visaljs 0.0.2 → 0.0.3

package/runtime/third_party/boringssl/crypto/obj/obj_xref.cc

@@ -0,0 +1,83 @@
+// Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/obj.h>
+
+#include "../internal.h"
+
+
+typedef struct {
+  int sign_nid;
+  int digest_nid;
+  int pkey_nid;
+} nid_triple;
+
+static const nid_triple kTriples[] = {
+    // RSA PKCS#1.
+    {NID_md4WithRSAEncryption, NID_md4, NID_rsaEncryption},
+    {NID_md5WithRSAEncryption, NID_md5, NID_rsaEncryption},
+    {NID_sha1WithRSAEncryption, NID_sha1, NID_rsaEncryption},
+    {NID_sha224WithRSAEncryption, NID_sha224, NID_rsaEncryption},
+    {NID_sha256WithRSAEncryption, NID_sha256, NID_rsaEncryption},
+    {NID_sha384WithRSAEncryption, NID_sha384, NID_rsaEncryption},
+    {NID_sha512WithRSAEncryption, NID_sha512, NID_rsaEncryption},
+    // DSA.
+    {NID_dsaWithSHA1, NID_sha1, NID_dsa},
+    {NID_dsaWithSHA1_2, NID_sha1, NID_dsa_2},
+    {NID_dsa_with_SHA224, NID_sha224, NID_dsa},
+    {NID_dsa_with_SHA256, NID_sha256, NID_dsa},
+    // ECDSA.
+    {NID_ecdsa_with_SHA1, NID_sha1, NID_X9_62_id_ecPublicKey},
+    {NID_ecdsa_with_SHA224, NID_sha224, NID_X9_62_id_ecPublicKey},
+    {NID_ecdsa_with_SHA256, NID_sha256, NID_X9_62_id_ecPublicKey},
+    {NID_ecdsa_with_SHA384, NID_sha384, NID_X9_62_id_ecPublicKey},
+    {NID_ecdsa_with_SHA512, NID_sha512, NID_X9_62_id_ecPublicKey},
+    // The following algorithms use more complex (or simpler) parameters. The
+    // digest "undef" indicates the caller should handle this explicitly.
+    {NID_rsassaPss, NID_undef, NID_rsaEncryption},
+    {NID_ED25519, NID_undef, NID_ED25519},
+    {NID_ML_DSA_44, NID_undef, NID_ML_DSA_44},
+    {NID_ML_DSA_65, NID_undef, NID_ML_DSA_65},
+    {NID_ML_DSA_87, NID_undef, NID_ML_DSA_87},
+};
+
+int OBJ_find_sigid_algs(int sign_nid, int *out_digest_nid, int *out_pkey_nid) {
+  for (const auto &triple : kTriples) {
+    if (triple.sign_nid == sign_nid) {
+      if (out_digest_nid != nullptr) {
+        *out_digest_nid = triple.digest_nid;
+      }
+      if (out_pkey_nid != nullptr) {
+        *out_pkey_nid = triple.pkey_nid;
+      }
+      return 1;
+    }
+  }
+
+  return 0;
+}
+
+int OBJ_find_sigid_by_algs(int *out_sign_nid, int digest_nid, int pkey_nid) {
+  for (const auto &triple : kTriples) {
+    if (triple.digest_nid == digest_nid &&
+        triple.pkey_nid == pkey_nid) {
+      if (out_sign_nid != nullptr) {
+        *out_sign_nid = triple.sign_nid;
+      }
+      return 1;
+    }
+  }
+
+  return 0;
+}

package/runtime/third_party/boringssl/crypto/params_internal.h

@@ -0,0 +1,30 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_PARAMS_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_PARAMS_INTERNAL_H
+
+#include <openssl/params.h>
+
+
+BSSL_NAMESPACE_BEGIN
+
+// IsEndParam returns whether `param` is a terminating element.
+inline bool IsEndParam(const OSSL_PARAM &param) {
+  return param.key == nullptr;
+}
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_PARAMS_INTERNAL_H

package/runtime/third_party/boringssl/crypto/pem/internal.h

@@ -0,0 +1,135 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_PEM_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_PEM_INTERNAL_H
+
+#include <openssl/base.h>
+#include <openssl/pem.h>
+
+#include "../mem_internal.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+// These macros make the PEM_read/PEM_write functions easier to maintain and
+// write. Now they are all implemented with either:
+// IMPLEMENT_PEM_rw(...) or IMPLEMENT_PEM_rw_cb(...)
