Update from https://crrev.com/311145

net/android/keystore_openssl.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/android/keystore_openssl.h"
 
 #include <jni.h>
 #include <openssl/bn.h>
 #include <openssl/dsa.h>
 #include <openssl/ec.h>
 #include <openssl/engine.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/rsa.h>
+#include <openssl/x509.h>
 
 #include "base/android/build_info.h"
 #include "base/android/jni_android.h"
 #include "base/android/scoped_java_ref.h"
 #include "base/basictypes.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "crypto/openssl_util.h"
 #include "net/android/keystore.h"
 #include "net/android/legacy_openssl.h"
@@ skipping 34 matching lines @@
 // that's referenced by the key using |EX_DATA|.
 
 using base::android::ScopedJavaGlobalRef;
 using base::android::ScopedJavaLocalRef;
 
 namespace net {
 namespace android {
 
 namespace {
 
+using ScopedPKCS8_PRIV_KEY_INFO =
+    crypto::ScopedOpenSSL<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>::Type;
+
 extern const RSA_METHOD android_rsa_method;
 extern const ECDSA_METHOD android_ecdsa_method;
 
 // KeyExData contains the data that is contained in the EX_DATA of the RSA, DSA
 // and ECDSA objects that are created to wrap Android system keys.
 struct KeyExData {
   // private_key contains a reference to a Java, private-key object.
   jobject private_key;
   // legacy_rsa, if not NULL, points to an RSA* in the system's OpenSSL (which
   // might not be ABI compatible with Chromium).
@@ skipping 232 matching lines @@
 
 // Setup an EVP_PKEY to wrap an existing platform RSA PrivateKey object.
 // |private_key| is the JNI reference (local or global) to the object.
 // |legacy_rsa|, if non-NULL, is a pointer to the system OpenSSL RSA object
 // backing |private_key|. This parameter is only used for Android < 4.2 to
 // implement key operations not exposed by the platform.
 // Returns a new EVP_PKEY on success, NULL otherwise.
 // On success, this creates a new global JNI reference to the object
 // that is owned by and destroyed with the EVP_PKEY. I.e. caller can
 // free |private_key| after the call.
-crypto::ScopedEVP_PKEY GetRsaPkeyWrapper(jobject private_key,
-                                         AndroidRSA* legacy_rsa) {
+crypto::ScopedEVP_PKEY CreateRsaPkeyWrapper(
+    jobject private_key,
+    AndroidRSA* legacy_rsa,
+    const crypto::OpenSSLErrStackTracer& tracer) {
   crypto::ScopedRSA rsa(
       RSA_new_method(global_boringssl_engine.Get().engine()));
 
   ScopedJavaGlobalRef<jobject> global_key;
   global_key.Reset(NULL, private_key);
   if (global_key.is_null()) {
     LOG(ERROR) << "Could not create global JNI reference";
     return crypto::ScopedEVP_PKEY();
   }
 
@@ skipping 47 matching lines @@
  private:
   ScopedJavaGlobalRef<jobject> engine_;
 };
 
 void LeakEngine(jobject private_key) {
   static base::LazyInstance<KeystoreEngineWorkaround>::Leaky s_instance =
       LAZY_INSTANCE_INITIALIZER;
   s_instance.Get().LeakEngine(private_key);
 }
 
-// Setup an EVP_PKEY to wrap an existing platform RSA PrivateKey object
-// for Android 4.0 to 4.1.x. Must only be used on Android < 4.2.
-// |private_key| is a JNI reference (local or global) to the object.
-// |pkey| is the EVP_PKEY to setup as a wrapper.
-// Returns true on success, false otherwise.
-crypto::ScopedEVP_PKEY GetRsaLegacyKey(jobject private_key) {
+// Creates an EVP_PKEY wrapper corresponding to the RSA key
+// |private_key|. Returns nullptr on failure.
+crypto::ScopedEVP_PKEY GetRsaPkeyWrapper(jobject private_key) {
+  const int kAndroid42ApiLevel = 17;
+  crypto::OpenSSLErrStackTracer tracer(FROM_HERE);
+
+  if (base::android::BuildInfo::GetInstance()->sdk_int() >=
+      kAndroid42ApiLevel) {
+    return CreateRsaPkeyWrapper(private_key, nullptr, tracer);
+  }
+
+  // Route around platform bug: if Android < 4.2, then
+  // base::android::RawSignDigestWithPrivateKey() cannot work, so instead, try
+  // to get the system OpenSSL's EVP_PKEY begin this PrivateKey object.
   AndroidEVP_PKEY* sys_pkey =
       GetOpenSSLSystemHandleForPrivateKey(private_key);
   if (sys_pkey != NULL) {
     if (sys_pkey->type != ANDROID_EVP_PKEY_RSA) {
       LOG(ERROR) << "Private key has wrong type!";
-      return crypto::ScopedEVP_PKEY();
+      return nullptr;
     }
 
     AndroidRSA* sys_rsa = sys_pkey->pkey.rsa;
     if (sys_rsa->engine) {
       // |private_key| may not have an engine if the PrivateKey did not come
       // from the key store, such as in unit tests.
       if (strcmp(sys_rsa->engine->id, "keystore") == 0) {
         LeakEngine(private_key);
       } else {
         NOTREACHED();
       }
     }
 
