Repository navigation
Expand file tree
/
Copy pathfix_handle_boringssl_and_openssl_incompatibilities.patch
More file actions
89 lines (78 loc) · 4.14 KB
/
Copy pathfix_handle_boringssl_and_openssl_incompatibilities.patch
File metadata and controls
89 lines (78 loc) · 4.14 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Wed, 12 Feb 2020 15:08:04 -0800
Subject: fix: handle BoringSSL and OpenSSL incompatibilities
This patch corrects for incompatibilities between OpenSSL, which Node.js
uses, and BoringSSL, which Electron uses via Chromium.
BoringSSL's sk_*_num() and EVP_MD_size() return size_t where OpenSSL
returns int, so code that hard codes int for these values does not build
cleanly against BoringSSL.
This is a backport of https://github.com/nodejs/node/pull/66752, which
switches those call sites to ncrypto's OPENSSL_SIZE_T (size_t under
BoringSSL, int under OpenSSL). The hunks are kept identical to upstream,
so this patch can be removed once Electron updates to a Node.js version
that includes that change.
diff --git a/src/crypto/crypto_common.cc b/src/crypto/crypto_common.cc
index ea0747511a107c96befd2dae1d7bd56759dd95b6..ad056b5610bc8f0db2137402cecc07e18ff0cd09 100644
--- a/src/crypto/crypto_common.cc
+++ b/src/crypto/crypto_common.cc
@@ -90,7 +90,7 @@ StackOfX509 CloneSSLCerts(X509Pointer&& cert,
if (!peer_certs) return StackOfX509();
if (cert && !sk_X509_push(peer_certs.get(), cert.release()))
return StackOfX509();
- for (int i = 0; i < sk_X509_num(ssl_certs); i++) {
+ for (OPENSSL_SIZE_T i = 0; i < sk_X509_num(ssl_certs); i++) {
X509Pointer cert(X509_dup(sk_X509_value(ssl_certs, i)));
if (!cert || !sk_X509_push(peer_certs.get(), cert.get()))
return StackOfX509();
@@ -106,7 +106,7 @@ MaybeLocal<Object> AddIssuerChainToObject(X509Pointer* cert,
Environment* const env) {
cert->reset(sk_X509_delete(peer_certs.get(), 0));
for (;;) {
- int i;
+ OPENSSL_SIZE_T i;
for (i = 0; i < sk_X509_num(peer_certs.get()); i++) {
X509View ca(sk_X509_value(peer_certs.get(), i));
if (!cert->view().isIssuedBy(ca)) continue;
diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
index 64be71541fe3bdfac768d799d401a7cbcb563879..05e8e5f85c0ba67b90f48278a40f4a5bc8f0b37a 100644
--- a/src/crypto/crypto_context.cc
+++ b/src/crypto/crypto_context.cc
@@ -157,7 +157,7 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
// the CA certificates.
SSL_CTX_clear_extra_chain_certs(ctx);
- for (int i = 0; i < sk_X509_num(extra_certs); i++) {
+ for (OPENSSL_SIZE_T i = 0; i < sk_X509_num(extra_certs); i++) {
X509* ca = sk_X509_value(extra_certs, i);
// NOTE: Increments reference count on `ca`
@@ -2526,7 +2526,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
}
// Add CA certs too
- for (int i = 0; i < sk_X509_num(extra_certs.get()); i++) {
+ for (OPENSSL_SIZE_T i = 0; i < sk_X509_num(extra_certs.get()); i++) {
X509* ca = sk_X509_value(extra_certs.get(), i);
X509_STORE_add_cert(sc->GetCertStoreOwnedByThisSecureContext(), ca);
diff --git a/src/crypto/crypto_hash.cc b/src/crypto/crypto_hash.cc
index 085cebdef06ba9cf1d00b0437f4d07460f838137..c7b21e60de2470d09fdb918920c450ab491a783a 100644
--- a/src/crypto/crypto_hash.cc
+++ b/src/crypto/crypto_hash.cc
@@ -374,7 +374,7 @@ void OneShotDigestWithMD(Environment* env,
enum encoding output_enc = ParseEncoding(isolate, args[4], args[5], HEX);
bool is_xof = (EVP_MD_flags(md) & EVP_MD_FLAG_XOF) != 0;
- int output_length = EVP_MD_size(md);
+ OPENSSL_SIZE_T output_length = EVP_MD_size(md);
// This is to cause hash() to fail when an incorrect
// outputLength option was passed for a non-XOF hash function.
diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc
index 4339d6ab4382037bf5ddab014211add3611dd036..c7dbe956149b479883ef1921db59b38dad7a55fd 100644
--- a/src/crypto/crypto_x509.cc
+++ b/src/crypto/crypto_x509.cc
@@ -1028,7 +1028,8 @@ MaybeLocal<Object> X509Certificate::NewWithIssuers(
}
Local<Object> issuer;
- if (issuer_chain != nullptr && start < sk_X509_num(issuer_chain)) {
+ if (issuer_chain != nullptr &&
+ static_cast<OPENSSL_SIZE_T>(start) < sk_X509_num(issuer_chain)) {
X509Pointer issuer_cert =
X509View(sk_X509_value(issuer_chain, start)).clone();
if (!issuer_cert) [[unlikely]] {