+
+#define IMPLEMENT_PEM_read_fp(name, type, str, asn1)                         \
+  static void *pem_read_##name##_d2i(void **x, const unsigned char **inp,    \
+                                     long len) {                             \
+    return d2i_##asn1((type **)x, inp, len);                                 \
+  }                                                                          \
+  OPENSSL_EXPORT type *PEM_read_##name(FILE *fp, type **x,                   \
+                                       pem_password_cb *cb, void *u) {       \
+    return (type *)PEM_ASN1_read(pem_read_##name##_d2i, str, fp, (void **)x, \
+                                 cb, u);                                     \
+  }
+
+#define IMPLEMENT_PEM_write_fp(name, type, str, asn1)                        \
+  static int pem_write_##name##_i2d(const void *x, unsigned char **outp) {   \
+    return i2d_##asn1((const type *)x, outp);                                \
+  }                                                                          \
+  OPENSSL_EXPORT int PEM_write_##name(FILE *fp, const type *x) {             \
+    return PEM_ASN1_write(pem_write_##name##_i2d, str, fp, x, NULL, NULL, 0, \
+                          NULL, NULL);                                       \
+  }
+
+#define IMPLEMENT_PEM_write_cb_fp(name, type, str, asn1)                       \
+  static int pem_write_##name##_i2d(const void *x, unsigned char **outp) {     \
+    return i2d_##asn1((const type *)x, outp);                                  \
+  }                                                                            \
+  OPENSSL_EXPORT int PEM_write_##name(                                         \
+      FILE *fp, const type *x, const EVP_CIPHER *enc,                          \
+      const unsigned char *pass, int pass_len, pem_password_cb *cb, void *u) { \
+    return PEM_ASN1_write(pem_write_##name##_i2d, str, fp, x, enc, pass,       \
+                          pass_len, cb, u);                                    \
+  }
+
+#define IMPLEMENT_PEM_read_bio(name, type, str, asn1)                         \
+  static void *pem_read_bio_##name##_d2i(void **x, const unsigned char **inp, \
+                                         long len) {                          \
+    return d2i_##asn1((type **)x, inp, len);                                  \
+  }                                                                           \
+  OPENSSL_EXPORT type *PEM_read_bio_##name(BIO *bp, type **x,                 \
+                                           pem_password_cb *cb, void *u) {    \
+    return (type *)PEM_ASN1_read_bio(pem_read_bio_##name##_d2i, str, bp,      \
+                                     (void **)x, cb, u);                      \
+  }
+
+#define IMPLEMENT_PEM_write_bio(name, type, str, asn1)                         \
+  static int pem_write_bio_##name##_i2d(const void *x, unsigned char **outp) { \
+    return i2d_##asn1((const type *)x, outp);                                  \
+  }                                                                            \
+  OPENSSL_EXPORT int PEM_write_bio_##name(BIO *bp, const type *x) {            \
+    return PEM_ASN1_write_bio(pem_write_bio_##name##_i2d, str, bp, x, NULL,    \
+                              NULL, 0, NULL, NULL);                            \
+  }
+
+#define IMPLEMENT_PEM_write_cb_bio(name, type, str, asn1)                      \
+  static int pem_write_bio_##name##_i2d(const void *x, unsigned char **outp) { \
+    return i2d_##asn1((const type *)x, outp);                                  \
+  }                                                                            \
+  OPENSSL_EXPORT int PEM_write_bio_##name(                                     \
+      BIO *bp, const type *x, const EVP_CIPHER *enc,                           \
+      const unsigned char *pass, int pass_len, pem_password_cb *cb, void *u) { \
+    return PEM_ASN1_write_bio(pem_write_bio_##name##_i2d, str, bp, x, enc,     \
+                              pass, pass_len, cb, u);                          \
+  }
+
+#define IMPLEMENT_PEM_write(name, type, str, asn1) \
+  IMPLEMENT_PEM_write_bio(name, type, str, asn1)   \
+  IMPLEMENT_PEM_write_fp(name, type, str, asn1)
+
+#define IMPLEMENT_PEM_write_cb(name, type, str, asn1) \
+  IMPLEMENT_PEM_write_cb_bio(name, type, str, asn1)   \
+  IMPLEMENT_PEM_write_cb_fp(name, type, str, asn1)
+
+#define IMPLEMENT_PEM_read(name, type, str, asn1) \
+  IMPLEMENT_PEM_read_bio(name, type, str, asn1)   \
+  IMPLEMENT_PEM_read_fp(name, type, str, asn1)
+
+#define IMPLEMENT_PEM_rw(name, type, str, asn1) \
+  IMPLEMENT_PEM_read(name, type, str, asn1)     \
+  IMPLEMENT_PEM_write(name, type, str, asn1)
+
+#define IMPLEMENT_PEM_rw_cb(name, type, str, asn1) \
+  IMPLEMENT_PEM_read(name, type, str, asn1)        \
+  IMPLEMENT_PEM_write_cb(name, type, str, asn1)
+
+// PEM_get_EVP_CIPHER_INFO decodes `header` as a PEM header block and writes the
+// specified cipher and IV to `cipher`. It returns one on success and zero on
+// error. `header` must be a NUL-terminated string. If `header` does not
+// specify encryption, this function will return success and set
+// `cipher->cipher` to NULL.
+int PEM_get_EVP_CIPHER_INFO(const char *header, EVP_CIPHER_INFO *cipher);
+
+// PEM_do_header decrypts `*len` bytes from `data` in-place according to the
+// information in `cipher`. On success, it returns one and sets `*len` to the
+// length of the plaintext. Otherwise, it returns zero. If `cipher` specifies
+// encryption, the key is derived from a password returned from `callback`.
+int PEM_do_header(const EVP_CIPHER_INFO *cipher, uint8_t *data, size_t *len,
+                  pem_password_cb *callback, void *u);
+
+// PEM_read_bio_inner differs from `PEM_read_bio` on the out pointer `len`
+// so that it guarantee non-negativeness on this output and it takes in
+// owned types.
+int PEM_read_bio_inner(BIO *bp, bssl::UniquePtr<char> *name,
+                       bssl::UniquePtr<char> *header,
+                       bssl::Array<uint8_t> *data);
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_PEM_INTERNAL_H

package/runtime/third_party/boringssl/crypto/pem/pem_all.cc

@@ -0,0 +1,153 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <stdio.h>
+
+#include <openssl/bio.h>
+#include <openssl/dh.h>
+#include <openssl/dsa.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+#include <openssl/pkcs7.h>
+#include <openssl/rsa.h>
+#include <openssl/x509.h>
+
+#include "internal.h"
+
+
+static RSA *pkey_get_rsa(EVP_PKEY *key, RSA **rsa);
+static DSA *pkey_get_dsa(EVP_PKEY *key, DSA **dsa);
+static EC_KEY *pkey_get_eckey(EVP_PKEY *key, EC_KEY **eckey);
+
+IMPLEMENT_PEM_rw(X509_REQ, X509_REQ, PEM_STRING_X509_REQ, X509_REQ)
+
+IMPLEMENT_PEM_write(X509_REQ_NEW, X509_REQ, PEM_STRING_X509_REQ_OLD, X509_REQ)
+IMPLEMENT_PEM_rw(X509_CRL, X509_CRL, PEM_STRING_X509_CRL, X509_CRL)
+IMPLEMENT_PEM_rw(PKCS7, PKCS7, PEM_STRING_PKCS7, PKCS7)
+
+// We treat RSA or DSA private keys as a special case. For private keys we
+// read in an EVP_PKEY structure with PEM_read_bio_PrivateKey() and extract
+// the relevant private key: this means can handle "traditional" and PKCS#8
+// formats transparently.
+static RSA *pkey_get_rsa(EVP_PKEY *key, RSA **rsa) {
+  if (!key) {
+    return nullptr;
+  }
+  if (EVP_PKEY_id(key) != EVP_PKEY_RSA) {
+    // Don't accept RSA-PSS keys in this function.
