO_free(in);
+            rb_jump_tag(status);
+        }
     }
     if(!(out = BIO_new(BIO_s_mem()))){
-	BIO_free(in);
-	sk_X509_pop_free(x509s, X509_free);
-	ossl_raise(ePKCS7Error, NULL);
+        BIO_free(in);
+        sk_X509_pop_free(x509s, X509_free);
+        ossl_raise(ePKCS7Error, NULL);
     }
     ok = PKCS7_verify(p7, x509s, x509st, in, out, flg);
     BIO_free(in);
     sk_X509_pop_free(x509s, X509_free);
-    if (ok < 0) ossl_raise(ePKCS7Error, "PKCS7_verify");
-    msg = ERR_reason_error_string(ERR_peek_error());
-    ossl_pkcs7_set_err_string(self, msg ? rb_str_new2(msg) : Qnil);
-    ossl_clear_error();
     data = ossl_membio2str(out);
     ossl_pkcs7_set_data(self, data);
-
-    return (ok == 1) ? Qtrue : Qfalse;
+    if (ok != 1) {
+        const char *msg = ERR_reason_error_string(ERR_peek_error());
+        ossl_pkcs7_set_err_string(self, msg ? rb_str_new_cstr(msg) : Qnil);
+        ossl_clear_error();
+        return Qfalse;
+    }
+    ossl_pkcs7_set_err_string(self, Qnil);
+    return Qtrue;
 }
 
 static VALUE
@@ -814,10 +837,10 @@ ossl_pkcs7_decrypt(int argc, VALUE *argv, VALUE self)
     flg = NIL_P(flags) ? 0 : NUM2INT(flags);
     GetPKCS7(self, p7);
     if(!(out = BIO_new(BIO_s_mem())))
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     if(!PKCS7_decrypt(p7, key, x509, out, flg)){
-	BIO_free(out);
-	ossl_raise(ePKCS7Error, NULL);
+        BIO_free(out);
+        ossl_raise(ePKCS7Error, NULL);
     }
     str = ossl_membio2str(out); /* out will be free */
 
@@ -830,30 +853,38 @@ ossl_pkcs7_add_data(VALUE self, VALUE data)
     PKCS7 *pkcs7;
     BIO *out, *in;
     char buf[4096];
-    int len;
+    int len, ret;
 
     GetPKCS7(self, pkcs7);
-    if(PKCS7_type_is_signed(pkcs7)){
-	if(!PKCS7_content_new(pkcs7, NID_pkcs7_data))
-	    ossl_raise(ePKCS7Error, NULL);
+    if (PKCS7_type_is_signed(pkcs7)) {
+        if (!PKCS7_content_new(pkcs7, NID_pkcs7_data))
+            ossl_raise(ePKCS7Error, "PKCS7_content_new");
     }
     in = ossl_obj2bio(&data);
-    if(!(out = PKCS7_dataInit(pkcs7, NULL))) goto err;
-    for(;;){
-	if((len = BIO_read(in, buf, sizeof(buf))) <= 0)
-	    break;
-	if(BIO_write(out, buf, len) != len)
-	    goto err;
+    if (!(out = PKCS7_dataInit(pkcs7, NULL))) {
+        BIO_free(in);
+        ossl_raise(ePKCS7Error, "PKCS7_dataInit");
     }
-    if(!PKCS7_dataFinal(pkcs7, out)) goto err;
-    ossl_pkcs7_set_data(self, Qnil);
-
- err:
+    for (;;) {
+        if ((len = BIO_read(in, buf, sizeof(buf))) <= 0)
+            break;
+        if (BIO_write(out, buf, len) != len) {
+            BIO_free_all(out);
+            BIO_free(in);
+            ossl_raise(ePKCS7Error, "BIO_write");
+        }
+    }
+    if (BIO_flush(out) <= 0) {
+        BIO_free_all(out);
+        BIO_free(in);
+        ossl_raise(ePKCS7Error, "BIO_flush");
+    }
+    ret = PKCS7_dataFinal(pkcs7, out);
     BIO_free_all(out);
     BIO_free(in);
-    if(ERR_peek_error()){
-	ossl_raise(ePKCS7Error, NULL);
-    }
+    if (!ret)
+        ossl_raise(ePKCS7Error, "PKCS7_dataFinal");
+    ossl_pkcs7_set_data(self, Qnil);
 
     return data;
 }
@@ -868,11 +899,11 @@ ossl_pkcs7_to_der(VALUE self)
 
