OpenSSL 1.0.2 build fix

Author: mtrojnar

src/libp11-int.h

@@ -200,6 +200,8 @@ extern int ERR_load_CKR_strings(void);
 #define PKCS11_DUP(s) \
 	pkcs11_strdup((char *) s, sizeof(s))
 extern char *pkcs11_strdup(char *, size_t);
+extern void *pkcs11_zalloc(size_t);
+extern void pkcs11_clear_free(void *, size_t);
 
 /* Emulate the OpenSSL 1.1 getters */
 #if OPENSSL_VERSION_NUMBER < 0x10100003L || ( defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x3000000L )

src/libpkcs11.c

@@ -71,10 +71,9 @@ C_LoadModule(const char *mspec, CK_FUNCTION_LIST_PTR_PTR funcs,
 	if (funcs_3_2)
 		*funcs_3_2 = NULL;
 
-	mod = OPENSSL_zalloc(sizeof(sc_pkcs11_module_t));
+	mod = pkcs11_zalloc(sizeof(sc_pkcs11_module_t));
 	if (!mod)
 		return NULL;
-
 	mod->_magic = MAGIC;
 
 	/* The caller intentionally selects the PKCS#11 module to load. */

src/p11_ec.c

@@ -584,7 +584,7 @@ static int pkcs11_ecdh_derive(unsigned char **out, size_t *outlen,
 	if (pkcs11_evp_pkey_ecdh_derive(key,
 			params->pPublicData, params->ulPublicDataLen,
 			cofactor_mode, secret, &secretlen) <= 0) {
-		OPENSSL_clear_free(secret, (size_t)key_len);
+		pkcs11_clear_free(secret, (size_t)key_len);
 		return -1;
 	}
 

src/p11_misc.c

@@ -39,6 +39,23 @@ char *pkcs11_strdup(char *mem, size_t size)
 	return res;
 }
 
+void *pkcs11_zalloc(size_t size)
+{
+	void *mem = OPENSSL_malloc(size);
+
+	if (mem)
+		memset(mem, 0, size);
+	return mem;
+}
+
+void pkcs11_clear_free(void *mem, size_t size)
+{
+	if (mem) {
+		OPENSSL_cleanse(mem, size);
+		OPENSSL_free(mem);
+	}
+}
+
 int pkcs11_atomic_add(int *value, int amount, pthread_mutex_t *lock)
 {
 #if defined( _WIN32)

src/p11_pkey.c

@@ -658,7 +658,7 @@ static CK_RV pkcs11_derive_with_mechanism(PKCS11_OBJECT_private *key,
 	if (newkey != CK_INVALID_HANDLE)
 		CRYPTOKI_call(ctx, C_DestroyObject(session, newkey));
 
-	OPENSSL_clear_free(value, value_len_alloc);
+	pkcs11_clear_free(value, value_len_alloc);
 	pkcs11_session_pool_release(slot, session);
 	return rv;
 }
@@ -784,7 +784,7 @@ static CK_RV pkcs11_decapsulate_with_mechanism(
 	if (newkey != CK_INVALID_HANDLE)
 		CRYPTOKI_call(ctx, C_DestroyObject(session, newkey));
 
-	OPENSSL_clear_free(value, value_len_alloc);
+	pkcs11_clear_free(value, value_len_alloc);
 	pkcs11_session_pool_release(slot, session);
 	return rv;
 }
@@ -863,7 +863,12 @@ static int pkcs11_build_digestinfo(const char *mdname,
 	if (x509_sig == NULL)
 		return 0;
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+	alg = x509_sig->algor;
+	digest = x509_sig->digest;
+#else
 	X509_SIG_getm(x509_sig, &alg, &digest);
+#endif
 
 	if (!X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_MD_type(md)), V_ASN1_NULL, NULL))
 		goto err;
@@ -1341,7 +1346,7 @@ extern int pkcs11_evp_pkey_ecdh_derive(PKCS11_OBJECT_private *key,
 
 	rv = pkcs11_derive_with_mechanism(key, &mechanism, secret, secretlen);
 
-	OPENSSL_clear_free(der_pub, der_pub_len);
+	pkcs11_clear_free(der_pub, der_pub_len);
 
 	if (rv != CKR_OK)
 		return -1;