/usr/src/usr.bin/openssl/cms.c

Bug Summary

File:	src/usr.bin/openssl/cms.c
Warning:	line 290, column 24 Access to field 'next' results in a dereference of a null pointer (loaded from field 'key_param')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name cms.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/openssl/obj -resource-dir /usr/local/llvm16/lib/clang/16 -D LIBRESSL_INTERNAL -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/openssl/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.bin/openssl/cms.c
1/* $OpenBSD: cms.c,v 1.35 2023/11/21 17:56:19 tb Exp $ */
2/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
* project.
*/
5/* ====================================================================
* Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in
*    the documentation and/or other materials provided with the
*    distribution.
*
* 3. All advertising materials mentioning features or use of this
*    software must display the following acknowledgment:
*    "This product includes software developed by the OpenSSL Project
*    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
*
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
*    endorse or promote products derived from this software without
*    prior written permission. For written permission, please contact
*    licensing@OpenSSL.org.
*
* 5. Products derived from this software may not be called "OpenSSL"
*    nor may "OpenSSL" appear in their names without prior written
*    permission of the OpenSSL Project.
*
* 6. Redistributions of any form whatsoever must retain the following
*    acknowledgment:
*    "This product includes software developed by the OpenSSL Project
*    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
*
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
* OF THE POSSIBILITY OF SUCH DAMAGE.
* ====================================================================
*/

54/* CMS utility function */

56#include <stdio.h>
57#include <string.h>

59#include "apps.h"

61#ifndef OPENSSL_NO_CMS

63#include <openssl/crypto.h>
64#include <openssl/err.h>
65#include <openssl/pem.h>
66#include <openssl/x509_vfy.h>
67#include <openssl/x509v3.h>

69#include <openssl/cms.h>

71static int save_certs(char *signerfile, STACK_OF(X509)struct stack_st_X509 *signers);
72static void receipt_request_print(BIO *out, CMS_ContentInfo *cms);
73static CMS_ReceiptRequest *make_receipt_request(
  STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *rr_to, int rr_allorfirst,
  STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *rr_from);
76static int cms_set_pkey_param(EVP_PKEY_CTX *pctx,
  STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *param);

79#define SMIME_OP0x10	0x10
80#define SMIME_IP0x20	0x20
81#define SMIME_SIGNERS0x40	0x40
82#define SMIME_ENCRYPT(1 | 0x10)		(1 | SMIME_OP0x10)
83#define SMIME_DECRYPT(2 | 0x20)		(2 | SMIME_IP0x20)
84#define SMIME_SIGN(3 | 0x10 | 0x40)		(3 | SMIME_OP0x10 | SMIME_SIGNERS0x40)
85#define SMIME_VERIFY(4 | 0x20)		(4 | SMIME_IP0x20)
86#define SMIME_CMSOUT(5 | 0x20 | 0x10)		(5 | SMIME_IP0x20 | SMIME_OP0x10)
87#define SMIME_RESIGN(6 | 0x20 | 0x10 | 0x40)		(6 | SMIME_IP0x20 | SMIME_OP0x10 | SMIME_SIGNERS0x40)
88#define SMIME_DATAOUT(7 | 0x20)		(7 | SMIME_IP0x20)
89#define SMIME_DATA_CREATE(8 | 0x10)	(8 | SMIME_OP0x10)
90#define SMIME_DIGEST_VERIFY(9 | 0x20)	(9 | SMIME_IP0x20)
91#define SMIME_DIGEST_CREATE(10 | 0x10)	(10 | SMIME_OP0x10)
92#define SMIME_UNCOMPRESS(11 | 0x20)	(11 | SMIME_IP0x20)
93#define SMIME_COMPRESS(12 | 0x10)		(12 | SMIME_OP0x10)
94#define SMIME_ENCRYPTED_DECRYPT(13 | 0x20)	(13 | SMIME_IP0x20)
95#define SMIME_ENCRYPTED_ENCRYPT(14 | 0x10)	(14 | SMIME_OP0x10)
96#define SMIME_SIGN_RECEIPT(15 | 0x20 | 0x10)	(15 | SMIME_IP0x20 | SMIME_OP0x10)
97#define SMIME_VERIFY_RECEIPT(16 | 0x20)	(16 | SMIME_IP0x20)

99int verify_err = 0;

101struct cms_key_param {
int idx;
STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *param;
struct cms_key_param *next;
105};

107static struct {
char *CAfile;
char *CApath;
X509 *cert;
char *certfile;
char *certsoutfile;
const EVP_CIPHER *cipher;
char *contfile;
ASN1_OBJECT *econtent_type;
STACK_OF(X509)struct stack_st_X509 *encerts;
int flags;
char *from;
char *infile;
int informat;
struct cms_key_param *key_first;
struct cms_key_param *key_param;
char *keyfile;
int keyform;
int noout;
int operation;
char *outfile;
int outformat;
char *passargin;
int print;
unsigned char *pwri_pass;
int rr_allorfirst;
STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *rr_from;
int rr_print;
STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *rr_to;
char *rctfile;
int rctformat;
char *recipfile;
unsigned char *secret_key;
unsigned char *secret_keyid;
size_t secret_keyidlen;
size_t secret_keylen;
const EVP_MD *sign_md;
char *signerfile;
STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *skkeys;
STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *sksigners;
char *subject;
char *to;
int verify_retcode;
X509_VERIFY_PARAM *vpm;
151} cfg;

153static const EVP_CIPHER *
154get_cipher_by_name(char *name)
155{
if (name == NULL((void *)0) || strcmp(name, "") == 0)
return (NULL((void *)0));
158#ifndef OPENSSL_NO_AES
else if (strcmp(name, "aes128") == 0)
return EVP_aes_128_cbc();
else if (strcmp(name, "aes192") == 0)
return EVP_aes_192_cbc();
else if (strcmp(name, "aes256") == 0)
return EVP_aes_256_cbc();
165#endif
166#ifndef OPENSSL_NO_CAMELLIA
else if (strcmp(name, "camellia128") == 0)
return EVP_camellia_128_cbc();
else if (strcmp(name, "camellia192") == 0)
return EVP_camellia_192_cbc();
else if (strcmp(name, "camellia256") == 0)
return EVP_camellia_256_cbc();
173#endif
174#ifndef OPENSSL_NO_DES
else if (strcmp(name, "des") == 0)
return EVP_des_cbc();
else if (strcmp(name, "des3") == 0)
return EVP_des_ede3_cbc();
179#endif
180#ifndef OPENSSL_NO_RC2
else if (!strcmp(name, "rc2-40"))
return EVP_rc2_40_cbc();
else if (!strcmp(name, "rc2-64"))
return EVP_rc2_64_cbc();
else if (!strcmp(name, "rc2-128"))
return EVP_rc2_cbc();
187#endif
else
return (NULL((void *)0));
190}

192static int
193cms_opt_cipher(int argc, char **argv, int *argsused)
194{
char *name = argv[0];

if (*name++ != '-')
return (1);

if ((cfg.cipher = get_cipher_by_name(name)) == NULL((void *)0))
if ((cfg.cipher = EVP_get_cipherbyname(name)) == NULL((void *)0))
	return (1);

*argsused = 1;
return (0);
206}

208static int
209cms_opt_econtent_type(char *arg)
210{
ASN1_OBJECT_free(cfg.econtent_type);

if ((cfg.econtent_type = OBJ_txt2obj(arg, 0)) == NULL((void *)0)) {
BIO_printf(bio_err, "Invalid OID %s\n", arg);
return (1);
}
return (0);
218}

