Upgrade chrome's OpenSSL to same version Android ships with.

openssl/crypto/asn1/a_object.c

 /* crypto/asn1/a_object.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
  * The implementation was written so as to conform with Netscapes SSL.
  * 
  * This library is free for commercial and non-commercial use as long as
  * the following conditions are aheared to.  The following conditions
@@ skipping 121 matching lines @@
                         if (num <= 0) break;
                         num--;
                         c= *(p++);
                         if ((c == ' ') || (c == '.'))
                                 break;
                         if ((c < '0') || (c > '9'))
                                 {
                                 ASN1err(ASN1_F_A2D_ASN1_OBJECT,ASN1_R_INVALID_DIGIT);
                                 goto err;
                                 }
-                        if (!use_bn && l > (ULONG_MAX / 10L))
+                        if (!use_bn && l >= ((ULONG_MAX - 80) / 10L))
                                 {
                                 use_bn = 1;
                                 if (!bl)
                                         bl = BN_new();
                                 if (!bl || !BN_set_word(bl, l))
                                         goto err;
                                 }
                         if (use_bn)
                                 {
                                 if (!BN_mul_word(bl, 10L)
@@ skipping 121 matching lines @@
         if (tag != V_ASN1_OBJECT)
                 {
                 i=ASN1_R_EXPECTING_AN_OBJECT;
                 goto err;
                 }
         ret = c2i_ASN1_OBJECT(a, &p, len);
         if(ret) *pp = p;
         return ret;
 err:
         ASN1err(ASN1_F_D2I_ASN1_OBJECT,i);
-        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_OBJECT_free(ret);
         return(NULL);
 }
 ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
              long len)
         {
         ASN1_OBJECT *ret=NULL;
         const unsigned char *p;
+        unsigned char *data;
         int i;
         /* Sanity check OID encoding: can't have leading 0x80 in
          * subidentifiers, see: X.690 8.19.2
          */
-        for (i = 0, p = *pp + 1; i < len - 1; i++, p++)
+        for (i = 0, p = *pp; i < len; i++, p++)
                 {
                 if (*p == 0x80 && (!i || !(p[-1] & 0x80)))
                         {
                         ASN1err(ASN1_F_C2I_ASN1_OBJECT,ASN1_R_INVALID_OBJECT_ENCODING);
                         return NULL;
                         }
                 }
 
         /* only the ASN1_OBJECTs from the 'table' will have values
          * for ->sn or ->ln */
         if ((a == NULL) || ((*a) == NULL) ||
                 !((*a)->flags & ASN1_OBJECT_FLAG_DYNAMIC))
                 {
                 if ((ret=ASN1_OBJECT_new()) == NULL) return(NULL);
                 }
         else    ret=(*a);
 
         p= *pp;
-        if ((ret->data == NULL) || (ret->length < len))
+        /* detach data from object */
+        data = (unsigned char *)ret->data;
+        ret->data = NULL;
+        /* once detached we can change it */
+        if ((data == NULL) || (ret->length < len))
                 {
-                if (ret->data != NULL) OPENSSL_free(ret->data);
-                ret->data=(unsigned char *)OPENSSL_malloc(len ? (int)len : 1);
+                ret->length=0;
+                if (data != NULL) OPENSSL_free(data);
+                data=(unsigned char *)OPENSSL_malloc(len ? (int)len : 1);
+                if (data == NULL)
+                        { i=ERR_R_MALLOC_FAILURE; goto err; }
                 ret->flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
-                if (ret->data == NULL)
-                        { i=ERR_R_MALLOC_FAILURE; goto err; }
                 }
-        memcpy(ret->data,p,(int)len);
+        memcpy(data,p,(int)len);
+        /* reattach data to object, after which it remains const */
+        ret->data  =data;
         ret->length=(int)len;
         ret->sn=NULL;
         ret->ln=NULL;
         /* ret->flags=ASN1_OBJECT_FLAG_DYNAMIC; we know it is dynamic */
         p+=len;
 
         if (a != NULL) (*a)=ret;
         *pp=p;
         return(ret);
 err:
@@ skipping 28 matching lines @@
         if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS)
                 {
 #ifndef CONST_STRICT /* disable purely for compile-time strict const checking. Doing this on a "real" compile will cause memory leaks */
                 if (a->sn != NULL) OPENSSL_free((void *)a->sn);
                 if (a->ln != NULL) OPENSSL_free((void *)a->ln);
 #endif
                 a->sn=a->ln=NULL;
                 }
         if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_DATA)
                 {
-                if (a->data != NULL) OPENSSL_free(a->data);
+                if (a->data != NULL) OPENSSL_free((void *)a->data);
                 a->data=NULL;
                 a->length=0;
                 }
         if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC)
                 OPENSSL_free(a);
         }
 
 ASN1_OBJECT *ASN1_OBJECT_create(int nid, unsigned char *data, int len,
              const char *sn, const char *ln)
         {
         ASN1_OBJECT o;
 
         o.sn=sn;
         o.ln=ln;
         o.data=data;
         o.nid=nid;
         o.length=len;
         o.flags=ASN1_OBJECT_FLAG_DYNAMIC|ASN1_OBJECT_FLAG_DYNAMIC_STRINGS|
                 ASN1_OBJECT_FLAG_DYNAMIC_DATA;
         return(OBJ_dup(&o));
         }
 
 IMPLEMENT_STACK_OF(ASN1_OBJECT)
 IMPLEMENT_ASN1_SET_OF(ASN1_OBJECT)