crlgen.c

Bug Summary

File:	cmd/crlutil/crlgen.c
Warning:	line 1062, column 9 Branch condition evaluates to a garbage value
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name crlgen.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/nss/cmd/crlutil -ffunction-sections -fdata-sections -fcoverage-compilation-dir=/nss/cmd/crlutil -resource-dir /usr/lib/llvm-21/lib/clang/21 -D HAVE_STRERROR -D LINUX -D linux -D XP_UNIX -D XP_UNIX -D NSPR20 -D DEBUG -U NDEBUG -D _DEFAULT_SOURCE -D _BSD_SOURCE -D _POSIX_SOURCE -D SDB_MEASURE_USE_TEMP_DIR -D _REENTRANT -D DEBUG -U NDEBUG -D _DEFAULT_SOURCE -D _BSD_SOURCE -D _POSIX_SOURCE -D SDB_MEASURE_USE_TEMP_DIR -D _REENTRANT -D NSS_DISABLE_SSE3 -D NSS_NO_INIT_SUPPORT -D USE_UTIL_DIRECTLY -D NO_NSPR_10_SUPPORT -D SSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -I ../../../dist/Linux6.1_x86_64_gcc_glibc_PTH_64_DBG.OBJ/include -I ../../../dist/public/nss -I ../../../dist/private/nss -I ../../../dist/public/seccmd -I ../../../dist/public/dbm -internal-isystem /usr/lib/llvm-21/lib/clang/21/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -std=c99 -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -analyzer-output=html -analyzer-config stable-report-filename=true -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2025-06-23-225121-2983009-1 -x c crlgen.c
1/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */

5/*
6** crlgen.c
7**
8** utility for managing certificates revocation lists generation
9**
10*/

12#include <stdio.h>
13#include <math.h>

15#include "nspr.h"
16#include "plgetopt.h"
17#include "nss.h"
18#include "secutil.h"
19#include "cert.h"
20#include "certi.h"
21#include "certdb.h"
22#include "pk11func.h"
23#include "crlgen.h"

25/* Destroys extHandle and data. data was create on heap.
* extHandle creaded by CERT_StartCRLEntryExtensions. entry
* was allocated on arena.*/
28static void
29destroyEntryData(CRLGENEntryData *data)
30{
  if (!data)
      return;
  PORT_Assert(data->entry)((data->entry)?((void)0):PR_Assert("data->entry","crlgen.c"
,33));
  if (data->extHandle)
      CERT_FinishExtensions(data->extHandle);
  PORT_FreePORT_Free_Util(data);
37}

39/* Prints error messages along with line number */
40void
41crlgen_PrintError(int line, char *msg, ...)
42{
  va_list args;

  va_start(args, msg)__builtin_va_start(args, msg);

  fprintf(stderrstderr, "crlgen: (line: %d) ", line);
  vfprintf(stderrstderr, msg, args);

  va_end(args)__builtin_va_end(args);
51}
52/* Finds CRLGENEntryData in hashtable according PRUint64 value
* - certId : cert serial number*/
54static CRLGENEntryData *
55crlgen_FindEntry(CRLGENGeneratorData *crlGenData, SECItem *certId)
56{
  if (!crlGenData->entryDataHashTable || !certId)
      return NULL((void*)0);
  return (CRLGENEntryData *)
      PL_HashTableLookup(crlGenData->entryDataHashTable,
                         certId);
62}

64/* Removes CRLGENEntryData from hashtable according to certId
* - certId : cert serial number*/
66static SECStatus
67crlgen_RmEntry(CRLGENGeneratorData *crlGenData, SECItem *certId)
68{
  CRLGENEntryData *data = NULL((void*)0);
  SECStatus rv = SECSuccess;

  if (!crlGenData->entryDataHashTable) {
      return SECSuccess;
  }

  data = crlgen_FindEntry(crlGenData, certId);
  if (!data) {
      return SECSuccess;
  }

  if (!PL_HashTableRemove(crlGenData->entryDataHashTable, certId)) {
      rv = SECFailure;
  }

  destroyEntryData(data);
  return rv;
87}

89/* Stores CRLGENEntryData in hashtable according to certId
* - certId : cert serial number*/
91static CRLGENEntryData *
92crlgen_PlaceAnEntry(CRLGENGeneratorData *crlGenData,
                  CERTCrlEntry *entry, SECItem *certId)
94{
  CRLGENEntryData *newData = NULL((void*)0);

  PORT_Assert(crlGenData && crlGenData->entryDataHashTable &&((crlGenData && crlGenData->entryDataHashTable &&
 entry)?((void)0):PR_Assert("crlGenData && crlGenData->entryDataHashTable && entry"
,"crlgen.c",98))
              entry)((crlGenData && crlGenData->entryDataHashTable &&
 entry)?((void)0):PR_Assert("crlGenData && crlGenData->entryDataHashTable && entry"
,"crlgen.c",98));
  if (!crlGenData || !crlGenData->entryDataHashTable || !entry) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return NULL((void*)0);
  }

  newData = PORT_ZNew(CRLGENEntryData)(CRLGENEntryData *)PORT_ZAlloc_Util(sizeof(CRLGENEntryData));
  if (!newData) {
      return NULL((void*)0);
  }
  newData->entry = entry;
  newData->certId = certId;
  if (!PL_HashTableAdd(crlGenData->entryDataHashTable,
                       newData->certId, newData)) {
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "Can not add entryData structure\n");
      return NULL((void*)0);
  }
  return newData;
117}

119/* Use this structure to keep pointer when commiting entries extensions */
120struct commitData {
  int pos;
  CERTCrlEntry **entries;
123};

125/* HT PL_HashTableEnumerateEntries callback. Sorts hashtable entries of the
* table he. Returns value through arg parameter*/
127static PRIntn PR_CALLBACK
128crlgen_CommitEntryData(PLHashEntry *he, PRIntn i, void *arg)
129{
  CRLGENEntryData *data = NULL((void*)0);

  PORT_Assert(he)((he)?((void)0):PR_Assert("he","crlgen.c",132));
  if (!he) {
      return HT_ENUMERATE_NEXT0;
  }
  data = (CRLGENEntryData *)he->value;

  PORT_Assert(data)((data)?((void)0):PR_Assert("data","crlgen.c",138));
  PORT_Assert(arg)((arg)?((void)0):PR_Assert("arg","crlgen.c",139));

  if (data) {
      struct commitData *dt = (struct commitData *)arg;
      dt->entries[dt->pos++] = data->entry;
      destroyEntryData(data);
  }
  return HT_ENUMERATE_NEXT0;
147}

149/* Copy char * datainto allocated in arena SECItem */
150static SECStatus
151crlgen_SetString(PLArenaPool *arena, const char *dataIn, SECItem *value)
152{
  SECItem item;