220static int
221cms_opt_inkey(char *arg)
222{
if (cfg.keyfile == NULL((void *)0)) {
cfg.keyfile = arg;
return (0);
}

if (cfg.signerfile == NULL((void *)0)) {
BIO_puts(bio_err, "Illegal -inkey without -signer\n");
return (1);
}

if (cfg.sksigners == NULL((void *)0))
cfg.sksigners = sk_OPENSSL_STRING_new_null()((struct stack_st_OPENSSL_STRING *)sk_new_null());
if (cfg.sksigners == NULL((void *)0))
return (1);
if (!sk_OPENSSL_STRING_push(cfg.sksigners, cfg.signerfile)sk_push(((_STACK*) (1 ? cfg.sksigners : (struct stack_st_OPENSSL_STRING
*)0)), ((void*) (1 ? cfg.signerfile : (char*)0))))
return (1);

cfg.signerfile = NULL((void *)0);

if (cfg.skkeys == NULL((void *)0))
cfg.skkeys = sk_OPENSSL_STRING_new_null()((struct stack_st_OPENSSL_STRING *)sk_new_null());
if (cfg.skkeys == NULL((void *)0))
return (1);
if (!sk_OPENSSL_STRING_push(cfg.skkeys, cfg.keyfile)sk_push(((_STACK*) (1 ? cfg.skkeys : (struct stack_st_OPENSSL_STRING
*)0)), ((void*) (1 ? cfg.keyfile : (char*)0))))
return (1);

cfg.keyfile = arg;
return (0);
251}

253static int
254cms_opt_keyopt(char *arg)
255{
int keyidx = -1;

if (cfg.operation == SMIME_ENCRYPT(1 | 0x10)) {
1
Assuming the condition is true→
2
←
Taking true branch→
if (cfg.encerts != NULL((void *)0))
3
←
Assuming field 'encerts' is not equal to NULL→
4
←
Taking true branch→
	keyidx += sk_X509_num(cfg.encerts)sk_num(((_STACK*) (1 ? (cfg.encerts) : (struct stack_st_X509*
)0)));
5
←
'?' condition is true→
} else {
if (cfg.keyfile != NULL((void *)0) || cfg.signerfile != NULL((void *)0))
	keyidx++;
if (cfg.skkeys != NULL((void *)0))
	keyidx += sk_OPENSSL_STRING_num(cfg.skkeys)sk_num(((_STACK*) (1 ? cfg.skkeys : (struct stack_st_OPENSSL_STRING
*)0)));
}

if (keyidx < 0) {
6
←
Assuming 'keyidx' is >= 0→
BIO_printf(bio_err, "No key specified\n");
return (1);
}

if (cfg.key_param == NULL((void *)0) ||
7
←
Assuming field 'key_param' is equal to NULL→
   cfg.key_param->idx != keyidx) {
struct cms_key_param *nparam;

if ((nparam = calloc(1, sizeof(struct cms_key_param))) == NULL((void *)0))
8
←
Assuming the condition is false→
9
←
Taking false branch→
	return (1);

nparam->idx = keyidx;
if ((nparam->param = sk_OPENSSL_STRING_new_null()((struct stack_st_OPENSSL_STRING *)sk_new_null())) == NULL((void *)0)) {
10
←
Assuming the condition is false→
11
←
Taking false branch→
	free(nparam);
	return (1);
}

nparam->next = NULL((void *)0);
if (cfg.key_first == NULL((void *)0))
12
←
Assuming field 'key_first' is not equal to NULL→
13
←
Taking false branch→
	cfg.key_first = nparam;
else
	cfg.key_param->next = nparam;
14
←
Access to field 'next' results in a dereference of a null pointer (loaded from field 'key_param')

cfg.key_param = nparam;
}

if (!sk_OPENSSL_STRING_push(cfg.key_param->param, arg)sk_push(((_STACK*) (1 ? cfg.key_param->param : (struct stack_st_OPENSSL_STRING
*)0)), ((void*) (1 ? arg : (char*)0))))
return (1);

return (0);
299}

301static int
302cms_opt_md(char *arg)
303{
if ((cfg.sign_md = EVP_get_digestbyname(arg)) == NULL((void *)0)) {
BIO_printf(bio_err, "Unknown digest %s\n", arg);
return (1);
}
return (0);
309}

311static int
312cms_opt_print(void)
313{
cfg.noout = 1;
cfg.print = 1;
return (0);
317}

319static int
320cms_opt_pwri_pass(char *arg)
321{
cfg.pwri_pass = (unsigned char *)arg;
return (0);
324}

326static int
327cms_opt_recip(char *arg)
328{
if (cfg.operation == SMIME_ENCRYPT(1 | 0x10)) {
if (cfg.encerts == NULL((void *)0)) {
	if ((cfg.encerts = sk_X509_new_null()((struct stack_st_X509 *)sk_new_null())) == NULL((void *)0))
		return (1);
}

cfg.cert = load_cert(bio_err, arg, FORMAT_PEM3,
    NULL((void *)0), "recipient certificate file");
if (cfg.cert == NULL((void *)0))
	return (1);

if (!sk_X509_push(cfg.encerts, cfg.cert)sk_push(((_STACK*) (1 ? (cfg.encerts) : (struct stack_st_X509
*)0)), ((void*) (1 ? (cfg.cert) : (X509*)0))))
	return (1);

cfg.cert = NULL((void *)0);
} else {
cfg.recipfile = arg;
}
return (0);
348}

350static int
351cms_opt_receipt_request_from(char *arg)
352{
if (cfg.rr_from == NULL((void *)0))
cfg.rr_from = sk_OPENSSL_STRING_new_null()((struct stack_st_OPENSSL_STRING *)sk_new_null());
if (cfg.rr_from == NULL((void *)0))
return (1);
if (!sk_OPENSSL_STRING_push(cfg.rr_from, arg)sk_push(((_STACK*) (1 ? cfg.rr_from : (struct stack_st_OPENSSL_STRING
*)0)), ((void*) (1 ? arg : (char*)0))))
return (1);

return (0);
361}

363static int
364cms_opt_receipt_request_to(char *arg)
365{
if (cfg.rr_to == NULL((void *)0))
cfg.rr_to = sk_OPENSSL_STRING_new_null()((struct stack_st_OPENSSL_STRING *)sk_new_null());
if (cfg.rr_to == NULL((void *)0))
return (1);
if (!sk_OPENSSL_STRING_push(cfg.rr_to, arg)sk_push(((_STACK*) (1 ? cfg.rr_to : (struct stack_st_OPENSSL_STRING
*)0)), ((void*) (1 ? arg : (char*)0))))
return (1);

return (0);
374}

376static int
377cms_opt_secretkey(char *arg)
378{
long ltmp;

free(cfg.secret_key);

if ((cfg.secret_key = string_to_hex(arg, &ltmp)) == NULL((void *)0)) {
BIO_printf(bio_err, "Invalid key %s\n", arg);
return (1);
}
cfg.secret_keylen = (size_t)ltmp;
return (0);
389}

391static int
392cms_opt_secretkeyid(char *arg)
393{
long ltmp;

free(cfg.secret_keyid);

if ((cfg.secret_keyid = string_to_hex(arg, &ltmp)) == NULL((void *)0)) {
BIO_printf(bio_err, "Invalid id %s\n", arg);
return (1);
}
cfg.secret_keyidlen = (size_t)ltmp;
return (0);
404}

406static int
407cms_opt_signer(char *arg)
408{
if (cfg.signerfile == NULL((void *)0)) {
cfg.signerfile = arg;
return (0);
}

if (cfg.sksigners == NULL((void *)0))
cfg.sksigners = sk_OPENSSL_STRING_new_null()((struct stack_st_OPENSSL_STRING *)sk_new_null());
if (cfg.sksigners == NULL((void *)0))
return (1);
if (!sk_OPENSSL_STRING_push(cfg.sksigners, cfg.signerfile)sk_push(((_STACK*) (1 ? cfg.sksigners : (struct stack_st_OPENSSL_STRING
*)0)), ((void*) (1 ? cfg.signerfile : (char*)0))))
return (1);

if (cfg.keyfile == NULL((void *)0))
cfg.keyfile = cfg.signerfile;

if (cfg.skkeys == NULL((void *)0))
cfg.skkeys = sk_OPENSSL_STRING_new_null()((struct stack_st_OPENSSL_STRING *)sk_new_null());
if (cfg.skkeys == NULL((void *)0))
return (1);
if (!sk_OPENSSL_STRING_push(cfg.skkeys, cfg.keyfile)sk_push(((_STACK*) (1 ? cfg.skkeys : (struct stack_st_OPENSSL_STRING
*)0)), ((void*) (1 ? cfg.keyfile : (char*)0))))
return (1);

cfg.keyfile = NULL((void *)0);

cfg.signerfile = arg;
return (0);
435}

437static int
438cms_opt_verify_param(int argc, char **argv, int *argsused)
439{
int oargc = argc;
int badarg = 0;

if (!args_verify(&argv, &argc, &badarg, bio_err, &cfg.vpm))
return (1);
if (badarg)
return (1);

*argsused = oargc - argc;

return (0);
451}

453static int
454cms_opt_verify_receipt(char *arg)
455{
cfg.operation = SMIME_VERIFY_RECEIPT(16 | 0x20);
cfg.rctfile = arg;
return (0);
459}

461static const struct option cms_options[] = {
462#ifndef OPENSSL_NO_AES
{
.name = "aes128",
.desc = "Encrypt PEM output with CBC AES",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
{
.name = "aes192",
.desc = "Encrypt PEM output with CBC AES",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
{
.name = "aes256",
.desc = "Encrypt PEM output with CBC AES",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
481#endif
482#ifndef OPENSSL_NO_CAMELLIA
{
.name = "camellia128",
.desc = "Encrypt PEM output with CBC Camellia",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
{
.name = "camellia192",
.desc = "Encrypt PEM output with CBC Camellia",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
{
.name = "camellia256",
.desc = "Encrypt PEM output with CBC Camellia",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
501#endif
502#ifndef OPENSSL_NO_DES
{
.name = "des",
.desc = "Encrypt with DES",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
{
.name = "des3",
.desc = "Encrypt with triple DES (default)",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
515#endif
516#ifndef OPENSSL_NO_RC2
{
.name = "rc2-40",
.desc = "Encrypt with RC2-40",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
{
.name = "rc2-64",
.desc = "Encrypt with RC2-64",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
{
.name = "rc2-128",
.desc = "Encrypt with RC2-128",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
535#endif
{
.name = "CAfile",
.argname = "file",
.desc = "Certificate Authority file",
.type = OPTION_ARG,
.opt.arg = &cfg.CAfile,
},
{
.name = "CApath",
.argname = "path",
.desc = "Certificate Authority path",
.type = OPTION_ARG,
.opt.arg = &cfg.CApath,
},
{
.name = "binary",
.desc = "Do not translate message to text",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_BINARY0x80,
},
{
.name = "certfile",
.argname = "file",
.desc = "Other certificates file",
.type = OPTION_ARG,
.opt.arg = &cfg.certfile,
},
{
.name = "certsout",
.argname = "file",
.desc = "Certificate output file",
.type = OPTION_ARG,
.opt.arg = &cfg.certsoutfile,
},
{
.name = "cmsout",
.desc = "Output CMS structure",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_CMSOUT(5 | 0x20 | 0x10),
},
{
.name = "compress",
.desc = "Create CMS CompressedData type",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_COMPRESS(12 | 0x10),
},
{
.name = "content",
.argname = "file",
.desc = "Supply or override content for detached signature",
.type = OPTION_ARG,
.opt.arg = &cfg.contfile,
},
{
.name = "crlfeol",
.desc = "Use CRLF as EOL termination instead of CR only",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_CRLFEOL0x800,
},
{
.name = "data_create",
.desc = "Create CMS Data type",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_DATA_CREATE(8 | 0x10),
},
{
.name = "data_out",
.desc = "Output content from the input CMS Data type",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_DATAOUT(7 | 0x20),
},
{
.name = "debug_decrypt",
.desc = "Set the CMS_DEBUG_DECRYPT flag when decrypting",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_DEBUG_DECRYPT0x20000,
},
{
.name = "decrypt",
.desc = "Decrypt encrypted message",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_DECRYPT(2 | 0x20),
},
{
.name = "digest_create",
.desc = "Create CMS DigestedData type",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_DIGEST_CREATE(10 | 0x10),
},
{
.name = "digest_verify",
.desc = "Verify CMS DigestedData type and output the content",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_DIGEST_VERIFY(9 | 0x20),
},
{
.name = "econtent_type",
.argname = "type",
.desc = "Set the encapsulated content type",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_econtent_type,
},
{
.name = "encrypt",
.desc = "Encrypt message",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_ENCRYPT(1 | 0x10),
},
{
.name = "EncryptedData_decrypt",
.desc = "Decrypt CMS EncryptedData",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_ENCRYPTED_DECRYPT(13 | 0x20),
},
{
.name = "EncryptedData_encrypt",
.desc = "Encrypt content using supplied symmetric key and algorithm",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_ENCRYPTED_ENCRYPT(14 | 0x10),
},
{
.name = "from",
.argname = "addr",
.desc = "From address",
.type = OPTION_ARG,
.opt.arg = &cfg.from,
},
{
.name = "in",
.argname = "file",
.desc = "Input file",
.type = OPTION_ARG,
.opt.arg = &cfg.infile,
},
{
.name = "indef",
.desc = "Same as -stream",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_STREAM0x1000,
},
{
.name = "inform",
.argname = "fmt",
.desc = "Input format (DER, PEM or SMIME (default))",
.type = OPTION_ARG_FORMAT,
.opt.value = &cfg.informat,
},
{
.name = "inkey",
.argname = "file",
.desc = "Input key file",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_inkey,
},
{
.name = "keyform",
.argname = "fmt",
.desc = "Input key format (DER or PEM (default))",
.type = OPTION_ARG_FORMAT,
.opt.value = &cfg.keyform,
},
{
.name = "keyid",
.desc = "Use subject key identifier",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_USE_KEYID0x10000,
},
{
.name = "keyopt",
.argname = "nm:v",
.desc = "Set public key parameters",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_keyopt,
},
{
.name = "md",
.argname = "digest",
.desc = "Digest to use when signing or resigning",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_md,
},
{
.name = "no_attr_verify",
.desc = "Do not verify the signer's attribute of a signature",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_NO_ATTR_VERIFY0x8,
},
{
.name = "no_content_verify",
.desc = "Do not verify the content of a signed message",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_NO_CONTENT_VERIFY0x4,
},
{
.name = "no_signer_cert_verify",
.desc = "Do not verify the signer's certificate",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_NO_SIGNER_CERT_VERIFY0x20,
},
{
.name = "noattr",
.desc = "Do not include any signed attributes",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_NOATTR0x100,
},
{
.name = "nocerts",
.desc = "Do not include signer's certificate when signing",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_NOCERTS0x2,
},
{
.name = "nodetach",
.desc = "Use opaque signing",
.type = OPTION_VALUE_AND,
.opt.value = &cfg.flags,
.value = ~CMS_DETACHED0x40,
},
{
.name = "noindef",
.desc = "Disable CMS streaming",
.type = OPTION_VALUE_AND,
.opt.value = &cfg.flags,
.value = ~CMS_STREAM0x1000,
},
{
.name = "nointern",
.desc = "Do not search certificates in message for signer",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_NOINTERN0x10,
},
{
.name = "nooldmime",
.desc = "Output old S/MIME content type",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_NOOLDMIMETYPE0x400,
},
{
.name = "noout",
.desc = "Do not output the parsed CMS structure",
.type = OPTION_FLAG,
.opt.flag = &cfg.noout,
},
{
.name = "nosigs",
.desc = "Do not verify message signature",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_NOSIGS(0x4|0x8),
},
{
.name = "nosmimecap",
.desc = "Omit the SMIMECapabilities attribute",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_NOSMIMECAP0x200,
},
{
.name = "noverify",
.desc = "Do not verify signer's certificate",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_NO_SIGNER_CERT_VERIFY0x20,
},
{
.name = "out",
.argname = "file",
.desc = "Output file",
.type = OPTION_ARG,
.opt.arg = &cfg.outfile,
},
{
.name = "outform",
.argname = "fmt",
.desc = "Output format (DER, PEM or SMIME (default))",
.type = OPTION_ARG_FORMAT,
.opt.value = &cfg.outformat,
},
{
.name = "passin",
.argname = "src",
.desc = "Private key password source",
.type = OPTION_ARG,
.opt.arg = &cfg.passargin,
},
{
.name = "print",
.desc = "Print out all fields of the CMS structure for the -cmsout",
.type = OPTION_FUNC,
.opt.func = cms_opt_print,
},
{
.name = "pwri_password",
.argname = "arg",
.desc = "Specify PasswordRecipientInfo (PWRI) password to use",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_pwri_pass,
},
{
.name = "rctform",
.argname = "fmt",
.desc = "Receipt file format (DER, PEM or SMIME (default))",
.type = OPTION_ARG_FORMAT,
.opt.value = &cfg.rctformat,
},
{
.name = "receipt_request_all",
.desc = "Indicate requests should be provided by all recipients",
.type = OPTION_VALUE,
.opt.value = &cfg.rr_allorfirst,
.value = 0,
},
{
.name = "receipt_request_first",
.desc = "Indicate requests should be provided by first tier recipient",
.type = OPTION_VALUE,
.opt.value = &cfg.rr_allorfirst,
.value = 1,
},
{
.name = "receipt_request_from",
.argname = "addr",
.desc = "Add explicit email address where receipts should be supplied",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_receipt_request_from,
},
{
.name = "receipt_request_print",
.desc = "Print out the contents of any signed receipt requests",
.type = OPTION_FLAG,
.opt.flag = &cfg.rr_print,
},
{
.name = "receipt_request_to",
.argname = "addr",
.desc = "Add explicit email address where receipts should be sent to",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_receipt_request_to,
},
{
.name = "recip",
.argname = "file",
.desc = "Recipient certificate file for decryption",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_recip,
},
{
.name = "resign",
.desc = "Resign a signed message",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_RESIGN(6 | 0x20 | 0x10 | 0x40),
},
{
.name = "secretkey",
.argname = "key",
.desc = "Specify symmetric key to use",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_secretkey,
},
{
.name = "secretkeyid",
.argname = "id",
.desc = "The key identifier for the supplied symmetric key",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_secretkeyid,
},
{
.name = "sign",
.desc = "Sign message",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_SIGN(3 | 0x10 | 0x40),
},
{
.name = "sign_receipt",
.desc = "Generate a signed receipt for the message",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_SIGN_RECEIPT(15 | 0x20 | 0x10),
},
{
.name = "signer",
.argname = "file",
.desc = "Signer certificate file",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_signer,
},
{
.name = "stream",
.desc = "Enable CMS streaming",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_STREAM0x1000,
},
{
.name = "subject",
.argname = "s",
.desc = "Subject",
.type = OPTION_ARG,
.opt.arg = &cfg.subject,
},
{
.name = "text",
.desc = "Include or delete text MIME headers",
.type = OPTION_VALUE_OR,
.opt.value = &cfg.flags,
.value = CMS_TEXT0x1,
},
{
.name = "to",
.argname = "addr",
.desc = "To address",
.type = OPTION_ARG,
.opt.arg = &cfg.to,
},
{
.name = "uncompress",
.desc = "Uncompress CMS CompressedData type",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_UNCOMPRESS(11 | 0x20),
},
{
.name = "verify",
.desc = "Verify signed message",
.type = OPTION_VALUE,
.opt.value = &cfg.operation,
.value = SMIME_VERIFY(4 | 0x20),
},
{
.name = "verify_receipt",
.argname = "file",
.desc = "Verify a signed receipt in file",
.type = OPTION_ARG_FUNC,
.opt.argfunc = cms_opt_verify_receipt,
},
{
.name = "verify_retcode",
.desc = "Set verification error code to exit code",
.type = OPTION_FLAG,
.opt.flag = &cfg.verify_retcode,
},
{
.name = "check_ss_sig",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_verify_param,
},
{
.name = "crl_check",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_verify_param,
},
{
.name = "crl_check_all",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_verify_param,
},
{
.name = "extended_crl",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_verify_param,
},
{
.name = "ignore_critical",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_verify_param,
},
{
.name = "issuer_checks",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_verify_param,
},
{
.name = "policy",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_verify_param,
},
{
.name = "policy_check",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_verify_param,
},
{
.name = "purpose",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_verify_param,
},
{
.name = "x509_strict",
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_verify_param,
},
{
.name = NULL((void *)0),
.type = OPTION_ARGV_FUNC,
.opt.argvfunc = cms_opt_cipher,
},
{ NULL((void *)0) },
1057};

1059static const struct option verify_shared_options[] = {
{
.name = "check_ss_sig",
.desc = "Check the root CA self-signed certificate signature",
},
{
.name = "crl_check",
.desc = "Enable CRL checking for the leaf certificate",
},
{
.name = "crl_check_all",
.desc = "Enable CRL checking for the entire certificate chain",
},
{
.name = "extended_crl",
.desc = "Enable extended CRL support",
},
{
.name = "ignore_critical",
.desc = "Disable critical extension checking",
},
{
.name = "issuer_checks",
.desc = "Enable debugging of certificate issuer checks",
},
{
.name = "policy",
.argname = "name",
.desc = "Add given policy to the acceptable set",
},
{
.name = "policy_check",
.desc = "Enable certificate policy checking",
},
{
.name = "purpose",
.argname = "name",
.desc = "Verify for the given purpose",
},
{
.name = "x509_strict",
.desc = "Use strict X.509 rules (disables workarounds)",
},
{ NULL((void *)0) },
1103};

1105static void
1106cms_usage(void)
1107{
int i;

fprintf(stderr(&__sF[2]), "usage: cms "
   "[-aes128 | -aes192 | -aes256 | -camellia128 |\n"
   "    -camellia192 | -camellia256 | -des | -des3 |\n"
   "    -rc2-40 | -rc2-64 | -rc2-128] [-CAfile file]\n"
   "    [-CApath directory] [-binary] [-certfile file]\n"
   "    [-certsout file] [-cmsout] [-compress] [-content file]\n"
   "    [-crlfeol] [-data_create] [-data_out] [-debug_decrypt]\n"
   "    [-decrypt] [-digest_create] [-digest_verify]\n"
   "    [-econtent_type type] [-encrypt] [-EncryptedData_decrypt]\n"
   "    [-EncryptedData_encrypt] [-from addr] [-in file]\n"
   "    [-inform der | pem | smime] [-inkey file]\n"
   "    [-keyform der | pem] [-keyid] [-keyopt nm:v] [-md digest]\n"
   "    [-no_attr_verify] [-no_content_verify]\n"
   "    [-no_signer_cert_verify] [-noattr] [-nocerts] [-nodetach]\n"
   "    [-nointern] [-nooldmime] [-noout] [-nosigs] [-nosmimecap]\n"
   "    [-noverify] [-out file] [-outform der | pem | smime]\n"
   "    [-passin src] [-print] [-pwri_password arg]\n"
   "    [-rctform der | pem | smime]\n"
   "    [-receipt_request_all | -receipt_request_first]\n"
   "    [-receipt_request_from addr] [-receipt_request_print]\n"
   "    [-receipt_request_to addr] [-recip file] [-resign]\n"
   "    [-secretkey key] [-secretkeyid id] [-sign] [-sign_receipt]\n"
   "    [-signer file] [-stream | -indef | -noindef] [-subject s]\n"
   "    [-text] [-to addr] [-uncompress] [-verify]\n"
   "    [-verify_receipt file] [-verify_retcode] [cert.pem ...]\n\n");

options_usage(cms_options);

fprintf(stderr(&__sF[2]), "\nVerification options:\n\n");
options_usage(verify_shared_options);

fprintf(stderr(&__sF[2]), "\nValid purposes:\n\n");
for (i = 0; i < X509_PURPOSE_get_count(); i++) {
const X509_PURPOSE *ptmp = X509_PURPOSE_get0(i);
fprintf(stderr(&__sF[2]), "  %-18s%s\n", X509_PURPOSE_get0_sname(ptmp),
    X509_PURPOSE_get0_name(ptmp));
}
1147}

1149int
1150cms_main(int argc, char **argv)
1151{
int ret = 0;
char **args;
int argsused = 0;
const char *inmode = "r", *outmode = "w";
CMS_ContentInfo *cms = NULL((void *)0), *rcms = NULL((void *)0);
X509_STORE *store = NULL((void *)0);
X509 *recip = NULL((void *)0), *signer = NULL((void *)0);
EVP_PKEY *key = NULL((void *)0);
STACK_OF(X509)struct stack_st_X509 *other = NULL((void *)0);
BIO *in = NULL((void *)0), *out = NULL((void *)0), *indata = NULL((void *)0), *rctin = NULL((void *)0);
int badarg = 0;
CMS_ReceiptRequest *rr = NULL((void *)0);
char *passin = NULL((void *)0);
unsigned char *pwri_tmp = NULL((void *)0);

if (pledge("stdio rpath wpath cpath tty", NULL((void *)0)) == -1) {
perror("pledge");
exit(1);
}

memset(&cfg, 0, sizeof(cfg));
cfg.flags = CMS_DETACHED0x40;
cfg.rr_allorfirst = -1;
cfg.informat = FORMAT_SMIME6;
cfg.outformat = FORMAT_SMIME6;
cfg.rctformat = FORMAT_SMIME6;
cfg.keyform = FORMAT_PEM3;
if (options_parse(argc, argv, cms_options, NULL((void *)0), &argsused) != 0) {
goto argerr;
}
args = argv + argsused;
ret = 1;

if (((cfg.rr_allorfirst != -1) || cfg.rr_from != NULL((void *)0)) &&
   cfg.rr_to == NULL((void *)0)) {
BIO_puts(bio_err, "No Signed Receipts Recipients\n");
goto argerr;
}
if (!(cfg.operation & SMIME_SIGNERS0x40) &&
   (cfg.rr_to != NULL((void *)0) || cfg.rr_from != NULL((void *)0))) {
BIO_puts(bio_err, "Signed receipts only allowed with -sign\n");
goto argerr;
}
if (!(cfg.operation & SMIME_SIGNERS0x40) &&
   (cfg.skkeys != NULL((void *)0) || cfg.sksigners != NULL((void *)0))) {
BIO_puts(bio_err, "Multiple signers or keys not allowed\n");
goto argerr;
}
if (cfg.operation & SMIME_SIGNERS0x40) {
if (cfg.keyfile != NULL((void *)0) &&
    cfg.signerfile == NULL((void *)0)) {
	BIO_puts(bio_err, "Illegal -inkey without -signer\n");
	goto argerr;
}
/* Check to see if any final signer needs to be appended */
if (cfg.signerfile != NULL((void *)0)) {
	if (cfg.sksigners == NULL((void *)0) &&
	    (cfg.sksigners =
	    sk_OPENSSL_STRING_new_null()((struct stack_st_OPENSSL_STRING *)sk_new_null())) == NULL((void *)0))
		goto end;
	if (!sk_OPENSSL_STRING_push(cfg.sksigners,sk_push(((_STACK*) (1 ? cfg.sksigners : (struct stack_st_OPENSSL_STRING
*)0)), ((void*) (1 ? cfg.signerfile : (char*)0)))
	    cfg.signerfile)sk_push(((_STACK*) (1 ? cfg.sksigners : (struct stack_st_OPENSSL_STRING
*)0)), ((void*) (1 ? cfg.signerfile : (char*)0))))
		goto end;
	if (cfg.skkeys == NULL((void *)0) &&
	    (cfg.skkeys =
	    sk_OPENSSL_STRING_new_null()((struct stack_st_OPENSSL_STRING *)sk_new_null())) == NULL((void *)0))
		goto end;
	if (cfg.keyfile == NULL((void *)0))
		cfg.keyfile = cfg.signerfile;
	if (!sk_OPENSSL_STRING_push(cfg.skkeys,sk_push(((_STACK*) (1 ? cfg.skkeys : (struct stack_st_OPENSSL_STRING
*)0)), ((void*) (1 ? cfg.keyfile : (char*)0)))
	    cfg.keyfile)sk_push(((_STACK*) (1 ? cfg.skkeys : (struct stack_st_OPENSSL_STRING
*)0)), ((void*) (1 ? cfg.keyfile : (char*)0))))
		goto end;
}
if (cfg.sksigners == NULL((void *)0)) {
	BIO_printf(bio_err,
	    "No signer certificate specified\n");
	badarg = 1;
}
cfg.signerfile = NULL((void *)0);
cfg.keyfile = NULL((void *)0);
} else if (cfg.operation == SMIME_DECRYPT(2 | 0x20)) {
if (cfg.recipfile == NULL((void *)0) &&
    cfg.keyfile == NULL((void *)0) &&
    cfg.secret_key == NULL((void *)0) &&
    cfg.pwri_pass == NULL((void *)0)) {
	BIO_printf(bio_err,
	    "No recipient certificate or key specified\n");
	badarg = 1;
}
} else if (cfg.operation == SMIME_ENCRYPT(1 | 0x10)) {
if (*args == NULL((void *)0) && cfg.secret_key == NULL((void *)0) &&
    cfg.pwri_pass == NULL((void *)0) &&
    cfg.encerts == NULL((void *)0)) {
	BIO_printf(bio_err,
	    "No recipient(s) certificate(s) specified\n");
	badarg = 1;
}
} else if (!cfg.operation) {
badarg = 1;
}

if (badarg) {
argerr:
cms_usage();
goto end;
}

if (!app_passwd(bio_err, cfg.passargin, NULL((void *)0), &passin, NULL((void *)0))) {
BIO_printf(bio_err, "Error getting password\n");
goto end;
}
ret = 2;

if (!(cfg.operation & SMIME_SIGNERS0x40))
cfg.flags &= ~CMS_DETACHED0x40;

if (cfg.operation & SMIME_OP0x10) {
if (cfg.outformat == FORMAT_ASN11)
	outmode = "wb";
} else {
if (cfg.flags & CMS_BINARY0x80)
	outmode = "wb";
}

if (cfg.operation & SMIME_IP0x20) {
if (cfg.informat == FORMAT_ASN11)
	inmode = "rb";
} else {
if (cfg.flags & CMS_BINARY0x80)
	inmode = "rb";
}

if (cfg.operation == SMIME_ENCRYPT(1 | 0x10)) {
if (cfg.cipher == NULL((void *)0)) {
1286#ifndef OPENSSL_NO_DES
	cfg.cipher = EVP_des_ede3_cbc();
1288#else
	BIO_printf(bio_err, "No cipher selected\n");
	goto end;
1291#endif
}
if (cfg.secret_key != NULL((void *)0) &&
    cfg.secret_keyid == NULL((void *)0)) {
	BIO_printf(bio_err, "No secret key id\n");
	goto end;
}
if (*args != NULL((void *)0) && cfg.encerts == NULL((void *)0))
	if ((cfg.encerts = sk_X509_new_null()((struct stack_st_X509 *)sk_new_null())) == NULL((void *)0))
		goto end;
while (*args) {
	if ((cfg.cert = load_cert(bio_err, *args,
	    FORMAT_PEM3, NULL((void *)0),
	    "recipient certificate file")) == NULL((void *)0))
		goto end;
	if (!sk_X509_push(cfg.encerts, cfg.cert)sk_push(((_STACK*) (1 ? (cfg.encerts) : (struct stack_st_X509
*)0)), ((void*) (1 ? (cfg.cert) : (X509*)0))))
		goto end;
	cfg.cert = NULL((void *)0);
	args++;
}
}
if (cfg.certfile != NULL((void *)0)) {
if ((other = load_certs(bio_err, cfg.certfile,
    FORMAT_PEM3, NULL((void *)0), "certificate file")) == NULL((void *)0)) {
	ERR_print_errors(bio_err);
	goto end;
}
}
if (cfg.recipfile != NULL((void *)0) &&
   (cfg.operation == SMIME_DECRYPT(2 | 0x20))) {
if ((recip = load_cert(bio_err, cfg.recipfile,
    FORMAT_PEM3, NULL((void *)0), "recipient certificate file")) == NULL((void *)0)) {
	ERR_print_errors(bio_err);
	goto end;
}
}
if (cfg.operation == SMIME_SIGN_RECEIPT(15 | 0x20 | 0x10)) {
if ((signer = load_cert(bio_err, cfg.signerfile,
    FORMAT_PEM3, NULL((void *)0),
    "receipt signer certificate file")) == NULL((void *)0)) {
	ERR_print_errors(bio_err);
	goto end;
}
}
if (cfg.operation == SMIME_DECRYPT(2 | 0x20)) {
if (cfg.keyfile == NULL((void *)0))
	cfg.keyfile = cfg.recipfile;
} else if ((cfg.operation == SMIME_SIGN(3 | 0x10 | 0x40)) ||
   (cfg.operation == SMIME_SIGN_RECEIPT(15 | 0x20 | 0x10))) {
if (cfg.keyfile == NULL((void *)0))
	cfg.keyfile = cfg.signerfile;
} else {
cfg.keyfile = NULL((void *)0);
}

if (cfg.keyfile != NULL((void *)0)) {
key = load_key(bio_err, cfg.keyfile, cfg.keyform,
    0, passin, "signing key file");
if (key == NULL((void *)0))
	goto end;
}
if (cfg.infile != NULL((void *)0)) {
if ((in = BIO_new_file(cfg.infile, inmode)) == NULL((void *)0)) {
	BIO_printf(bio_err,
	    "Can't open input file %s\n", cfg.infile);
	goto end;
}
} else {
if ((in = BIO_new_fp(stdin(&__sF[0]), BIO_NOCLOSE0x00)) == NULL((void *)0))
	goto end;
}

if (cfg.operation & SMIME_IP0x20) {
if (cfg.informat == FORMAT_SMIME6)
	cms = SMIME_read_CMS(in, &indata);
else if (cfg.informat == FORMAT_PEM3)
	cms = PEM_read_bio_CMS(in, NULL((void *)0), NULL((void *)0), NULL((void *)0));
else if (cfg.informat == FORMAT_ASN11)
	cms = d2i_CMS_bio(in, NULL((void *)0));
else {
	BIO_printf(bio_err, "Bad input format for CMS file\n");
	goto end;
}

if (cms == NULL((void *)0)) {
	BIO_printf(bio_err, "Error reading S/MIME message\n");
	goto end;
}
if (cfg.contfile != NULL((void *)0)) {
	BIO_free(indata);
	if ((indata = BIO_new_file(cfg.contfile,
	    "rb")) == NULL((void *)0)) {
		BIO_printf(bio_err,
		    "Can't read content file %s\n",
		    cfg.contfile);
		goto end;
	}
}
if (cfg.certsoutfile != NULL((void *)0)) {
	STACK_OF(X509)struct stack_st_X509 *allcerts;
	if ((allcerts = CMS_get1_certs(cms)) == NULL((void *)0))
		goto end;
	if (!save_certs(cfg.certsoutfile, allcerts)) {
		BIO_printf(bio_err,
		    "Error writing certs to %s\n",
		    cfg.certsoutfile);
		sk_X509_pop_free(allcerts, X509_free)sk_pop_free(((_STACK*) (1 ? (allcerts) : (struct stack_st_X509
*)0)), ((void (*)(void *)) ((1 ? (X509_free) : (void (*)(X509
 *))0))));
		ret = 5;
		goto end;
	}
	sk_X509_pop_free(allcerts, X509_free)sk_pop_free(((_STACK*) (1 ? (allcerts) : (struct stack_st_X509
*)0)), ((void (*)(void *)) ((1 ? (X509_free) : (void (*)(X509
 *))0))));
}
}
if (cfg.rctfile != NULL((void *)0)) {
char *rctmode = (cfg.rctformat == FORMAT_ASN11) ?
    "rb" : "r";
if ((rctin = BIO_new_file(cfg.rctfile, rctmode)) == NULL((void *)0)) {
	BIO_printf(bio_err,
	    "Can't open receipt file %s\n", cfg.rctfile);
	goto end;
}
if (cfg.rctformat == FORMAT_SMIME6)
	rcms = SMIME_read_CMS(rctin, NULL((void *)0));
else if (cfg.rctformat == FORMAT_PEM3)
	rcms = PEM_read_bio_CMS(rctin, NULL((void *)0), NULL((void *)0), NULL((void *)0));
else if (cfg.rctformat == FORMAT_ASN11)
	rcms = d2i_CMS_bio(rctin, NULL((void *)0));
else {
	BIO_printf(bio_err, "Bad input format for receipt\n");
	goto end;
}

if (rcms == NULL((void *)0)) {
	BIO_printf(bio_err, "Error reading receipt\n");
	goto end;
}
}
if (cfg.outfile != NULL((void *)0)) {
if ((out = BIO_new_file(cfg.outfile, outmode)) == NULL((void *)0)) {
	BIO_printf(bio_err,
	    "Can't open output file %s\n", cfg.outfile);
	goto end;
}
} else {
if ((out = BIO_new_fp(stdout(&__sF[1]), BIO_NOCLOSE0x00)) == NULL((void *)0))
	goto end;
}

if ((cfg.operation == SMIME_VERIFY(4 | 0x20)) ||
   (cfg.operation == SMIME_VERIFY_RECEIPT(16 | 0x20))) {
if ((store = setup_verify(bio_err, cfg.CAfile,
    cfg.CApath)) == NULL((void *)0))
	goto end;
if (cfg.vpm != NULL((void *)0)) {
	if (!X509_STORE_set1_param(store, cfg.vpm))
		goto end;
}
}
ret = 3;

if (cfg.operation == SMIME_DATA_CREATE(8 | 0x10)) {
cms = CMS_data_create(in, cfg.flags);
} else if (cfg.operation == SMIME_DIGEST_CREATE(10 | 0x10)) {
cms = CMS_digest_create(in, cfg.sign_md,
    cfg.flags);
} else if (cfg.operation == SMIME_COMPRESS(12 | 0x10)) {
cms = CMS_compress(in, -1, cfg.flags);
} else if (cfg.operation == SMIME_ENCRYPT(1 | 0x10)) {
int i;
cfg.flags |= CMS_PARTIAL0x4000;
cms = CMS_encrypt(NULL((void *)0), in, cfg.cipher,
    cfg.flags);
if (cms == NULL((void *)0))
	goto end;
for (i = 0; i < sk_X509_num(cfg.encerts)sk_num(((_STACK*) (1 ? (cfg.encerts) : (struct stack_st_X509*
)0))); i++) {
	CMS_RecipientInfo *ri;
	struct cms_key_param *kparam;
	int tflags = cfg.flags;
	X509 *x;

	if ((x = sk_X509_value(cfg.encerts, i)((X509 *)sk_value(((_STACK*) (1 ? (cfg.encerts) : (struct stack_st_X509
*)0)), (i)))) == NULL((void *)0))
		goto end;
	for (kparam = cfg.key_first; kparam != NULL((void *)0);
	    kparam = kparam->next) {
		if (kparam->idx == i) {
			tflags |= CMS_KEY_PARAM0x40000;
			break;
		}
	}
	ri = CMS_add1_recipient_cert(cms, x, tflags);
	if (ri == NULL((void *)0))
		goto end;
	if (kparam != NULL((void *)0)) {
		EVP_PKEY_CTX *pctx;
		if ((pctx = CMS_RecipientInfo_get0_pkey_ctx(
		    ri)) == NULL((void *)0))
			goto end;
		if (!cms_set_pkey_param(pctx, kparam->param))
			goto end;
	}
}

if (cfg.secret_key != NULL((void *)0)) {
	if (CMS_add0_recipient_key(cms, NID_undef0,
	    cfg.secret_key, cfg.secret_keylen,
	    cfg.secret_keyid, cfg.secret_keyidlen,
	    NULL((void *)0), NULL((void *)0), NULL((void *)0)) == NULL((void *)0))
		goto end;
	/* NULL these because call absorbs them */
	cfg.secret_key = NULL((void *)0);
	cfg.secret_keyid = NULL((void *)0);
}
if (cfg.pwri_pass != NULL((void *)0)) {
	pwri_tmp = strdup(cfg.pwri_pass);
	if (pwri_tmp == NULL((void *)0))
		goto end;
	if (CMS_add0_recipient_password(cms, -1, NID_undef0,
	    NID_undef0, pwri_tmp, -1, NULL((void *)0)) == NULL((void *)0))
		goto end;
	pwri_tmp = NULL((void *)0);
}
if (!(cfg.flags & CMS_STREAM0x1000)) {
	if (!CMS_final(cms, in, NULL((void *)0), cfg.flags))
		goto end;
}
} else if (cfg.operation == SMIME_ENCRYPTED_ENCRYPT(14 | 0x10)) {
cms = CMS_EncryptedData_encrypt(in, cfg.cipher,
    cfg.secret_key, cfg.secret_keylen,
    cfg.flags);

} else if (cfg.operation == SMIME_SIGN_RECEIPT(15 | 0x20 | 0x10)) {
CMS_ContentInfo *srcms = NULL((void *)0);
STACK_OF(CMS_SignerInfo)struct stack_st_CMS_SignerInfo *sis;
CMS_SignerInfo *si;
sis = CMS_get0_SignerInfos(cms);
if (sis == NULL((void *)0))
	goto end;
si = sk_CMS_SignerInfo_value(sis, 0)((CMS_SignerInfo *)sk_value(((_STACK*) (1 ? (sis) : (struct stack_st_CMS_SignerInfo
*)0)), (0)));
if (si == NULL((void *)0))
	goto end;
srcms = CMS_sign_receipt(si, signer, key, other,
    cfg.flags);
if (srcms == NULL((void *)0))
	goto end;
CMS_ContentInfo_free(cms);
cms = srcms;
} else if (cfg.operation & SMIME_SIGNERS0x40) {
int i;
/*
 * If detached data content we enable streaming if S/MIME
 * output format.
 */
if (cfg.operation == SMIME_SIGN(3 | 0x10 | 0x40)) {

	if (cfg.flags & CMS_DETACHED0x40) {
		if (cfg.outformat == FORMAT_SMIME6)
			cfg.flags |= CMS_STREAM0x1000;
	}
	cfg.flags |= CMS_PARTIAL0x4000;
	cms = CMS_sign(NULL((void *)0), NULL((void *)0), other, in, cfg.flags);
	if (cms == NULL((void *)0))
		goto end;
	if (cfg.econtent_type != NULL((void *)0))
		if (!CMS_set1_eContentType(cms,
		    cfg.econtent_type))
			goto end;

	if (cfg.rr_to != NULL((void *)0)) {
		rr = make_receipt_request(cfg.rr_to,
		    cfg.rr_allorfirst,
		    cfg.rr_from);
		if (rr == NULL((void *)0)) {
			BIO_puts(bio_err,
			    "Signed Receipt Request Creation Error\n");
			goto end;
		}
	}
} else {
	cfg.flags |= CMS_REUSE_DIGEST0x8000;
}

for (i = 0; i < sk_OPENSSL_STRING_num(cfg.sksigners)sk_num(((_STACK*) (1 ? cfg.sksigners : (struct stack_st_OPENSSL_STRING
*)0))); i++) {
	CMS_SignerInfo *si;
	struct cms_key_param *kparam;
	int tflags = cfg.flags;

	cfg.signerfile = sk_OPENSSL_STRING_value(((OPENSSL_STRING)sk_value(((_STACK*) (1 ? cfg.sksigners : (struct
 stack_st_OPENSSL_STRING*)0)), i))
	    cfg.sksigners, i)((OPENSSL_STRING)sk_value(((_STACK*) (1 ? cfg.sksigners : (struct
 stack_st_OPENSSL_STRING*)0)), i));
	cfg.keyfile = sk_OPENSSL_STRING_value(((OPENSSL_STRING)sk_value(((_STACK*) (1 ? cfg.skkeys : (struct
 stack_st_OPENSSL_STRING*)0)), i))
	    cfg.skkeys, i)((OPENSSL_STRING)sk_value(((_STACK*) (1 ? cfg.skkeys : (struct
 stack_st_OPENSSL_STRING*)0)), i));

	signer = load_cert(bio_err, cfg.signerfile,
	    FORMAT_PEM3, NULL((void *)0), "signer certificate");
	if (signer == NULL((void *)0))
		goto end;
	key = load_key(bio_err, cfg.keyfile,
	    cfg.keyform, 0, passin, "signing key file");
	if (key == NULL((void *)0))
		goto end;
	for (kparam = cfg.key_first; kparam != NULL((void *)0);
	    kparam = kparam->next) {
		if (kparam->idx == i) {
			tflags |= CMS_KEY_PARAM0x40000;
			break;
		}
	}
	si = CMS_add1_signer(cms, signer, key,
	    cfg.sign_md, tflags);
	if (si == NULL((void *)0))
		goto end;
	if (kparam != NULL((void *)0)) {
		EVP_PKEY_CTX *pctx;
		if ((pctx = CMS_SignerInfo_get0_pkey_ctx(
		    si)) == NULL((void *)0))
			goto end;
		if (!cms_set_pkey_param(pctx, kparam->param))
			goto end;
	}
	if (rr != NULL((void *)0) && !CMS_add1_ReceiptRequest(si, rr))
		goto end;
	X509_free(signer);
	signer = NULL((void *)0);
	EVP_PKEY_free(key);
	key = NULL((void *)0);
}
/* If not streaming or resigning finalize structure */
if ((cfg.operation == SMIME_SIGN(3 | 0x10 | 0x40)) &&
    !(cfg.flags & CMS_STREAM0x1000)) {
	if (!CMS_final(cms, in, NULL((void *)0), cfg.flags))
		goto end;
}
}
if (cms == NULL((void *)0)) {
BIO_printf(bio_err, "Error creating CMS structure\n");
goto end;
}
ret = 4;
if (cfg.operation == SMIME_DECRYPT(2 | 0x20)) {
if (cfg.flags & CMS_DEBUG_DECRYPT0x20000)
	CMS_decrypt(cms, NULL((void *)0), NULL((void *)0), NULL((void *)0), NULL((void *)0),
	    cfg.flags);

if (cfg.secret_key != NULL((void *)0)) {
	if (!CMS_decrypt_set1_key(cms, cfg.secret_key,
	    cfg.secret_keylen, cfg.secret_keyid,
	    cfg.secret_keyidlen)) {
		BIO_puts(bio_err,
		    "Error decrypting CMS using secret key\n");
		goto end;
	}
}
if (key != NULL((void *)0)) {
	if (!CMS_decrypt_set1_pkey(cms, key, recip)) {
		BIO_puts(bio_err,
		    "Error decrypting CMS using private key\n");
		goto end;
	}
}
if (cfg.pwri_pass != NULL((void *)0)) {
	if (!CMS_decrypt_set1_password(cms,
	    cfg.pwri_pass, -1)) {
		BIO_puts(bio_err,
		    "Error decrypting CMS using password\n");
		goto end;
	}
}
if (!CMS_decrypt(cms, NULL((void *)0), NULL((void *)0), indata, out,
    cfg.flags)) {
	BIO_printf(bio_err, "Error decrypting CMS structure\n");
	goto end;
}
} else if (cfg.operation == SMIME_DATAOUT(7 | 0x20)) {
if (!CMS_data(cms, out, cfg.flags))
	goto end;
} else if (cfg.operation == SMIME_UNCOMPRESS(11 | 0x20)) {
if (!CMS_uncompress(cms, indata, out, cfg.flags))
	goto end;
} else if (cfg.operation == SMIME_DIGEST_VERIFY(9 | 0x20)) {
if (CMS_digest_verify(cms, indata, out, cfg.flags) > 0)
	BIO_printf(bio_err, "Verification successful\n");
else {
	BIO_printf(bio_err, "Verification failure\n");
	goto end;
}
} else if (cfg.operation == SMIME_ENCRYPTED_DECRYPT(13 | 0x20)) {
if (!CMS_EncryptedData_decrypt(cms, cfg.secret_key,
    cfg.secret_keylen, indata, out, cfg.flags))
	goto end;
} else if (cfg.operation == SMIME_VERIFY(4 | 0x20)) {
if (CMS_verify(cms, other, store, indata, out,
    cfg.flags) > 0) {
	BIO_printf(bio_err, "Verification successful\n");
} else {
	BIO_printf(bio_err, "Verification failure\n");
	if (cfg.verify_retcode)
		ret = verify_err + 32;
	goto end;
}
if (cfg.signerfile != NULL((void *)0)) {
	STACK_OF(X509)struct stack_st_X509 *signers;
	if ((signers = CMS_get0_signers(cms)) == NULL((void *)0))
		goto end;
	if (!save_certs(cfg.signerfile, signers)) {
		BIO_printf(bio_err,
		    "Error writing signers to %s\n",
		    cfg.signerfile);
		sk_X509_free(signers)sk_free(((_STACK*) (1 ? (signers) : (struct stack_st_X509*)0)
));
		ret = 5;
		goto end;
	}
	sk_X509_free(signers)sk_free(((_STACK*) (1 ? (signers) : (struct stack_st_X509*)0)
));
}
if (cfg.rr_print)
	receipt_request_print(bio_err, cms);

} else if (cfg.operation == SMIME_VERIFY_RECEIPT(16 | 0x20)) {
if (CMS_verify_receipt(rcms, cms, other, store,
    cfg.flags) > 0) {
	BIO_printf(bio_err, "Verification successful\n");
} else {
	BIO_printf(bio_err, "Verification failure\n");
	goto end;
}
} else {
if (cfg.noout) {
	if (cfg.print &&
	    !CMS_ContentInfo_print_ctx(out, cms, 0, NULL((void *)0)))
		goto end;
} else if (cfg.outformat == FORMAT_SMIME6) {
	if (cfg.to != NULL((void *)0))
		BIO_printf(out, "To: %s\n", cfg.to);
	if (cfg.from != NULL((void *)0))
		BIO_printf(out, "From: %s\n", cfg.from);
	if (cfg.subject != NULL((void *)0))
		BIO_printf(out, "Subject: %s\n",
		    cfg.subject);
	if (cfg.operation == SMIME_RESIGN(6 | 0x20 | 0x10 | 0x40))
		ret = SMIME_write_CMS(out, cms, indata,
		    cfg.flags);
	else
		ret = SMIME_write_CMS(out, cms, in,
		    cfg.flags);
} else if (cfg.outformat == FORMAT_PEM3) {
	ret = PEM_write_bio_CMS_stream(out, cms, in,
	    cfg.flags);
} else if (cfg.outformat == FORMAT_ASN11) {
	ret = i2d_CMS_bio_stream(out, cms, in, cfg.flags);
} else {
	BIO_printf(bio_err, "Bad output format for CMS file\n");
	goto end;
}
if (ret <= 0) {
	ret = 6;
	goto end;
}
}
ret = 0;

end:
if (ret)
ERR_print_errors(bio_err);

sk_X509_pop_free(cfg.encerts, X509_free)sk_pop_free(((_STACK*) (1 ? (cfg.encerts) : (struct stack_st_X509
*)0)), ((void (*)(void *)) ((1 ? (X509_free) : (void (*)(X509
 *))0))));
sk_X509_pop_free(other, X509_free)sk_pop_free(((_STACK*) (1 ? (other) : (struct stack_st_X509*)
0)), ((void (*)(void *)) ((1 ? (X509_free) : (void (*)(X509 *
))0))));
X509_VERIFY_PARAM_free(cfg.vpm);
sk_OPENSSL_STRING_free(cfg.sksigners)sk_free(((_STACK*) (1 ? cfg.sksigners : (struct stack_st_OPENSSL_STRING
*)0)));
sk_OPENSSL_STRING_free(cfg.skkeys)sk_free(((_STACK*) (1 ? cfg.skkeys : (struct stack_st_OPENSSL_STRING
*)0)));
free(cfg.secret_key);
free(cfg.secret_keyid);
free(pwri_tmp);
ASN1_OBJECT_free(cfg.econtent_type);
CMS_ReceiptRequest_free(rr);
sk_OPENSSL_STRING_free(cfg.rr_to)sk_free(((_STACK*) (1 ? cfg.rr_to : (struct stack_st_OPENSSL_STRING
*)0)));
sk_OPENSSL_STRING_free(cfg.rr_from)sk_free(((_STACK*) (1 ? cfg.rr_from : (struct stack_st_OPENSSL_STRING
*)0)));
for (cfg.key_param = cfg.key_first; cfg.key_param;) {
struct cms_key_param *tparam;
sk_OPENSSL_STRING_free(cfg.key_param->param)sk_free(((_STACK*) (1 ? cfg.key_param->param : (struct stack_st_OPENSSL_STRING
*)0)));
tparam = cfg.key_param->next;
free(cfg.key_param);
cfg.key_param = tparam;
}
X509_STORE_free(store);
X509_free(cfg.cert);
X509_free(recip);
X509_free(signer);
EVP_PKEY_free(key);
CMS_ContentInfo_free(cms);
CMS_ContentInfo_free(rcms);
BIO_free(rctin);
BIO_free(in);
BIO_free(indata);
BIO_free_all(out);
free(passin);

return (ret);
1786}

1788static int
1789save_certs(char *signerfile, STACK_OF(X509)struct stack_st_X509 *signers)
1790{
int i;
BIO *tmp;

if (signerfile == NULL((void *)0))
return 1;
tmp = BIO_new_file(signerfile, "w");
if (tmp == NULL((void *)0))
return 0;
for (i = 0; i < sk_X509_num(signers)sk_num(((_STACK*) (1 ? (signers) : (struct stack_st_X509*)0))
); i++)
PEM_write_bio_X509(tmp, sk_X509_value(signers, i)((X509 *)sk_value(((_STACK*) (1 ? (signers) : (struct stack_st_X509
*)0)), (i))));
BIO_free(tmp);
return 1;
1803}

