Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix double conversion due to aws-lc/boringssl API #893

Conversation

haproxyFred
Copy link
Contributor

This previous patch fixes some warning where several sk_509*() functions return a size_t (awl-lc/boringSSL API) in place of an int (OpenSSL API): 3cd3932

But this introduced others warnings where a double conversions were done into x509vfy.c where a "typedef size_t x509_siz_t" is implemented to fix the same API issue. This is correct but leads after the mentioned commit to such double conversion:
x509_size_t num = sk_X509_CRL_num(crls) ->
size_t num = (int)sk_X509_CRL_num(crls)

This does not please to the compiler ;-)

This simple patch fixes these warnings:

../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreFindCert_ex': ../../../src/openssl/x509vfy.c:218:20: warning: comparison of integer expressions of different signedness: 'x509_size_t' {aka 'long unsigned int'} and 'int' [-Wsign-compare]
218 | for(ii = 0; ii < sk_X509_num(ctx->untrusted); ++ii) {
| ^
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreFindCertByValue':
../../../src/openssl/x509vfy.c:265:20: warning: comparison of integer expressions of different signedness: 'x509_size_t' {aka 'long unsigned int'} and 'int' [-Wsign-compare]
265 | for(ii = 0; ii < sk_X509_num(ctx->untrusted); ++ii) {
| ^
In file included from ../../../src/openssl/x509vfy.c:37:
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreVerifyAndCopyCrls':
../../../src/openssl/openssl_compat.h:66:26: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
66 | #define sk_X509_CRL_num (int)sk_X509_CRL_num
| ^
../../../src/openssl/x509vfy.c:358:11: note: in expansion of macro 'sk_X509_CRL_num'
358 | num = sk_X509_CRL_num(crls);
| ^~~~~~~~~~~~~~~
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreFindBestCrl':
../../../src/openssl/openssl_compat.h:66:26: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
66 | #define sk_X509_CRL_num (int)sk_X509_CRL_num
| ^
../../../src/openssl/x509vfy.c:506:11: note: in expansion of macro 'sk_X509_CRL_num'
506 | num = sk_X509_CRL_num(crls);
| ^~~~~~~~~~~~~~~
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreVerifyCertsAgainstCrls':
../../../src/openssl/openssl_compat.h:65:26: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
65 | #define sk_X509_num (int)sk_X509_num
| ^
../../../src/openssl/x509vfy.c:633:17: note: in expansion of macro 'sk_X509_num'
633 | num_certs = sk_X509_num(chain);
| ^~~~~~~~~~~
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreVerify':
../../../src/openssl/openssl_compat.h:65:26: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
65 | #define sk_X509_num (int)sk_X509_num
| ^
../../../src/openssl/x509vfy.c:862:11: note: in expansion of macro 'sk_X509_num'
862 | num = sk_X509_num(certs);
| ^~~~~~~~~~~
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreCombineCerts':
../../../src/openssl/openssl_compat.h:65:26: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
65 | #define sk_X509_num (int)sk_X509_num
| ^
../../../src/openssl/x509vfy.c:1703:15: note: in expansion of macro 'sk_X509_num'
1703 | num = sk_X509_num(certs2);
| ^~~~~~~~~~~
In file included from ../../../src/openssl/x509vfy.c:15:
../../../src/openssl/x509vfy.c:1707:38: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
1707 | "size=%d", (int)(num + sk_X509_num(res)));
| ^
../../../src/openssl/globals.h:74:22: note: in definition of macro '__xmlSecOpenSSLError2'
74 | (param),
| ^~~~~
../../../src/openssl/x509vfy.c:1706:13: note: in expansion of macro 'xmlSecOpenSSLError2'
1706 | xmlSecOpenSSLError2("sk_X509_reserve(res)", NULL,
| ^~~~~~~~~~~~~~~~~~~
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509FindChildCert':
../../../src/openssl/x509vfy.c:1746:20: warning: comparison of integer expressions of different signedness: 'x509_size_t' {aka 'long unsigned int'} and 'int' [-Wsign-compare]
1746 | for(ii = 0; ii < sk_X509_num(chain); ++ii) {

This previous patch fixes some warning where several sk_509*() functions
return a size_t (awl-lc/boringSSL API) in place of an int (OpenSSL API):
lsh123@3cd3932