  PORT_Assert(arena && dataIn)((arena && dataIn)?((void)0):PR_Assert("arena && dataIn"
,"crlgen.c",155));
  if (!arena || !dataIn) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  item.data = (void *)dataIn;
  item.len = PORT_Strlen(dataIn)strlen(dataIn);

  return SECITEM_CopyItemSECITEM_CopyItem_Util(arena, value, &item);
165}

167/* Creates CERTGeneralName from parsed data for the Authority Key Extension */
168static CERTGeneralName *
169crlgen_GetGeneralName(PLArenaPool *arena, CRLGENGeneratorData *crlGenData,
                    const char *data)
171{
  CERTGeneralName *namesList = NULL((void*)0);
  CERTGeneralName *current;
  CERTGeneralName *tail = NULL((void*)0);
  SECStatus rv = SECSuccess;
  const char *nextChunk = NULL((void*)0);
  const char *currData = NULL((void*)0);
  int intValue;
  char buffer[512];
  void *mark;

  if (!data)
      return NULL((void*)0);
  PORT_Assert(arena)((arena)?((void)0):PR_Assert("arena","crlgen.c",184));
  if (!arena) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return NULL((void*)0);
  }

  mark = PORT_ArenaMarkPORT_ArenaMark_Util(arena);

  currData = data;
  do {
      int nameLen = 0;
      char name[128];
      const char *sepPrt = NULL((void*)0);
      nextChunk = PORT_Strchrstrchr(currData, '|');
      if (!nextChunk)
          nextChunk = data + strlen(data);
      sepPrt = PORT_Strchrstrchr(currData, ':');
      if (sepPrt == NULL((void*)0) || sepPrt >= nextChunk) {
          *buffer = '\0';
          sepPrt = nextChunk;
      } else {
          PORT_Memcpymemcpy(buffer, sepPrt + 1,
                      (nextChunk - sepPrt - 1));
          buffer[nextChunk - sepPrt - 1] = '\0';
      }
      nameLen = PR_MIN(sepPrt - currData, sizeof(name) - 1)((sepPrt - currData)<(sizeof(name) - 1)?(sepPrt - currData
):(sizeof(name) - 1));
      PORT_Memcpymemcpy(name, currData, nameLen);
      name[nameLen] = '\0';
      currData = nextChunk + 1;

      if (!PORT_Strcmpstrcmp(name, "otherName"))
          intValue = certOtherName;
      else if (!PORT_Strcmpstrcmp(name, "rfc822Name"))
          intValue = certRFC822Name;
      else if (!PORT_Strcmpstrcmp(name, "dnsName"))
          intValue = certDNSName;
      else if (!PORT_Strcmpstrcmp(name, "x400Address"))
          intValue = certX400Address;
      else if (!PORT_Strcmpstrcmp(name, "directoryName"))
          intValue = certDirectoryName;
      else if (!PORT_Strcmpstrcmp(name, "ediPartyName"))
          intValue = certEDIPartyName;
      else if (!PORT_Strcmpstrcmp(name, "URI"))
          intValue = certURI;
      else if (!PORT_Strcmpstrcmp(name, "ipAddress"))
          intValue = certIPAddress;
      else if (!PORT_Strcmpstrcmp(name, "registerID"))
          intValue = certRegisterID;
      else
          intValue = -1;

      if (intValue >= certOtherName && intValue <= certRegisterID) {
          if (namesList == NULL((void*)0)) {
              namesList = current = tail = PORT_ArenaZNew(arena,(CERTGeneralName *)PORT_ArenaZAlloc_Util(arena, sizeof(CERTGeneralName
))
                                                          CERTGeneralName)(CERTGeneralName *)PORT_ArenaZAlloc_Util(arena, sizeof(CERTGeneralName
));
          } else {
              current = PORT_ArenaZNew(arena, CERTGeneralName)(CERTGeneralName *)PORT_ArenaZAlloc_Util(arena, sizeof(CERTGeneralName
));
          }
          if (current == NULL((void*)0)) {
              rv = SECFailure;
              break;
          }
      } else {
          PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
          break;
      }
      current->type = intValue;
      switch (current->type) {
          case certURI:
          case certDNSName:
          case certRFC822Name:
              current->name.other.data = PORT_ArenaAllocPORT_ArenaAlloc_Util(arena, strlen(buffer));
              if (current->name.other.data == NULL((void*)0)) {
                  rv = SECFailure;
                  break;
              }
              PORT_Memcpymemcpy(current->name.other.data, buffer,
                          current->name.other.len = strlen(buffer));
              break;

          case certEDIPartyName:
          case certIPAddress:
          case certOtherName:
          case certRegisterID:
          case certX400Address: {

              current->name.other.data = PORT_ArenaAllocPORT_ArenaAlloc_Util(arena, strlen(buffer) + 2);
              if (current->name.other.data == NULL((void*)0)) {
                  rv = SECFailure;
                  break;
              }

              PORT_Memcpymemcpy(current->name.other.data + 2, buffer, strlen(buffer));
              /* This may not be accurate for all cases.For now, use this tag type */
              current->name.other.data[0] = (char)(((current->type - 1) & 0x1f) | 0x80);
              current->name.other.data[1] = (char)strlen(buffer);
              current->name.other.len = strlen(buffer) + 2;
              break;
          }

          case certDirectoryName: {
              CERTName *directoryName = NULL((void*)0);

              directoryName = CERT_AsciiToName(buffer);
              if (!directoryName) {
                  rv = SECFailure;
                  break;
              }

              rv = CERT_CopyName(arena, &current->name.directoryName, directoryName);
              CERT_DestroyName(directoryName);

              break;
          }
      }
      if (rv != SECSuccess)
          break;
      current->l.next = &(namesList->l);
      current->l.prev = &(tail->l);
      tail->l.next = &(current->l);
      tail = current;

  } while (nextChunk != data + strlen(data));

  if (rv != SECSuccess) {
      PORT_ArenaReleasePORT_ArenaRelease_Util(arena, mark);
      namesList = NULL((void*)0);
  }
  return (namesList);
313}

315/* Creates CERTGeneralName from parsed data for the Authority Key Extension */
316static CERTGeneralName *
317crlgen_DistinguishedName(PLArenaPool *arena, CRLGENGeneratorData *crlGenData,
                       const char *data)
319{
  CERTName *directoryName = NULL((void*)0);
  CERTGeneralName *current;
  SECStatus rv = SECFailure;
  void *mark;

  if (!data)
      return NULL((void*)0);
  PORT_Assert(arena)((arena)?((void)0):PR_Assert("arena","crlgen.c",327));
  if (!arena) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return NULL((void*)0);
  }

  mark = PORT_ArenaMarkPORT_ArenaMark_Util(arena);

  current = PORT_ArenaZNew(arena, CERTGeneralName)(CERTGeneralName *)PORT_ArenaZAlloc_Util(arena, sizeof(CERTGeneralName
));
  if (current == NULL((void*)0)) {
      goto loser;
  }
  current->type = certDirectoryName;
  current->l.next = &current->l;
  current->l.prev = &current->l;

  directoryName = CERT_AsciiToName((char *)data);
  if (!directoryName) {
      goto loser;
  }

  rv = CERT_CopyName(arena, &current->name.directoryName, directoryName);
  CERT_DestroyName(directoryName);

351loser:
  if (rv != SECSuccess) {
      PORT_SetErrorPORT_SetError_Util(rv);
      PORT_ArenaReleasePORT_ArenaRelease_Util(arena, mark);
      current = NULL((void*)0);
  }
  return (current);
358}

360/* Adding Authority Key ID extension to extension handle. */
361static SECStatus
362crlgen_AddAuthKeyID(CRLGENGeneratorData *crlGenData,
                  const char **dataArr)
364{
  void *extHandle = NULL((void*)0);
  CERTAuthKeyID *authKeyID = NULL((void*)0);
  PLArenaPool *arena = NULL((void*)0);
  SECStatus rv = SECSuccess;