1805static void
1806gnames_stack_print(BIO *out, STACK_OF(GENERAL_NAMES)struct stack_st_GENERAL_NAMES *gns)
1807{
STACK_OF(GENERAL_NAME)struct stack_st_GENERAL_NAME *gens;
GENERAL_NAME *gen;
int i, j;

for (i = 0; i < sk_GENERAL_NAMES_num(gns)sk_num(((_STACK*) (1 ? (gns) : (struct stack_st_GENERAL_NAMES
*)0))); i++) {
gens = sk_GENERAL_NAMES_value(gns, i)((GENERAL_NAMES *)sk_value(((_STACK*) (1 ? (gns) : (struct stack_st_GENERAL_NAMES
*)0)), (i)));
for (j = 0; j < sk_GENERAL_NAME_num(gens)sk_num(((_STACK*) (1 ? (gens) : (struct stack_st_GENERAL_NAME
*)0))); j++) {
	gen = sk_GENERAL_NAME_value(gens, j)((GENERAL_NAME *)sk_value(((_STACK*) (1 ? (gens) : (struct stack_st_GENERAL_NAME
*)0)), (j)));
	BIO_puts(out, "    ");
	GENERAL_NAME_print(out, gen);
	BIO_puts(out, "\n");
}
}
return;
1822}

1824static void
1825receipt_request_print(BIO *out, CMS_ContentInfo *cms)
1826{
STACK_OF(CMS_SignerInfo)struct stack_st_CMS_SignerInfo *sis;
CMS_SignerInfo *si;
CMS_ReceiptRequest *rr;
int allorfirst;
STACK_OF(GENERAL_NAMES)struct stack_st_GENERAL_NAMES *rto, *rlist;
ASN1_STRING *scid;
int i, rv;

if ((sis = CMS_get0_SignerInfos(cms)) == NULL((void *)0))
return;
for (i = 0; i < sk_CMS_SignerInfo_num(sis)sk_num(((_STACK*) (1 ? (sis) : (struct stack_st_CMS_SignerInfo
*)0))); i++) {
if ((si = sk_CMS_SignerInfo_value(sis, i)((CMS_SignerInfo *)sk_value(((_STACK*) (1 ? (sis) : (struct stack_st_CMS_SignerInfo
*)0)), (i)))) == NULL((void *)0))
	return;
rv = CMS_get1_ReceiptRequest(si, &rr);
BIO_printf(bio_err, "Signer %d:\n", i + 1);
if (rv == 0) {
	BIO_puts(bio_err, "  No Receipt Request\n");
} else if (rv < 0) {
	BIO_puts(bio_err, "  Receipt Request Parse Error\n");
	ERR_print_errors(bio_err);
} else {
	char *id;
	int idlen;

	CMS_ReceiptRequest_get0_values(rr, &scid, &allorfirst,
	    &rlist, &rto);
	BIO_puts(out, "  Signed Content ID:\n");
	idlen = ASN1_STRING_length(scid);
	id = (char *) ASN1_STRING_data(scid);
	BIO_dump_indent(out, id, idlen, 4);
	BIO_puts(out, "  Receipts From");
	if (rlist != NULL((void *)0)) {
		BIO_puts(out, " List:\n");
		gnames_stack_print(out, rlist);
	} else if (allorfirst == 1) {
		BIO_puts(out, ": First Tier\n");
	} else if (allorfirst == 0) {
		BIO_puts(out, ": All\n");
	} else {
		BIO_printf(out, " Unknown (%d)\n", allorfirst);
	}
	BIO_puts(out, "  Receipts To:\n");
	gnames_stack_print(out, rto);
}
CMS_ReceiptRequest_free(rr);
}
1873}

1875static STACK_OF(GENERAL_NAMES)struct stack_st_GENERAL_NAMES *
1876make_names_stack(STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *ns)
1877{
int i;
STACK_OF(GENERAL_NAMES)struct stack_st_GENERAL_NAMES *ret;
GENERAL_NAMES *gens = NULL((void *)0);
GENERAL_NAME *gen = NULL((void *)0);

if ((ret = sk_GENERAL_NAMES_new_null()((struct stack_st_GENERAL_NAMES *)sk_new_null())) == NULL((void *)0))
goto err;
for (i = 0; i < sk_OPENSSL_STRING_num(ns)sk_num(((_STACK*) (1 ? ns : (struct stack_st_OPENSSL_STRING*)
0))); i++) {
char *str = sk_OPENSSL_STRING_value(ns, i)((OPENSSL_STRING)sk_value(((_STACK*) (1 ? ns : (struct stack_st_OPENSSL_STRING
*)0)), i));
gen = a2i_GENERAL_NAME(NULL((void *)0), NULL((void *)0), NULL((void *)0), GEN_EMAIL1, str, 0);
if (gen == NULL((void *)0))
	goto err;
gens = GENERAL_NAMES_new();
if (gens == NULL((void *)0))
	goto err;
if (!sk_GENERAL_NAME_push(gens, gen)sk_push(((_STACK*) (1 ? (gens) : (struct stack_st_GENERAL_NAME
*)0)), ((void*) (1 ? (gen) : (GENERAL_NAME*)0))))
	goto err;
gen = NULL((void *)0);
if (!sk_GENERAL_NAMES_push(ret, gens)sk_push(((_STACK*) (1 ? (ret) : (struct stack_st_GENERAL_NAMES
*)0)), ((void*) (1 ? (gens) : (GENERAL_NAMES*)0))))
	goto err;
gens = NULL((void *)0);
}

return ret;

err:
sk_GENERAL_NAMES_pop_free(ret, GENERAL_NAMES_free)sk_pop_free(((_STACK*) (1 ? (ret) : (struct stack_st_GENERAL_NAMES
*)0)), ((void (*)(void *)) ((1 ? (GENERAL_NAMES_free) : (void
 (*)(GENERAL_NAMES *))0))));
GENERAL_NAMES_free(gens);
GENERAL_NAME_free(gen);

return NULL((void *)0);
1909}


1912static CMS_ReceiptRequest *
1913make_receipt_request(STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *rr_to, int rr_allorfirst,
  STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *rr_from)
1915{
STACK_OF(GENERAL_NAMES)struct stack_st_GENERAL_NAMES *rct_to = NULL((void *)0), *rct_from = NULL((void *)0);
CMS_ReceiptRequest *rr;

rct_to = make_names_stack(rr_to);
if (rct_to == NULL((void *)0))
goto err;
if (rr_from != NULL((void *)0)) {
rct_from = make_names_stack(rr_from);
if (rct_from == NULL((void *)0))
	goto err;
} else {
rct_from = NULL((void *)0);
}

if ((rr = CMS_ReceiptRequest_create0(NULL((void *)0), -1, rr_allorfirst, rct_from,
   rct_to)) == NULL((void *)0))
goto err;

return rr;

err:
sk_GENERAL_NAMES_pop_free(rct_to, GENERAL_NAMES_free)sk_pop_free(((_STACK*) (1 ? (rct_to) : (struct stack_st_GENERAL_NAMES
*)0)), ((void (*)(void *)) ((1 ? (GENERAL_NAMES_free) : (void
 (*)(GENERAL_NAMES *))0))));
sk_GENERAL_NAMES_pop_free(rct_from, GENERAL_NAMES_free)sk_pop_free(((_STACK*) (1 ? (rct_from) : (struct stack_st_GENERAL_NAMES
*)0)), ((void (*)(void *)) ((1 ? (GENERAL_NAMES_free) : (void
 (*)(GENERAL_NAMES *))0))));
return NULL((void *)0);
1940}

1942static int
1943cms_set_pkey_param(EVP_PKEY_CTX *pctx, STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *param)
1944{
char *keyopt;
int i;

if (sk_OPENSSL_STRING_num(param)sk_num(((_STACK*) (1 ? param : (struct stack_st_OPENSSL_STRING
*)0))) <= 0)
return 1;
for (i = 0; i < sk_OPENSSL_STRING_num(param)sk_num(((_STACK*) (1 ? param : (struct stack_st_OPENSSL_STRING
*)0))); i++) {
keyopt = sk_OPENSSL_STRING_value(param, i)((OPENSSL_STRING)sk_value(((_STACK*) (1 ? param : (struct stack_st_OPENSSL_STRING
*)0)), i));
if (pkey_ctrl_string(pctx, keyopt) <= 0) {
	BIO_printf(bio_err, "parameter error \"%s\"\n", keyopt);
	ERR_print_errors(bio_err);
	return 0;
}
}
return 1;
1959}

1961#endif