+    OPENSSL_PUT_ERROR(EVP, EVP_R_EXPECTING_AN_RSA_KEY);
+    return nullptr;
+  }
+  RSA *rtmp = EVP_PKEY_get1_RSA(key);
+  if (!rtmp) {
+    return nullptr;
+  }
+  if (rsa) {
+    RSA_free(*rsa);
+    *rsa = rtmp;
+  }
+  return rtmp;
+}
+
+RSA *PEM_read_bio_RSAPrivateKey(BIO *bp, RSA **rsa, pem_password_cb *cb,
+                                void *u) {
+  bssl::UniquePtr<EVP_PKEY> pkey(PEM_read_bio_PrivateKey(bp, nullptr, cb, u));
+  return pkey_get_rsa(pkey.get(), rsa);
+}
+
+RSA *PEM_read_RSAPrivateKey(FILE *fp, RSA **rsa, pem_password_cb *cb, void *u) {
+  bssl::UniquePtr<EVP_PKEY> pkey(PEM_read_PrivateKey(fp, nullptr, cb, u));
+  return pkey_get_rsa(pkey.get(), rsa);
+}
+
+IMPLEMENT_PEM_write_cb(RSAPrivateKey, RSA, PEM_STRING_RSA, RSAPrivateKey)
+
+
+IMPLEMENT_PEM_rw(RSAPublicKey, RSA, PEM_STRING_RSA_PUBLIC, RSAPublicKey)
+IMPLEMENT_PEM_rw(RSA_PUBKEY, RSA, PEM_STRING_PUBLIC, RSA_PUBKEY)
+#ifndef OPENSSL_NO_DSA
+static DSA *pkey_get_dsa(EVP_PKEY *key, DSA **dsa) {
+  DSA *dtmp;
+  if (!key) {
+    return nullptr;
+  }
+  dtmp = EVP_PKEY_get1_DSA(key);
+  EVP_PKEY_free(key);
+  if (!dtmp) {
+    return nullptr;
+  }
+  if (dsa) {
+    DSA_free(*dsa);
+    *dsa = dtmp;
+  }
+  return dtmp;
+}
+
+DSA *PEM_read_bio_DSAPrivateKey(BIO *bp, DSA **dsa, pem_password_cb *cb,
+                                void *u) {
+  EVP_PKEY *pktmp;
+  pktmp = PEM_read_bio_PrivateKey(bp, nullptr, cb, u);
+  return pkey_get_dsa(pktmp, dsa);  // will free pktmp
+}
+
+IMPLEMENT_PEM_write_cb(DSAPrivateKey, DSA, PEM_STRING_DSA, DSAPrivateKey)
+
+IMPLEMENT_PEM_rw(DSA_PUBKEY, DSA, PEM_STRING_PUBLIC, DSA_PUBKEY)
+DSA *PEM_read_DSAPrivateKey(FILE *fp, DSA **dsa, pem_password_cb *cb, void *u) {
+  EVP_PKEY *pktmp;
+  pktmp = PEM_read_PrivateKey(fp, nullptr, cb, u);
+  return pkey_get_dsa(pktmp, dsa);  // will free pktmp
+}
+
+IMPLEMENT_PEM_rw(DSAparams, DSA, PEM_STRING_DSAPARAMS, DSAparams)
+#endif
+static EC_KEY *pkey_get_eckey(EVP_PKEY *key, EC_KEY **eckey) {
+  EC_KEY *dtmp;
+  if (!key) {
+    return nullptr;
+  }
+  dtmp = EVP_PKEY_get1_EC_KEY(key);
+  EVP_PKEY_free(key);
+  if (!dtmp) {
+    return nullptr;
+  }
+  if (eckey) {
+    EC_KEY_free(*eckey);
+    *eckey = dtmp;
+  }
+  return dtmp;
+}
+
+EC_KEY *PEM_read_bio_ECPrivateKey(BIO *bp, EC_KEY **key, pem_password_cb *cb,
+                                  void *u) {
+  EVP_PKEY *pktmp;
+  pktmp = PEM_read_bio_PrivateKey(bp, nullptr, cb, u);
+  return pkey_get_eckey(pktmp, key);  // will free pktmp
+}
+
+IMPLEMENT_PEM_write_cb(ECPrivateKey, EC_KEY, PEM_STRING_ECPRIVATEKEY,
+                       ECPrivateKey)
+
+IMPLEMENT_PEM_rw(EC_PUBKEY, EC_KEY, PEM_STRING_PUBLIC, EC_PUBKEY)
+EC_KEY *PEM_read_ECPrivateKey(FILE *fp, EC_KEY **eckey, pem_password_cb *cb,
+                              void *u) {
+  EVP_PKEY *pktmp;
+  pktmp = PEM_read_PrivateKey(fp, nullptr, cb, u);
+  return pkey_get_eckey(pktmp, eckey);  // will free pktmp
+}
+
+
+IMPLEMENT_PEM_rw(DHparams, DH, PEM_STRING_DHPARAMS, DHparams)
+
+IMPLEMENT_PEM_rw(PUBKEY, EVP_PKEY, PEM_STRING_PUBLIC, PUBKEY)

package/runtime/third_party/boringssl/crypto/pem/pem_info.cc

@@ -0,0 +1,250 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/pem.h>
+
+#include <limits.h>
+#include <string.h>
+
+#include <string_view>
+