But this introduced others warnings where a double conversions were done
into x509vfy.c where a "typedef size_t x509_siz_t" is implemented to
fix the same API issue. This is correct but leads after the mentioned commit
to such double conversion:
       x509_size_t num = sk_X509_CRL_num(crls) ->
       size_t num = (int)sk_X509_CRL_num(crls)

This does not please to the compiler ;-)

This simple patch fixes these warnings:

../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreFindCert_ex':
../../../src/openssl/x509vfy.c:218:20: warning: comparison of integer expressions of different signedness: 'x509_size_t' {aka 'long unsigned int'} and 'int' [-Wsign-compare]
  218 |     for(ii = 0; ii < sk_X509_num(ctx->untrusted); ++ii) {
      |                    ^
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreFindCertByValue':
../../../src/openssl/x509vfy.c:265:20: warning: comparison of integer expressions of different signedness: 'x509_size_t' {aka 'long unsigned int'} and 'int' [-Wsign-compare]
  265 |     for(ii = 0; ii < sk_X509_num(ctx->untrusted); ++ii) {
      |                    ^
In file included from ../../../src/openssl/x509vfy.c:37:
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreVerifyAndCopyCrls':
../../../src/openssl/openssl_compat.h:66:26: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
   66 | #define sk_X509_CRL_num  (int)sk_X509_CRL_num
      |                          ^
../../../src/openssl/x509vfy.c:358:11: note: in expansion of macro 'sk_X509_CRL_num'
  358 |     num = sk_X509_CRL_num(crls);
      |           ^~~~~~~~~~~~~~~
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreFindBestCrl':
../../../src/openssl/openssl_compat.h:66:26: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
   66 | #define sk_X509_CRL_num  (int)sk_X509_CRL_num
      |                          ^
../../../src/openssl/x509vfy.c:506:11: note: in expansion of macro 'sk_X509_CRL_num'
  506 |     num = sk_X509_CRL_num(crls);
      |           ^~~~~~~~~~~~~~~
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreVerifyCertsAgainstCrls':
../../../src/openssl/openssl_compat.h:65:26: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
   65 | #define sk_X509_num      (int)sk_X509_num
      |                          ^
../../../src/openssl/x509vfy.c:633:17: note: in expansion of macro 'sk_X509_num'
  633 |     num_certs = sk_X509_num(chain);
      |                 ^~~~~~~~~~~
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreVerify':
../../../src/openssl/openssl_compat.h:65:26: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
   65 | #define sk_X509_num      (int)sk_X509_num
      |                          ^
../../../src/openssl/x509vfy.c:862:11: note: in expansion of macro 'sk_X509_num'
  862 |     num = sk_X509_num(certs);
      |           ^~~~~~~~~~~
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509StoreCombineCerts':
../../../src/openssl/openssl_compat.h:65:26: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
   65 | #define sk_X509_num      (int)sk_X509_num
      |                          ^
../../../src/openssl/x509vfy.c:1703:15: note: in expansion of macro 'sk_X509_num'
 1703 |         num = sk_X509_num(certs2);
      |               ^~~~~~~~~~~
In file included from ../../../src/openssl/x509vfy.c:15:
../../../src/openssl/x509vfy.c:1707:38: warning: conversion to 'x509_size_t' {aka 'long unsigned int'} from 'int' may change the sign of the result [-Wsign-conversion]
 1707 |                 "size=%d", (int)(num + sk_X509_num(res)));
      |                                      ^
../../../src/openssl/globals.h:74:22: note: in definition of macro '__xmlSecOpenSSLError2'
   74 |                     (param),                                \
      |                      ^~~~~
../../../src/openssl/x509vfy.c:1706:13: note: in expansion of macro 'xmlSecOpenSSLError2'
 1706 |             xmlSecOpenSSLError2("sk_X509_reserve(res)", NULL,
      |             ^~~~~~~~~~~~~~~~~~~
../../../src/openssl/x509vfy.c: In function 'xmlSecOpenSSLX509FindChildCert':
../../../src/openssl/x509vfy.c:1746:20: warning: comparison of integer expressions of different signedness: 'x509_size_t' {aka 'long unsigned int'} and 'int' [-Wsign-compare]
 1746 |     for(ii = 0; ii < sk_X509_num(chain); ++ii) {
@lsh123
Copy link
Owner

lsh123 commented Feb 8, 2025

See better way to fix these in PR #894 and PR #895

@lsh123 lsh123 closed this Feb 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants