Changeset 44e8944 in mod_gnutls

Timestamp:

Jun 15, 2016, 7:27:39 PM (3 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

7e7d328

Parents:

eee1432

Message:

Allocate memory for X.509 and PGP certificates only when needed

Location:

src

Files:

• gnutls_config.c (modified) (4 diffs)
• gnutls_hooks.c (modified) (1 diff)

src/gnutls_config.c

@@ -188 +188 @@
     apr_pool_create(&spool, ptemp);
 
-    sc->cert_pgp = apr_pcalloc(pconf, sizeof(sc->cert_pgp[0]));
-    sc->cert_crt_pgp = apr_pcalloc(pconf, sizeof(sc->cert_crt_pgp[0]));
-    sc->certs_x509_chain =
-        apr_pcalloc(pconf, MAX_CHAIN_SIZE * sizeof(sc->certs_x509_chain[0]));
-    sc->certs_x509_crt_chain =
-        apr_pcalloc(pconf, MAX_CHAIN_SIZE * sizeof(sc->certs_x509_crt_chain[0]));
-
     /* Cleanup function for the GnuTLS structures allocated below */
     apr_pool_cleanup_register(pconf, sc, mgs_pool_free_credentials,
@@ -303 +296 @@
     }
 
-    if (sc->x509_cert_file != NULL && sc->certs_x509_crt_chain[0] == NULL)
-    {
+    if (sc->x509_cert_file != NULL && sc->certs_x509_crt_chain == NULL)
+    {
+        sc->certs_x509_chain =
+            apr_pcalloc(pconf,
+                        MAX_CHAIN_SIZE * sizeof(sc->certs_x509_chain[0]));
+        sc->certs_x509_crt_chain =
+            apr_pcalloc(pconf,
+                        MAX_CHAIN_SIZE * sizeof(sc->certs_x509_crt_chain[0]));
         unsigned int chain_num = MAX_CHAIN_SIZE;
         unsigned format = GNUTLS_X509_FMT_PEM;
@@ -469 +468 @@
     }
 
-    if (sc->pgp_cert_file)
-    {
+    if (sc->pgp_cert_file && sc->cert_pgp == NULL)
+    {
+        sc->cert_pgp = apr_pcalloc(pconf, sizeof(sc->cert_pgp[0]));
+        sc->cert_crt_pgp = apr_pcalloc(pconf, sizeof(sc->cert_crt_pgp[0]));
+
         if (load_datum_from_file(spool, sc->pgp_cert_file, &data) != 0) {
             ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
@@ -1070 +1072 @@
 #endif
     sc->certs = NULL;
+    sc->certs_x509_chain = NULL;
+    sc->certs_x509_crt_chain = NULL;
     sc->certs_x509_chain_num = 0;
     sc->p11_modules = NULL;
     sc->pin = NULL;
 
+    sc->cert_pgp = NULL;
+    sc->cert_crt_pgp = NULL;
     sc->privkey_pgp = NULL;
 #if GNUTLS_VERSION_NUMBER < 0x030312

src/gnutls_hooks.c

@@ -463 +463 @@
         if (sc->enabled == GNUTLS_ENABLED_TRUE &&
             ((sc->certs_x509_chain_num > 0 && sc->privkey_x509 == NULL) ||
-             (sc->cert_crt_pgp[0] != NULL && sc->privkey_pgp == NULL))) {
+             (sc->cert_crt_pgp != NULL && sc->privkey_pgp == NULL)))
+        {
                         ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
                                                 "GnuTLS: Host '%s:%d' is missing a Private Key File!",