  PORT_Assert(dataArr && crlGenData)((dataArr && crlGenData)?((void)0):PR_Assert("dataArr && crlGenData"
,"crlgen.c",370));
  if (!crlGenData || !dataArr) {
      return SECFailure;
  }

  extHandle = crlGenData->crlExtHandle;

  if (!dataArr[0] || !dataArr[1] || !dataArr[2]) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "insufficient number of parameters.\n");
      return SECFailure;
  }

  arena = PORT_NewArenaPORT_NewArena_Util(DER_DEFAULT_CHUNKSIZE(2048));
  if (!arena) {
      return SECFailure;
  }

  authKeyID = PORT_ArenaZNew(arena, CERTAuthKeyID)(CERTAuthKeyID *)PORT_ArenaZAlloc_Util(arena, sizeof(CERTAuthKeyID
));
  if (authKeyID == NULL((void*)0)) {
      rv = SECFailure;
      goto loser;
  }

  if (dataArr[3] == NULL((void*)0)) {
      rv = crlgen_SetString(arena, dataArr[2], &authKeyID->keyID);
      if (rv != SECSuccess)
          goto loser;
  } else {
      rv = crlgen_SetString(arena, dataArr[3],
                            &authKeyID->authCertSerialNumber);
      if (rv != SECSuccess)
          goto loser;

      authKeyID->authCertIssuer =
          crlgen_DistinguishedName(arena, crlGenData, dataArr[2]);
      if (authKeyID->authCertIssuer == NULL((void*)0) && SECFailure == PORT_GetErrorPORT_GetError_Util()) {
          crlgen_PrintError(crlGenData->parsedLineNum, "syntax error.\n");
          rv = SECFailure;
          goto loser;
      }
  }

  rv =
      SECU_EncodeAndAddExtensionValue(arena, extHandle, authKeyID,
                                      (*dataArr[1] == '1') ? PR_TRUE1 : PR_FALSE0,
                                      SEC_OID_X509_AUTH_KEY_ID,
                                      EXTEN_EXT_VALUE_ENCODER_CERT_EncodeAuthKeyID);
419loser:
  if (arena)
      PORT_FreeArenaPORT_FreeArena_Util(arena, PR_FALSE0);
  return rv;
423}

425/* Creates and add Subject Alternative Names extension */
426static SECStatus
427crlgen_AddIssuerAltNames(CRLGENGeneratorData *crlGenData,
                       const char **dataArr)
429{
  CERTGeneralName *nameList = NULL((void*)0);
  PLArenaPool *arena = NULL((void*)0);
  void *extHandle = NULL((void*)0);
  SECStatus rv = SECSuccess;

  PORT_Assert(dataArr && crlGenData)((dataArr && crlGenData)?((void)0):PR_Assert("dataArr && crlGenData"
,"crlgen.c",435));
  if (!crlGenData || !dataArr) {
      return SECFailure;
  }

  if (!dataArr || !dataArr[0] || !dataArr[1] || !dataArr[2]) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "insufficient number of arguments.\n");
      return SECFailure;
  }

  PORT_Assert(dataArr && crlGenData)((dataArr && crlGenData)?((void)0):PR_Assert("dataArr && crlGenData"
,"crlgen.c",447));
  if (!crlGenData || !dataArr) {
      return SECFailure;
  }

  extHandle = crlGenData->crlExtHandle;

  if (!dataArr[0] || !dataArr[1] || !dataArr[2]) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "insufficient number of parameters.\n");
      return SECFailure;
  }

  arena = PORT_NewArenaPORT_NewArena_Util(DER_DEFAULT_CHUNKSIZE(2048));
  if (!arena) {
      return SECFailure;
  }

  nameList = crlgen_GetGeneralName(arena, crlGenData, dataArr[2]);
  if (nameList == NULL((void*)0)) {
      crlgen_PrintError(crlGenData->parsedLineNum, "syntax error.\n");
      rv = SECFailure;
      goto loser;
  }

  rv =
      SECU_EncodeAndAddExtensionValue(arena, extHandle, nameList,
                                      (*dataArr[1] == '1') ? PR_TRUE1 : PR_FALSE0,
                                      SEC_OID_X509_ISSUER_ALT_NAME,
                                      EXTEN_EXT_VALUE_ENCODER_CERT_EncodeAltNameExtension);
478loser:
  if (arena)
      PORT_FreeArenaPORT_FreeArena_Util(arena, PR_FALSE0);
  return rv;
482}

484/* Creates and adds CRLNumber extension to extension handle.
* Since, this is CRL extension, extension handle is the one
* related to CRL extensions */
487static SECStatus
488crlgen_AddCrlNumber(CRLGENGeneratorData *crlGenData, const char **dataArr)
489{
  PLArenaPool *arena = NULL((void*)0);
  SECItem encodedItem;
  void *dummy;
  SECStatus rv = SECFailure;
  int code = 0;

  PORT_Assert(dataArr && crlGenData)((dataArr && crlGenData)?((void)0):PR_Assert("dataArr && crlGenData"
,"crlgen.c",496));
  if (!crlGenData || !dataArr) {
      goto loser;
  }

  if (!dataArr[0] || !dataArr[1] || !dataArr[2]) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "insufficient number of arguments.\n");
      goto loser;
  }

  arena = PORT_NewArenaPORT_NewArena_Util(DER_DEFAULT_CHUNKSIZE(2048));
  if (arena == NULL((void*)0)) {
      goto loser;
  }

  code = atoi(dataArr[2]);
  if (code == 0 && *dataArr[2] != '0') {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      goto loser;
  }

  dummy = SEC_ASN1EncodeIntegerSEC_ASN1EncodeInteger_Util(arena, &encodedItem, code);
  if (!dummy) {
      rv = SECFailure;
      goto loser;
  }

  rv = CERT_AddExtension(crlGenData->crlExtHandle, SEC_OID_X509_CRL_NUMBER,
                         &encodedItem,
                         (*dataArr[1] == '1') ? PR_TRUE1 : PR_FALSE0,
                         PR_TRUE1);

530loser:
  if (arena)
      PORT_FreeArenaPORT_FreeArena_Util(arena, PR_FALSE0);
  return rv;
534}

536/* Creates Cert Revocation Reason code extension. Encodes it and
* returns as SECItem structure */
538static SECItem *
539crlgen_CreateReasonCode(PLArenaPool *arena, const char **dataArr,
                      int *extCode)
541{
  SECItem *encodedItem;
  void *dummy;
  void *mark = NULL((void*)0);
  int code = 0;

  PORT_Assert(arena && dataArr)((arena && dataArr)?((void)0):PR_Assert("arena && dataArr"
,"crlgen.c",547));
  if (!arena || !dataArr) {
      goto loser;
  }

  mark = PORT_ArenaMarkPORT_ArenaMark_Util(arena);

  encodedItem = PORT_ArenaZNew(arena, SECItem)(SECItem *)PORT_ArenaZAlloc_Util(arena, sizeof(SECItem));
  if (encodedItem == NULL((void*)0)) {
      goto loser;
  }

  if (dataArr[2] == NULL((void*)0)) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      goto loser;
  }

  code = atoi(dataArr[2]);
  /* aACompromise(10) is the last possible of the values
   * for the Reason Core Extension */
  if ((code == 0 && *dataArr[2] != '0') || code > 10) {

      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      goto loser;
  }

  dummy = SEC_ASN1EncodeIntegerSEC_ASN1EncodeInteger_Util(arena, encodedItem, code);
  if (!dummy) {
      goto loser;
  }

  *extCode = SEC_OID_X509_REASON_CODE;
  return encodedItem;

581loser:
  if (mark) {
      PORT_ArenaReleasePORT_ArenaRelease_Util(arena, mark);
  }
  return NULL((void*)0);
586}

588/* Creates Cert Invalidity Date extension. Encodes it and
* returns as SECItem structure */
590static SECItem *
591crlgen_CreateInvalidityDate(PLArenaPool *arena, const char **dataArr,
                          int *extCode)
593{
  SECItem *encodedItem;
  int length = 0;
  void *mark = NULL((void*)0);

  PORT_Assert(arena && dataArr)((arena && dataArr)?((void)0):PR_Assert("arena && dataArr"
,"crlgen.c",598));
  if (!arena || !dataArr) {
      goto loser;
  }

  mark = PORT_ArenaMarkPORT_ArenaMark_Util(arena);

  encodedItem = PORT_ArenaZNew(arena, SECItem)(SECItem *)PORT_ArenaZAlloc_Util(arena, sizeof(SECItem));
  if (encodedItem == NULL((void*)0)) {
      goto loser;
  }

  length = PORT_Strlen(dataArr[2])strlen(dataArr[2]);

  encodedItem->type = siGeneralizedTime;
  encodedItem->data = PORT_ArenaAllocPORT_ArenaAlloc_Util(arena, length);
  if (!encodedItem->data) {
      goto loser;
  }

  PORT_Memcpymemcpy(encodedItem->data, dataArr[2], (encodedItem->len = length) * sizeof(char));

  *extCode = SEC_OID_X509_INVALID_DATE;
  return encodedItem;

623loser:
  if (mark) {
      PORT_ArenaReleasePORT_ArenaRelease_Util(arena, mark);
  }
  return NULL((void*)0);
628}

630/* Creates(by calling extCreator function) and adds extension to a set
* of already added certs. Uses values of rangeFrom and rangeTo from
* CRLGENCrlGenCtl structure for identifying the inclusive set of certs */
633static SECStatus
634crlgen_AddEntryExtension(CRLGENGeneratorData *crlGenData,
                       const char **dataArr, char *extName,
                       SECItem *(*extCreator)(PLArenaPool *arena,
                                              const char **dataArr,
                                              int *extCode))
639{
  PRUint64 i = 0;
  SECStatus rv = SECFailure;
  int extCode = 0;
  PRUint64 lastRange;
  SECItem *ext = NULL((void*)0);
  PLArenaPool *arena = NULL((void*)0);

  PORT_Assert(crlGenData && dataArr)((crlGenData && dataArr)?((void)0):PR_Assert("crlGenData && dataArr"
,"crlgen.c",647));
  if (!crlGenData || !dataArr) {
      goto loser;
  }

  if (!dataArr[0] || !dataArr[1]) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "insufficient number of arguments.\n");
  }

  lastRange = crlGenData->rangeTo - crlGenData->rangeFrom + 1;

  arena = PORT_NewArenaPORT_NewArena_Util(DER_DEFAULT_CHUNKSIZE(2048));
  if (arena == NULL((void*)0)) {
      goto loser;
  }

  ext = extCreator(arena, dataArr, &extCode);
  if (ext == NULL((void*)0)) {
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "got error while creating extension: %s\n",
                        extName);
      goto loser;
  }

  for (i = 0; i < lastRange; i++) {
      CRLGENEntryData *extData = NULL((void*)0);
      void *extHandle = NULL((void*)0);
      SECItem *certIdItem =
          SEC_ASN1EncodeIntegerSEC_ASN1EncodeInteger_Util(arena, NULL((void*)0),
                                crlGenData->rangeFrom + i);
      if (!certIdItem) {
          rv = SECFailure;
          goto loser;
      }

      extData = crlgen_FindEntry(crlGenData, certIdItem);
      if (!extData) {
          crlgen_PrintError(crlGenData->parsedLineNum,
                            "can not add extension: crl entry "
                            "(serial number: %d) is not in the list yet.\n",
                            crlGenData->rangeFrom + i);
          continue;
      }

      extHandle = extData->extHandle;
      if (extHandle == NULL((void*)0)) {
          extHandle = extData->extHandle =
              CERT_StartCRLEntryExtensions(&crlGenData->signCrl->crl,
                                           (CERTCrlEntry *)extData->entry);
      }
      rv = CERT_AddExtension(extHandle, extCode, ext,
                             (*dataArr[1] == '1') ? PR_TRUE1 : PR_FALSE0,
                             PR_TRUE1);
      if (rv == SECFailure) {
          goto loser;
      }
  }

707loser:
  if (arena)
      PORT_FreeArenaPORT_FreeArena_Util(arena, PR_FALSE0);
  return rv;
711}

713/* Commits all added entries and their's extensions into CRL. */
714SECStatus
715CRLGEN_CommitExtensionsAndEntries(CRLGENGeneratorData *crlGenData)
716{
  int size = 0;
  CERTCrl *crl;
  PLArenaPool *arena;
  SECStatus rv = SECSuccess;
  void *mark;

  PORT_Assert(crlGenData && crlGenData->signCrl && crlGenData->signCrl->arena)((crlGenData && crlGenData->signCrl && crlGenData
->signCrl->arena)?((void)0):PR_Assert("crlGenData && crlGenData->signCrl && crlGenData->signCrl->arena"
,"crlgen.c",723));
  if (!crlGenData || !crlGenData->signCrl || !crlGenData->signCrl->arena) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  arena = crlGenData->signCrl->arena;
  crl = &crlGenData->signCrl->crl;

  mark = PORT_ArenaMarkPORT_ArenaMark_Util(arena);

  if (crlGenData->crlExtHandle)
      CERT_FinishExtensions(crlGenData->crlExtHandle);

  size = crlGenData->entryDataHashTable->nentries;
  crl->entries = NULL((void*)0);
  if (size) {
      crl->entries = PORT_ArenaZNewArray(arena, CERTCrlEntry *, size + 1)(CERTCrlEntry * *)PORT_ArenaZAlloc_Util(arena, sizeof(CERTCrlEntry
 *) * (size + 1));
      if (!crl->entries) {
          rv = SECFailure;
      } else {
          struct commitData dt;
          dt.entries = crl->entries;
          dt.pos = 0;
          PL_HashTableEnumerateEntries(crlGenData->entryDataHashTable,
                                       &crlgen_CommitEntryData, &dt);
          /* Last should be NULL */
          crl->entries[size] = NULL((void*)0);
      }
  }

  if (rv != SECSuccess)
      PORT_ArenaReleasePORT_ArenaRelease_Util(arena, mark);
  return rv;
757}

759/* Initializes extHandle with data from extensions array */
760static SECStatus
761crlgen_InitExtensionHandle(void *extHandle,
                         CERTCertExtension **extensions)
763{
  CERTCertExtension *extension = NULL((void*)0);

  if (!extensions)
      return SECSuccess;

  PORT_Assert(extHandle != NULL)((extHandle != ((void*)0))?((void)0):PR_Assert("extHandle != NULL"
,"crlgen.c",769));
  if (!extHandle) {
      return SECFailure;
  }

  extension = *extensions;
  while (extension) {
      SECOidTag oidTag = SECOID_FindOIDTagSECOID_FindOIDTag_Util(&extension->id);
      /* shell we skip unknown extensions? */
      CERT_AddExtension(extHandle, oidTag, &extension->value,
                        (extension->critical.len != 0) ? PR_TRUE1 : PR_FALSE0,
                        PR_FALSE0);
      extension = *(++extensions);
  }
  return SECSuccess;
784}

786/* Used for initialization of extension handles for crl and certs
* extensions from existing CRL data then modifying existing CRL.*/
788SECStatus
789CRLGEN_ExtHandleInit(CRLGENGeneratorData *crlGenData)
790{
  CERTCrl *crl = NULL((void*)0);
  PRUint64 maxSN = 0;