-    return GetRsaPkeyWrapper(private_key, sys_rsa);
+    return CreateRsaPkeyWrapper(private_key, sys_rsa, tracer);
   }
 
   // GetOpenSSLSystemHandleForPrivateKey() will fail on Android 4.0.3 and
   // earlier. However, it is possible to get the key content with
   // PrivateKey.getEncoded() on these platforms.  Note that this method may
-  // return NULL on 4.0.4 and later.
-  std::vector<uint8> encoded;
-  if (!GetPrivateKeyEncodedBytes(private_key, &encoded)) {
+  // return false on 4.0.4 and later.
+  std::vector<uint8_t> encoded;
+  if (!GetPrivateKeyEncodedBytes(private_key, &encoded) || encoded.empty()) {
     LOG(ERROR) << "Can't get private key data!";
-    return crypto::ScopedEVP_PKEY();
+    return nullptr;
   }
-  const unsigned char* p =
-      reinterpret_cast<const unsigned char*>(&encoded[0]);
-  int len = static_cast<int>(encoded.size());
-  crypto::ScopedEVP_PKEY pkey(d2i_AutoPrivateKey(NULL, &p, len));
-  if (!pkey) {
-    LOG(ERROR) << "Can't convert private key data!";
-    return crypto::ScopedEVP_PKEY();
+  const uint8_t* p = &encoded[0];
+  ScopedPKCS8_PRIV_KEY_INFO pkcs8(
+      d2i_PKCS8_PRIV_KEY_INFO(NULL, &p, encoded.size()));
+  if (!pkcs8.get() || p != &encoded[0] + encoded.size()) {
+    LOG(ERROR) << "Can't decode PrivateKeyInfo";
+    return nullptr;
+  }
+  crypto::ScopedEVP_PKEY pkey(EVP_PKCS82PKEY(pkcs8.get()));
+  if (!pkey || EVP_PKEY_id(pkey.get()) != EVP_PKEY_RSA) {
+    LOG(ERROR) << "Can't decode RSA key";
+    return nullptr;
   }
   return pkey.Pass();
 }
 
 // Custom ECDSA_METHOD that uses the platform APIs.
 // Note that for now, only signing through ECDSA_sign() is really supported.
 // all other method pointers are either stubs returning errors, or no-ops.
 
 jobject EcKeyGetKey(const EC_KEY* ec_key) {
   KeyExData* ex_data = reinterpret_cast<KeyExData*>(EC_KEY_get_ex_data(
@@ skipping 52 matching lines @@
   return 0;
 }
 
 // Setup an EVP_PKEY to wrap an existing platform PrivateKey object.
 // |private_key| is the JNI reference (local or global) to the object.
 // Returns a new EVP_PKEY on success, NULL otherwise.
 // On success, this creates a global JNI reference to the object that
 // is owned by and destroyed with the EVP_PKEY. I.e. the caller shall
 // always free |private_key| after the call.
 crypto::ScopedEVP_PKEY GetEcdsaPkeyWrapper(jobject private_key) {
+  crypto::OpenSSLErrStackTracer tracer(FROM_HERE);
   crypto::ScopedEC_KEY ec_key(
       EC_KEY_new_method(global_boringssl_engine.Get().engine()));
 
   ScopedJavaGlobalRef<jobject> global_key;
   global_key.Reset(NULL, private_key);
   if (global_key.is_null()) {
     LOG(ERROR) << "Can't create global JNI reference";
     return crypto::ScopedEVP_PKEY();
   }
 
@@ skipping 30 matching lines @@
     NULL /* finish */,
     EcdsaMethodGroupOrderSize,
     EcdsaMethodSign,
     EcdsaMethodVerify,
     ECDSA_FLAG_OPAQUE,
 };
 
 }  // namespace
 
 crypto::ScopedEVP_PKEY GetOpenSSLPrivateKeyWrapper(jobject private_key) {
-  const int kAndroid42ApiLevel = 17;
-
   // Create sub key type, depending on private key's algorithm type.
   PrivateKeyType key_type = GetPrivateKeyType(private_key);
   switch (key_type) {
     case PRIVATE_KEY_TYPE_RSA:
-      // Route around platform bug: if Android < 4.2, then
-      // base::android::RawSignDigestWithPrivateKey() cannot work, so
-      // instead, obtain a raw EVP_PKEY* to the system object
-      // backing this PrivateKey object.
-      if (base::android::BuildInfo::GetInstance()->sdk_int() <
-          kAndroid42ApiLevel) {
-        return GetRsaLegacyKey(private_key);
-      } else {
-        // Running on Android 4.2.
-        return GetRsaPkeyWrapper(private_key, NULL);
-      }
+      return GetRsaPkeyWrapper(private_key);
     case PRIVATE_KEY_TYPE_ECDSA:
       return GetEcdsaPkeyWrapper(private_key);
     default:
       LOG(WARNING)
           << "GetOpenSSLPrivateKeyWrapper() called with invalid key type";
-      return crypto::ScopedEVP_PKEY();
+      return nullptr;
   }
 }
 
 }  // namespace android
 }  // namespace net