+#include <openssl/dsa.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/mem.h>
+#include <openssl/obj.h>
+#include <openssl/rsa.h>
+#include <openssl/x509.h>
+
+#include "../mem_internal.h"
+#include "internal.h"
+
+
+using namespace bssl;
+
+static X509_PKEY *X509_PKEY_new() { return New<X509_PKEY>(); }
+
+static void X509_PKEY_free(X509_PKEY *x) {
+  if (x == nullptr) {
+    return;
+  }
+
+  EVP_PKEY_free(x->dec_pkey);
+  Delete(x);
+}
+
+static X509_INFO *X509_INFO_new() { return New<X509_INFO>(); }
+
+void X509_INFO_free(X509_INFO *x) {
+  if (x == nullptr) {
+    return;
+  }
+
+  X509_free(x->x509);
+  X509_CRL_free(x->crl);
+  X509_PKEY_free(x->x_pkey);
+  OPENSSL_free(x->enc_data);
+  Delete(x);
+}
+
+
+STACK_OF(X509_INFO) *PEM_X509_INFO_read(FILE *fp, STACK_OF(X509_INFO) *sk,
+                                        pem_password_cb *cb, void *u) {
+  BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
+  if (b == nullptr) {
+    OPENSSL_PUT_ERROR(PEM, ERR_R_BUF_LIB);
+    return nullptr;
+  }
+  STACK_OF(X509_INFO) *ret = PEM_X509_INFO_read_bio(b, sk, cb, u);
+  BIO_free(b);
+  return ret;
+}
+
+enum parse_result_t {
+  parse_ok,
+  parse_error,
+  parse_new_entry,
+};
+
+static enum parse_result_t parse_x509(X509_INFO *info, const uint8_t *data,
+                                      size_t len, int key_type) {
+  if (info->x509 != nullptr) {
+    return parse_new_entry;
+  }
+  info->x509 = d2i_X509(nullptr, &data, len);
+  return info->x509 != nullptr ? parse_ok : parse_error;
+}
+
+static enum parse_result_t parse_x509_aux(X509_INFO *info, const uint8_t *data,
+                                          size_t len, int key_type) {
+  if (info->x509 != nullptr) {
+    return parse_new_entry;
+  }
+  info->x509 = d2i_X509_AUX(nullptr, &data, len);
+  return info->x509 != nullptr ? parse_ok : parse_error;
+}
+
+static enum parse_result_t parse_crl(X509_INFO *info, const uint8_t *data,
+                                     size_t len, int key_type) {
+  if (info->crl != nullptr) {
+    return parse_new_entry;
+  }
+  info->crl = d2i_X509_CRL(nullptr, &data, len);
+  return info->crl != nullptr ? parse_ok : parse_error;
+}
+
+static enum parse_result_t parse_key(X509_INFO *info, const uint8_t *data,
+                                     size_t len, int key_type) {
+  if (info->x_pkey != nullptr) {
+    return parse_new_entry;
+  }
+  info->x_pkey = X509_PKEY_new();
+  if (info->x_pkey == nullptr) {
+    return parse_error;
+  }
+  info->x_pkey->dec_pkey = d2i_PrivateKey(key_type, nullptr, &data, len);
+  return info->x_pkey->dec_pkey != nullptr ? parse_ok : parse_error;
+}
+
+STACK_OF(X509_INFO) *PEM_X509_INFO_read_bio(BIO *bp, STACK_OF(X509_INFO) *sk,
+                                            pem_password_cb *cb, void *u) {
+  X509_INFO *info = nullptr;
+  UniquePtr<char> name;
+  UniquePtr<char> header;
+  Array<uint8_t> data;
+  int ok = 0;
+  STACK_OF(X509_INFO) *ret = nullptr;
+
+  if (sk == nullptr) {
+    ret = sk_X509_INFO_new_null();
+    if (ret == nullptr) {
+      return nullptr;
+    }
+  } else {
+    ret = sk;
+  }
+  size_t orig_num = sk_X509_INFO_num(ret);
+
+  info = X509_INFO_new();
+  if (info == nullptr) {
+    goto err;
+  }
+
+  for (;;) {
+    if (!PEM_read_bio_inner(bp, &name, &header, &data)) {