  PORT_Assert(crlGenData && crlGenData->signCrl &&((crlGenData && crlGenData->signCrl && crlGenData
->entryDataHashTable)?((void)0):PR_Assert("crlGenData && crlGenData->signCrl && crlGenData->entryDataHashTable"
,"crlgen.c",795))
              crlGenData->entryDataHashTable)((crlGenData && crlGenData->signCrl && crlGenData
->entryDataHashTable)?((void)0):PR_Assert("crlGenData && crlGenData->signCrl && crlGenData->entryDataHashTable"
,"crlgen.c",795));
  if (!crlGenData || !crlGenData->signCrl ||
      !crlGenData->entryDataHashTable) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  crl = &crlGenData->signCrl->crl;
  crlGenData->crlExtHandle = CERT_StartCRLExtensions(crl);
  crlgen_InitExtensionHandle(crlGenData->crlExtHandle,
                             crl->extensions);
  crl->extensions = NULL((void*)0);

  if (crl->entries) {
      CERTCrlEntry **entry = crl->entries;
      while (*entry) {
          PRUint64 sn = DER_GetIntegerDER_GetInteger_Util(&(*entry)->serialNumber);
          CRLGENEntryData *extData =
              crlgen_PlaceAnEntry(crlGenData, *entry, &(*entry)->serialNumber);
          if ((*entry)->extensions) {
              extData->extHandle =
                  CERT_StartCRLEntryExtensions(&crlGenData->signCrl->crl,
                                               (CERTCrlEntry *)extData->entry);
              if (crlgen_InitExtensionHandle(extData->extHandle,
                                             (*entry)->extensions) == SECFailure)
                  return SECFailure;
          }
          (*entry)->extensions = NULL((void*)0);
          entry++;
          maxSN = PR_MAX(maxSN, sn)((maxSN)>(sn)?(maxSN):(sn));
      }
  }

  crlGenData->rangeFrom = crlGenData->rangeTo = maxSN + 1;
  return SECSuccess;
830}

832/*****************************************************************************
* Parser trigger functions start here
*/

836/* Sets new internal range value for add/rm certs.*/
837static SECStatus
838crlgen_SetNewRangeField(CRLGENGeneratorData *crlGenData, char *value)
839{
  long rangeFrom = 0, rangeTo = 0;
  char *dashPos = NULL((void*)0);

  PORT_Assert(crlGenData)((crlGenData)?((void)0):PR_Assert("crlGenData","crlgen.c",843
));
  if (!crlGenData) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  if (value == NULL((void*)0)) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "insufficient number of arguments.\n");
      return SECFailure;
  }

  if ((dashPos = strchr(value, '-')) != NULL((void*)0)) {
      char *rangeToS, *rangeFromS = value;
      *dashPos = '\0';
      rangeFrom = atoi(rangeFromS);
      *dashPos = '-';

      rangeToS = (char *)(dashPos + 1);
      rangeTo = atol(rangeToS);
  } else {
      rangeFrom = atol(value);
      rangeTo = rangeFrom;
  }

  if (rangeFrom < 1 || rangeTo < rangeFrom) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "bad cert id range: %s.\n", value);
      return SECFailure;
  }

  crlGenData->rangeFrom = rangeFrom;
  crlGenData->rangeTo = rangeTo;

  return SECSuccess;
880}

882/* Changes issuer subject field in CRL. By default this data is taken from
* issuer cert subject field.Not yet implemented */
884static SECStatus
885crlgen_SetIssuerField(CRLGENGeneratorData *crlGenData, char *value)
886{
  crlgen_PrintError(crlGenData->parsedLineNum,
                    "Can not change CRL issuer field.\n");
  return SECFailure;
890}

892/* Encode and sets CRL thisUpdate and nextUpdate time fields*/
893static SECStatus
894crlgen_SetTimeField(CRLGENGeneratorData *crlGenData, char *value,
                  PRBool setThisUpdate)
896{
  CERTSignedCrl *signCrl;
  PLArenaPool *arena;
  CERTCrl *crl;
  int length = 0;
  SECItem *timeDest = NULL((void*)0);

  PORT_Assert(crlGenData && crlGenData->signCrl &&((crlGenData && crlGenData->signCrl && crlGenData
->signCrl->arena)?((void)0):PR_Assert("crlGenData && crlGenData->signCrl && crlGenData->signCrl->arena"
,"crlgen.c",904))
              crlGenData->signCrl->arena)((crlGenData && crlGenData->signCrl && crlGenData
->signCrl->arena)?((void)0):PR_Assert("crlGenData && crlGenData->signCrl && crlGenData->signCrl->arena"
,"crlgen.c",904));
  if (!crlGenData || !crlGenData->signCrl || !crlGenData->signCrl->arena) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  signCrl = crlGenData->signCrl;
  arena = signCrl->arena;
  crl = &signCrl->crl;

  if (value == NULL((void*)0)) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "insufficient number of arguments.\n");
      return SECFailure;
  }
  length = PORT_Strlen(value)strlen(value);

  if (setThisUpdate == PR_TRUE1) {
      timeDest = &crl->lastUpdate;
  } else {
      timeDest = &crl->nextUpdate;
  }

  timeDest->type = siGeneralizedTime;
  timeDest->data = PORT_ArenaAllocPORT_ArenaAlloc_Util(arena, length);
  if (!timeDest->data) {
      return SECFailure;
  }
  PORT_Memcpymemcpy(timeDest->data, value, length);
  timeDest->len = length;

  return SECSuccess;
937}

939/* Adds new extension into CRL or added cert handles */
940static SECStatus
941crlgen_AddExtension(CRLGENGeneratorData *crlGenData, const char **extData)
942{
  PORT_Assert(crlGenData && crlGenData->crlExtHandle)((crlGenData && crlGenData->crlExtHandle)?((void)0
):PR_Assert("crlGenData && crlGenData->crlExtHandle"
,"crlgen.c",943));
  if (!crlGenData || !crlGenData->crlExtHandle) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  if (extData == NULL((void*)0) || *extData == NULL((void*)0)) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "insufficient number of arguments.\n");
      return SECFailure;
  }
  if (!PORT_Strcmpstrcmp(*extData, "authKeyId"))
      return crlgen_AddAuthKeyID(crlGenData, extData);
  else if (!PORT_Strcmpstrcmp(*extData, "issuerAltNames"))
      return crlgen_AddIssuerAltNames(crlGenData, extData);
  else if (!PORT_Strcmpstrcmp(*extData, "crlNumber"))
      return crlgen_AddCrlNumber(crlGenData, extData);
  else if (!PORT_Strcmpstrcmp(*extData, "reasonCode"))
      return crlgen_AddEntryExtension(crlGenData, extData, "reasonCode",
                                      crlgen_CreateReasonCode);
  else if (!PORT_Strcmpstrcmp(*extData, "invalidityDate"))
      return crlgen_AddEntryExtension(crlGenData, extData, "invalidityDate",
                                      crlgen_CreateInvalidityDate);
  else {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "insufficient number of arguments.\n");
      return SECFailure;
  }
973}

975/* Created CRLGENEntryData for cert with serial number certId and
* adds it to entryDataHashTable. certId can be a single cert serial
* number or an inclusive rage of certs */
978static SECStatus
979crlgen_AddCert(CRLGENGeneratorData *crlGenData,
             char *certId, char *revocationDate)
981{
  CERTSignedCrl *signCrl;
  SECItem *certIdItem;
  PLArenaPool *arena;
  PRUint64 rangeFrom = 0, rangeTo = 0, i = 0;
  int timeValLength = -1;
  SECStatus rv = SECFailure;
  void *mark;
6
←
'mark' declared without an initial value→