     GetPKCS7(self, pkcs7);
     if((len = i2d_PKCS7(pkcs7, NULL)) <= 0)
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     str = rb_str_new(0, len);
     p = (unsigned char *)RSTRING_PTR(str);
     if(i2d_PKCS7(pkcs7, &p) <= 0)
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     ossl_str_adjust(str, p);
 
     return str;
@@ -906,11 +937,11 @@ ossl_pkcs7_to_pem(VALUE self)
 
     GetPKCS7(self, pkcs7);
     if (!(out = BIO_new(BIO_s_mem()))) {
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     }
     if (!PEM_write_bio_PKCS7(out, pkcs7)) {
-	BIO_free(out);
-	ossl_raise(ePKCS7Error, NULL);
+        BIO_free(out);
+        ossl_raise(ePKCS7Error, NULL);
     }
     str = ossl_membio2str(out);
 
@@ -928,7 +959,7 @@ ossl_pkcs7si_alloc(VALUE klass)
 
     obj = NewPKCS7si(klass);
     if (!(p7si = PKCS7_SIGNER_INFO_new())) {
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     }
     SetPKCS7si(obj, p7si);
 
@@ -942,14 +973,15 @@ ossl_pkcs7si_initialize(VALUE self, VALUE cert, VALUE key, VALUE digest)
     EVP_PKEY *pkey;
     X509 *x509;
     const EVP_MD *md;
+    VALUE md_holder;
 
     pkey = GetPrivPKeyPtr(key); /* NO NEED TO DUP */
     x509 = GetX509CertPtr(cert); /* NO NEED TO DUP */
-    md = ossl_evp_get_digestbyname(digest);
+    md = ossl_evp_md_fetch(digest, &md_holder);
     GetPKCS7si(self, p7si);
-    if (!(PKCS7_SIGNER_INFO_set(p7si, x509, pkey, (EVP_MD*)md))) {
-	ossl_raise(ePKCS7Error, NULL);
-    }
+    if (!(PKCS7_SIGNER_INFO_set(p7si, x509, pkey, md)))
+        ossl_raise(ePKCS7Error, "PKCS7_SIGNER_INFO_set");
+    rb_ivar_set(self, id_md_holder, md_holder);
 
     return self;
 }
@@ -983,10 +1015,10 @@ ossl_pkcs7si_get_signed_time(VALUE self)
     GetPKCS7si(self, p7si);
 
     if (!(asn1obj = PKCS7_get_signed_attribute(p7si, NID_pkcs9_signingTime))) {
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     }
     if (asn1obj->type == V_ASN1_UTCTIME) {
-	return asn1time_to_time(asn1obj->value.utctime);
+        return asn1time_to_time(asn1obj->value.utctime);
     }
     /*
      * OR
@@ -1008,7 +1040,7 @@ ossl_pkcs7ri_alloc(VALUE klass)
 
     obj = NewPKCS7ri(klass);
     if (!(p7ri = PKCS7_RECIP_INFO_new())) {
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     }
     SetPKCS7ri(obj, p7ri);
 
@@ -1024,7 +1056,7 @@ ossl_pkcs7ri_initialize(VALUE self, VALUE cert)
     x509 = GetX509CertPtr(cert); /* NO NEED TO DUP */
     GetPKCS7ri(self, p7ri);
     if (!PKCS7_RECIP_INFO_set(p7ri, x509)) {
-	ossl_raise(ePKCS7Error, NULL);
+        ossl_raise(ePKCS7Error, NULL);
     }
 
     return self;
@@ -1067,11 +1099,6 @@ void
 Init_ossl_pkcs7(void)
 {
 #undef rb_intern
-#if 0
-    mOSSL = rb_define_module("OpenSSL");
-    eOSSLError = rb_define_class_under(mOSSL, "OpenSSLError", rb_eStandardError);
-#endif
-
     cPKCS7 = rb_define_class_under(mOSSL, "PKCS7", rb_cObject);
     ePKCS7Error = rb_define_class_under(cPKCS7, "PKCS7Error", eOSSLError);
     rb_define_singleton_method(cPKCS7, "read_smime", ossl_pkcs7_s_read_smime, 1);
@@ -1135,4 +1162,7 @@ Init_ossl_pkcs7(void)
     DefPKCS7Const(BINARY);
     DefPKCS7Const(NOATTR);
     DefPKCS7Const(NOSMIMECAP);
+
+    id_md_holder = rb_intern_const("EVP_MD_holder");
+    id_cipher_holder = rb_intern_const("EVP_CIPHER_holder");
 }