+      if (ERR_equals(ERR_peek_last_error(), ERR_LIB_PEM, PEM_R_NO_START_LINE)) {
+        ERR_clear_error();
+        break;
+      }
+      goto err;
+    }
+
+    enum parse_result_t (*parse_function)(X509_INFO *, const uint8_t *, size_t,
+                                          int) = nullptr;
+    int key_type = EVP_PKEY_NONE;
+    std::string_view name_view = name.get();
+    if (name_view == PEM_STRING_X509 || name_view == PEM_STRING_X509_OLD) {
+      parse_function = parse_x509;
+    } else if (name_view == PEM_STRING_X509_TRUSTED) {
+      parse_function = parse_x509_aux;
+    } else if (name_view == PEM_STRING_X509_CRL) {
+      parse_function = parse_crl;
+    } else if (name_view == PEM_STRING_RSA) {
+      parse_function = parse_key;
+      key_type = EVP_PKEY_RSA;
+    } else if (name_view == PEM_STRING_DSA) {
+      parse_function = parse_key;
+      key_type = EVP_PKEY_DSA;
+    } else if (name_view == PEM_STRING_ECPRIVATEKEY) {
+      parse_function = parse_key;
+      key_type = EVP_PKEY_EC;
+    }
+
+    // If a private key has a header, assume it is encrypted. This function does
+    // not decrypt private keys.
+    if (key_type != EVP_PKEY_NONE && strlen(header.get()) > 10) {
+      if (data.size() > INT_MAX) {
+        // We need the data to fit in `info` which forces the size to
+        // fit in one int type.
+        goto err;
+      }
+      if (info->x_pkey != nullptr) {
+        if (!sk_X509_INFO_push(ret, info)) {
+          goto err;
+        }
+        info = X509_INFO_new();
+        if (info == nullptr) {
+          goto err;
+        }
+      }
+      // Use an empty key as a placeholder.
+      info->x_pkey = X509_PKEY_new();
+      if (info->x_pkey == nullptr ||
+          !PEM_get_EVP_CIPHER_INFO(header.get(), &info->enc_cipher)) {
+        goto err;
+      }
+      size_t size;
+      data.Release(reinterpret_cast<uint8_t **>(&info->enc_data), &size);
+      // Safety: we checked that `size` <= `INT_MAX`.
+      info->enc_len = static_cast<int>(size);
+    } else if (parse_function != nullptr) {
+      EVP_CIPHER_INFO cipher;
+      size_t len = data.size();
+      if (!PEM_get_EVP_CIPHER_INFO(header.get(), &cipher) ||
+          !PEM_do_header(&cipher, data.data(), &len, cb, u)) {
+        goto err;
+      }
+      enum parse_result_t result =
+          parse_function(info, data.data(), len, key_type);
+      if (result == parse_new_entry) {
+        if (!sk_X509_INFO_push(ret, info)) {
+          goto err;
+        }
+        info = X509_INFO_new();
+        if (info == nullptr) {
+          goto err;
+        }
+        result = parse_function(info, data.data(), len, key_type);
+      }
+      if (result != parse_ok) {
+        OPENSSL_PUT_ERROR(PEM, ERR_R_ASN1_LIB);
+        goto err;
+      }
+    }
+  }
+
+  // Push the last entry on the stack if not empty.
+  if (info->x509 != nullptr || info->crl != nullptr ||
+      info->x_pkey != nullptr || info->enc_data != nullptr) {
+    if (!sk_X509_INFO_push(ret, info)) {
+      goto err;
+    }
+    info = nullptr;
+  }
+
+  ok = 1;
+
+err:
+  X509_INFO_free(info);
+  if (!ok) {
+    while (sk_X509_INFO_num(ret) > orig_num) {
+      X509_INFO_free(sk_X509_INFO_pop(ret));
+    }
+    if (ret != sk) {
+      sk_X509_INFO_free(ret);
+    }
+    ret = nullptr;
+  }
+  return ret;
+}