  PORT_Assert(crlGenData && crlGenData->signCrl &&((crlGenData && crlGenData->signCrl && crlGenData
->signCrl->arena)?((void)0):PR_Assert("crlGenData && crlGenData->signCrl && crlGenData->signCrl->arena"
,"crlgen.c",991))
7
←
Assuming field 'signCrl' is non-null→
8
←
Assuming field 'arena' is non-null→
              crlGenData->signCrl->arena)((crlGenData && crlGenData->signCrl && crlGenData
->signCrl->arena)?((void)0):PR_Assert("crlGenData && crlGenData->signCrl && crlGenData->signCrl->arena"
,"crlgen.c",991));
  if (!crlGenData8.1
'crlGenData' is non-null
 || !crlGenData->signCrl8.2
Field 'signCrl' is non-null
 || !crlGenData->signCrl->arena8.3
Field 'arena' is non-null
) {
9
←
Taking false branch→
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  signCrl = crlGenData->signCrl;
  arena = signCrl->arena;

  if (!certId || !revocationDate) {
10
←
Assuming 'certId' is non-null→
11
←
Assuming 'revocationDate' is non-null→
12
←
Taking false branch→
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "insufficient number of arguments.\n");
      return SECFailure;
  }

  timeValLength = strlen(revocationDate);

  if (crlgen_SetNewRangeField(crlGenData, certId) == SECFailure &&
      certId) {
      return SECFailure;
  }
  rangeFrom = crlGenData->rangeFrom;
  rangeTo = crlGenData->rangeTo;

  for (i = 0; i < rangeTo - rangeFrom + 1; i++) {
13
←
Assuming the condition is false→
14
←
Loop condition is false. Execution continues on line 1060→
      CERTCrlEntry *entry;
      mark = PORT_ArenaMarkPORT_ArenaMark_Util(arena);
      entry = PORT_ArenaZNew(arena, CERTCrlEntry)(CERTCrlEntry *)PORT_ArenaZAlloc_Util(arena, sizeof(CERTCrlEntry
));
      if (entry == NULL((void*)0)) {
          goto loser;
      }

      certIdItem = SEC_ASN1EncodeIntegerSEC_ASN1EncodeInteger_Util(arena, &entry->serialNumber,
                                         rangeFrom + i);
      if (!certIdItem) {
          goto loser;
      }

      if (crlgen_FindEntry(crlGenData, certIdItem)) {
          crlgen_PrintError(crlGenData->parsedLineNum,
                            "entry already exists. Use \"range\" "
                            "and \"rmcert\" before adding a new one with the "
                            "same serial number %ld\n",
                            rangeFrom + i);
          goto loser;
      }

      entry->serialNumber.type = siBuffer;

      entry->revocationDate.type = siGeneralizedTime;

      entry->revocationDate.data =
          PORT_ArenaAllocPORT_ArenaAlloc_Util(arena, timeValLength);
      if (entry->revocationDate.data == NULL((void*)0)) {
          goto loser;
      }

      PORT_Memcpymemcpy(entry->revocationDate.data, revocationDate,
                  timeValLength * sizeof(char));
      entry->revocationDate.len = timeValLength;

      entry->extensions = NULL((void*)0);
      if (!crlgen_PlaceAnEntry(crlGenData, entry, certIdItem)) {
          goto loser;
      }
      mark = NULL((void*)0);
  }

  rv = SECSuccess;
1061loser:
  if (mark) {
15
←
Branch condition evaluates to a garbage value
      PORT_ArenaReleasePORT_ArenaRelease_Util(arena, mark);
  }
  return rv;
1066}

1068/* Removes certs from entryDataHashTable which have certId serial number.
* certId can have value of a range of certs */
1070static SECStatus
1071crlgen_RmCert(CRLGENGeneratorData *crlGenData, char *certId)
1072{
  PRUint64 i = 0;

  PORT_Assert(crlGenData && certId)((crlGenData && certId)?((void)0):PR_Assert("crlGenData && certId"
,"crlgen.c",1075));
  if (!crlGenData || !certId) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  if (crlgen_SetNewRangeField(crlGenData, certId) == SECFailure &&
      certId) {
      return SECFailure;
  }

  for (i = 0; i < crlGenData->rangeTo - crlGenData->rangeFrom + 1; i++) {
      SECItem *certIdItem = SEC_ASN1EncodeIntegerSEC_ASN1EncodeInteger_Util(NULL((void*)0), NULL((void*)0),
                                                  crlGenData->rangeFrom + i);
      if (certIdItem) {
          CRLGENEntryData *extData =
              crlgen_FindEntry(crlGenData, certIdItem);
          if (!extData) {
              printf("Cert with id %s is not in the list\n", certId);
          } else {
              crlgen_RmEntry(crlGenData, certIdItem);
          }
          SECITEM_FreeItemSECITEM_FreeItem_Util(certIdItem, PR_TRUE1);
      }
  }

  return SECSuccess;
1102}

1104/*************************************************************************
* Lex Parser Helper functions are used to store parsed information
* in context related structures. Context(or state) is identified base on
* a type of a instruction parser currently is going through. New context
* is identified by first token in a line. It can be addcert context,
* addext context, etc. */

1111/* Updates CRL field depending on current context */
1112static SECStatus
1113crlgen_updateCrlFn_field(CRLGENGeneratorData *crlGenData, void *str)
1114{
  CRLGENCrlField *fieldStr = (CRLGENCrlField *)str;

  PORT_Assert(crlGenData)((crlGenData)?((void)0):PR_Assert("crlGenData","crlgen.c",1117
));
  if (!crlGenData) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  switch (crlGenData->contextId) {
      case CRLGEN_ISSUER_CONTEXT1:
          crlgen_SetIssuerField(crlGenData, fieldStr->value);
          break;
      case CRLGEN_UPDATE_CONTEXT2:
          return crlgen_SetTimeField(crlGenData, fieldStr->value, PR_TRUE1);
          break;
      case CRLGEN_NEXT_UPDATE_CONTEXT3:
          return crlgen_SetTimeField(crlGenData, fieldStr->value, PR_FALSE0);
          break;
      case CRLGEN_CHANGE_RANGE_CONTEXT7:
          return crlgen_SetNewRangeField(crlGenData, fieldStr->value);
          break;
      default:
          crlgen_PrintError(crlGenData->parsedLineNum,
                            "syntax error (unknow token type: %d)\n",
                            crlGenData->contextId);
          PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
          return SECFailure;
  }
  return SECSuccess;
1144}

1146/* Sets parsed data for CRL field update into temporary structure */
1147static SECStatus
1148crlgen_setNextDataFn_field(CRLGENGeneratorData *crlGenData, void *str,
                         void *data, unsigned short dtype)
1150{
  CRLGENCrlField *fieldStr = (CRLGENCrlField *)str;

  PORT_Assert(crlGenData)((crlGenData)?((void)0):PR_Assert("crlGenData","crlgen.c",1153
));
  if (!crlGenData) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  switch (crlGenData->contextId) {
      case CRLGEN_CHANGE_RANGE_CONTEXT7:
          if (dtype != CRLGEN_TYPE_DIGIT2 && dtype != CRLGEN_TYPE_DIGIT_RANGE3) {
              crlgen_PrintError(crlGenData->parsedLineNum,
                                "range value should have "
                                "numeric or numeric range values.\n");
              return SECFailure;
          }
          break;
      case CRLGEN_NEXT_UPDATE_CONTEXT3:
      case CRLGEN_UPDATE_CONTEXT2:
          if (dtype != CRLGEN_TYPE_ZDATE1) {
              crlgen_PrintError(crlGenData->parsedLineNum,
                                "bad formated date. Should be "
                                "YYYYMMDDHHMMSSZ.\n");
              return SECFailure;
          }
          break;
      default:
          PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
          crlgen_PrintError(crlGenData->parsedLineNum,
                            "syntax error (unknow token type: %d).\n",
                            crlGenData->contextId, data);
          return SECFailure;
  }
  fieldStr->value = PORT_StrdupPORT_Strdup_Util(data);
  if (!fieldStr->value) {
      return SECFailure;
  }
  return SECSuccess;
1189}

1191/* Triggers cert entries update depending on current context */
1192static SECStatus
1193crlgen_updateCrlFn_cert(CRLGENGeneratorData *crlGenData, void *str)
1194{
  CRLGENCertEntry *certStr = (CRLGENCertEntry *)str;

  PORT_Assert(crlGenData)((crlGenData)?((void)0):PR_Assert("crlGenData","crlgen.c",1197
));
1
Assuming 'crlGenData' is non-null→
2
←
'?' condition is true→
  if (!crlGenData2.1
'crlGenData' is non-null
) {
3
←
Taking false branch→
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  switch (crlGenData->contextId) {
4
←
Control jumps to 'case 6:'  at line 1204→
      case CRLGEN_ADD_CERT_CONTEXT6:
          return crlgen_AddCert(crlGenData, certStr->certId,
5
←
Calling 'crlgen_AddCert'→
                                certStr->revocationTime);
      case CRLGEN_RM_CERT_CONTEXT8:
          return crlgen_RmCert(crlGenData, certStr->certId);
      default:
          PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
          crlgen_PrintError(crlGenData->parsedLineNum,
                            "syntax error (unknow token type: %d).\n",
                            crlGenData->contextId);
          return SECFailure;
  }
1216}

1218/* Sets parsed data for CRL entries update into temporary structure */
1219static SECStatus
1220crlgen_setNextDataFn_cert(CRLGENGeneratorData *crlGenData, void *str,
                        void *data, unsigned short dtype)
1222{
  CRLGENCertEntry *certStr = (CRLGENCertEntry *)str;

  PORT_Assert(crlGenData)((crlGenData)?((void)0):PR_Assert("crlGenData","crlgen.c",1225
));
  if (!crlGenData) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  switch (dtype) {
      case CRLGEN_TYPE_DIGIT2:
      case CRLGEN_TYPE_DIGIT_RANGE3:
          certStr->certId = PORT_StrdupPORT_Strdup_Util(data);
          if (!certStr->certId) {
              return SECFailure;
          }
          break;
      case CRLGEN_TYPE_DATE0:
      case CRLGEN_TYPE_ZDATE1:
          certStr->revocationTime = PORT_StrdupPORT_Strdup_Util(data);
          if (!certStr->revocationTime) {
              return SECFailure;
          }
          break;
      default:
          PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
          crlgen_PrintError(crlGenData->parsedLineNum,
                            "syntax error (unknow token type: %d).\n",
                            crlGenData->contextId);
          return SECFailure;
  }
  return SECSuccess;
1254}

1256/* Triggers cert entries/crl extension update */
1257static SECStatus
1258crlgen_updateCrlFn_extension(CRLGENGeneratorData *crlGenData, void *str)
1259{
  CRLGENExtensionEntry *extStr = (CRLGENExtensionEntry *)str;

  return crlgen_AddExtension(crlGenData, (const char **)extStr->extData);
1263}

1265/* Defines maximum number of fields extension may have */
1266#define MAX_EXT_DATA_LENGTH10 10

1268/* Sets parsed extension data for CRL entries/CRL extensions update
* into temporary structure */
1270static SECStatus
1271crlgen_setNextDataFn_extension(CRLGENGeneratorData *crlGenData, void *str,
                             void *data, unsigned short dtype)
1273{
  CRLGENExtensionEntry *extStr = (CRLGENExtensionEntry *)str;

  PORT_Assert(crlGenData)((crlGenData)?((void)0):PR_Assert("crlGenData","crlgen.c",1276
));
  if (!crlGenData) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  if (extStr->extData == NULL((void*)0)) {
      extStr->extData = PORT_ZNewArray(char *, MAX_EXT_DATA_LENGTH)(char * *)PORT_ZAlloc_Util(sizeof(char *) * (10));
      if (!extStr->extData) {
          return SECFailure;
      }
  }
  if (extStr->nextUpdatedData >= MAX_EXT_DATA_LENGTH10) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      crlgen_PrintError(crlGenData->parsedLineNum,
                        "number of fields in extension "
                        "exceeded maximum allowed data length: %d.\n",
                        MAX_EXT_DATA_LENGTH10);
      return SECFailure;
  }
  extStr->extData[extStr->nextUpdatedData] = PORT_StrdupPORT_Strdup_Util(data);
  if (!extStr->extData[extStr->nextUpdatedData]) {
      return SECFailure;
  }
  extStr->nextUpdatedData += 1;

  return SECSuccess;
1303}

1305/****************************************************************************************
* Top level functions are triggered directly by parser.
*/

1309/*
* crl generation script parser recreates a temporary data staructure
* for each line it is going through. This function cleans temp structure.
*/
1313void
1314crlgen_destroyTempData(CRLGENGeneratorData *crlGenData)
1315{
  if (crlGenData->contextId != CRLGEN_UNKNOWN_CONTEXT0) {
      switch (crlGenData->contextId) {
          case CRLGEN_ISSUER_CONTEXT1:
          case CRLGEN_UPDATE_CONTEXT2:
          case CRLGEN_NEXT_UPDATE_CONTEXT3:
          case CRLGEN_CHANGE_RANGE_CONTEXT7:
              if (crlGenData->crlField->value)
                  PORT_FreePORT_Free_Util(crlGenData->crlField->value);
              PORT_FreePORT_Free_Util(crlGenData->crlField);
              break;
          case CRLGEN_ADD_CERT_CONTEXT6:
          case CRLGEN_RM_CERT_CONTEXT8:
              if (crlGenData->certEntry->certId)
                  PORT_FreePORT_Free_Util(crlGenData->certEntry->certId);
              if (crlGenData->certEntry->revocationTime)
                  PORT_FreePORT_Free_Util(crlGenData->certEntry->revocationTime);
              PORT_FreePORT_Free_Util(crlGenData->certEntry);
              break;
          case CRLGEN_ADD_EXTENSION_CONTEXT4:
              if (crlGenData->extensionEntry->extData) {
                  int i = 0;
                  for (; i < crlGenData->extensionEntry->nextUpdatedData; i++)
                      PORT_FreePORT_Free_Util(*(crlGenData->extensionEntry->extData + i));
                  PORT_FreePORT_Free_Util(crlGenData->extensionEntry->extData);
              }
              PORT_FreePORT_Free_Util(crlGenData->extensionEntry);
              break;
      }
      crlGenData->contextId = CRLGEN_UNKNOWN_CONTEXT0;
  }
1346}

1348SECStatus
1349crlgen_updateCrl(CRLGENGeneratorData *crlGenData)
1350{
  SECStatus rv = SECSuccess;

  PORT_Assert(crlGenData)((crlGenData)?((void)0):PR_Assert("crlGenData","crlgen.c",1353
));
  if (!crlGenData) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  switch (crlGenData->contextId) {
      case CRLGEN_ISSUER_CONTEXT1:
      case CRLGEN_UPDATE_CONTEXT2:
      case CRLGEN_NEXT_UPDATE_CONTEXT3:
      case CRLGEN_CHANGE_RANGE_CONTEXT7:
          rv = crlGenData->crlField->updateCrlFn(crlGenData, crlGenData->crlField);
          break;
      case CRLGEN_RM_CERT_CONTEXT8:
      case CRLGEN_ADD_CERT_CONTEXT6:
          rv = crlGenData->certEntry->updateCrlFn(crlGenData, crlGenData->certEntry);
          break;
      case CRLGEN_ADD_EXTENSION_CONTEXT4:
          rv = crlGenData->extensionEntry->updateCrlFn(crlGenData, crlGenData->extensionEntry);
          break;
      case CRLGEN_UNKNOWN_CONTEXT0:
          break;
      default:
          crlgen_PrintError(crlGenData->parsedLineNum,
                            "unknown lang context type code: %d.\n",
                            crlGenData->contextId);
          PORT_Assert(0)((0)?((void)0):PR_Assert("0","crlgen.c",1379));
          return SECFailure;
  }
  /* Clrean structures after crl update */
  crlgen_destroyTempData(crlGenData);

  crlGenData->parsedLineNum += 1;

  return rv;
1388}

1390SECStatus
1391crlgen_setNextData(CRLGENGeneratorData *crlGenData, void *data,
                 unsigned short dtype)
1393{
  SECStatus rv = SECSuccess;

  PORT_Assert(crlGenData)((crlGenData)?((void)0):PR_Assert("crlGenData","crlgen.c",1396
));
  if (!crlGenData) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  switch (crlGenData->contextId) {
      case CRLGEN_ISSUER_CONTEXT1:
      case CRLGEN_UPDATE_CONTEXT2:
      case CRLGEN_NEXT_UPDATE_CONTEXT3:
      case CRLGEN_CHANGE_RANGE_CONTEXT7:
          rv = crlGenData->crlField->setNextDataFn(crlGenData, crlGenData->crlField,
                                                   data, dtype);
          break;
      case CRLGEN_ADD_CERT_CONTEXT6:
      case CRLGEN_RM_CERT_CONTEXT8:
          rv = crlGenData->certEntry->setNextDataFn(crlGenData, crlGenData->certEntry,
                                                    data, dtype);
          break;
      case CRLGEN_ADD_EXTENSION_CONTEXT4:
          rv =
              crlGenData->extensionEntry->setNextDataFn(crlGenData, crlGenData->extensionEntry, data, dtype);
          break;
      case CRLGEN_UNKNOWN_CONTEXT0:
          break;
      default:
          crlgen_PrintError(crlGenData->parsedLineNum,
                            "unknown context type: %d.\n",
                            crlGenData->contextId);
          PORT_Assert(0)((0)?((void)0):PR_Assert("0","crlgen.c",1425));
          return SECFailure;
  }
  return rv;
1429}

1431SECStatus
1432crlgen_createNewLangStruct(CRLGENGeneratorData *crlGenData,
                         unsigned structType)
1434{
  PORT_Assert(crlGenData &&((crlGenData && crlGenData->contextId == 0)?((void
)0):PR_Assert("crlGenData && crlGenData->contextId == CRLGEN_UNKNOWN_CONTEXT"
,"crlgen.c",1436))
              crlGenData->contextId == CRLGEN_UNKNOWN_CONTEXT)((crlGenData && crlGenData->contextId == 0)?((void
)0):PR_Assert("crlGenData && crlGenData->contextId == CRLGEN_UNKNOWN_CONTEXT"
,"crlgen.c",1436));
  if (!crlGenData ||
      crlGenData->contextId != CRLGEN_UNKNOWN_CONTEXT0) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }

  switch (structType) {
      case CRLGEN_ISSUER_CONTEXT1:
      case CRLGEN_UPDATE_CONTEXT2:
      case CRLGEN_NEXT_UPDATE_CONTEXT3:
      case CRLGEN_CHANGE_RANGE_CONTEXT7:
          crlGenData->crlField = PORT_New(CRLGENCrlField)(CRLGENCrlField *)PORT_Alloc_Util(sizeof(CRLGENCrlField));
          if (!crlGenData->crlField) {
              return SECFailure;
          }
          crlGenData->contextId = structType;
          crlGenData->crlField->value = NULL((void*)0);
          crlGenData->crlField->updateCrlFn = &crlgen_updateCrlFn_field;
          crlGenData->crlField->setNextDataFn = &crlgen_setNextDataFn_field;
          break;
      case CRLGEN_RM_CERT_CONTEXT8:
      case CRLGEN_ADD_CERT_CONTEXT6:
          crlGenData->certEntry = PORT_New(CRLGENCertEntry)(CRLGENCertEntry *)PORT_Alloc_Util(sizeof(CRLGENCertEntry));
          if (!crlGenData->certEntry) {
              return SECFailure;
          }
          crlGenData->contextId = structType;
          crlGenData->certEntry->certId = 0;
          crlGenData->certEntry->revocationTime = NULL((void*)0);
          crlGenData->certEntry->updateCrlFn = &crlgen_updateCrlFn_cert;
          crlGenData->certEntry->setNextDataFn = &crlgen_setNextDataFn_cert;
          break;
      case CRLGEN_ADD_EXTENSION_CONTEXT4:
          crlGenData->extensionEntry = PORT_New(CRLGENExtensionEntry)(CRLGENExtensionEntry *)PORT_Alloc_Util(sizeof(CRLGENExtensionEntry
));
          if (!crlGenData->extensionEntry) {
              return SECFailure;
          }
          crlGenData->contextId = structType;
          crlGenData->extensionEntry->extData = NULL((void*)0);
          crlGenData->extensionEntry->nextUpdatedData = 0;
          crlGenData->extensionEntry->updateCrlFn =
              &crlgen_updateCrlFn_extension;
          crlGenData->extensionEntry->setNextDataFn =
              &crlgen_setNextDataFn_extension;
          break;
      case CRLGEN_UNKNOWN_CONTEXT0:
          break;
      default:
          crlgen_PrintError(crlGenData->parsedLineNum,
                            "unknown context type: %d.\n", structType);
          PORT_Assert(0)((0)?((void)0):PR_Assert("0","crlgen.c",1487));
          return SECFailure;
  }
  return SECSuccess;
1491}

1493/* Parser initialization function */
1494CRLGENGeneratorData *
1495CRLGEN_InitCrlGeneration(CERTSignedCrl *signCrl, PRFileDesc *src)
1496{
  CRLGENGeneratorData *crlGenData = NULL((void*)0);

  PORT_Assert(signCrl && src)((signCrl && src)?((void)0):PR_Assert("signCrl && src"
,"crlgen.c",1499));
  if (!signCrl || !src) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return NULL((void*)0);
  }

  crlGenData = PORT_ZNew(CRLGENGeneratorData)(CRLGENGeneratorData *)PORT_ZAlloc_Util(sizeof(CRLGENGeneratorData
));
  if (!crlGenData) {
      return NULL((void*)0);
  }

  crlGenData->entryDataHashTable =
      PL_NewHashTable(0, SECITEM_Hash, SECITEM_HashCompare,
                      PL_CompareValues, NULL((void*)0), NULL((void*)0));
  if (!crlGenData->entryDataHashTable) {
      PORT_FreePORT_Free_Util(crlGenData);
      return NULL((void*)0);
  }

  crlGenData->src = src;
  crlGenData->parsedLineNum = 1;
  crlGenData->contextId = CRLGEN_UNKNOWN_CONTEXT0;
  crlGenData->signCrl = signCrl;
  crlGenData->rangeFrom = 0;
  crlGenData->rangeTo = 0;
  crlGenData->crlExtHandle = NULL((void*)0);

  PORT_SetErrorPORT_SetError_Util(0);

  return crlGenData;
1529}

1531void
1532CRLGEN_FinalizeCrlGeneration(CRLGENGeneratorData *crlGenData)
1533{
  if (!crlGenData)
      return;
  if (crlGenData->src)
      PR_Close(crlGenData->src);
  PL_HashTableDestroy(crlGenData->entryDataHashTable);
  PORT_FreePORT_Free_Util(crlGenData);
1540}