Changeset 64883 in vbox for trunk/src/VBox/Runtime/common

Timestamp:

Dec 15, 2016 3:26:20 PM (8 years ago)

Author:

vboxsync

Message:

IPRT/ASN.1: Refactored array handling (SET OF, SEQUENCE OF) to use a pointer array instead of an object instance array. The old approach would move objects around in memory after they'd be initialized/decoded, making certain core optimziations involving pointers to object members impossible, as well as causing potentially causing trouble when modifying structures that takes down pointers after decoding. Fixed validation bug in rtCrX509Name_CheckSanityExtra where it didn't check that the RDNs had subitems but instead checked the parent twice (slight risk).

Location:

trunk/src/VBox/Runtime/common

Files:

• asn1/asn1-basics.cpp (modified) (2 diffs)
• asn1/asn1-cursor.cpp (modified) (1 diff)
• asn1/asn1-default-allocator.cpp (modified) (1 diff)
• asn1/asn1-efence-allocator.cpp (modified) (2 diffs)
• crypto/pkcs7-core.cpp (modified) (11 diffs)
• crypto/pkcs7-sanity.cpp (modified) (4 diffs)
• crypto/pkcs7-verify.cpp (modified) (8 diffs)
• crypto/spc-core.cpp (modified) (1 diff)
• crypto/spc-sanity.cpp (modified) (2 diffs)
• crypto/x509-certpaths.cpp (modified) (24 diffs)
• crypto/x509-core.cpp (modified) (24 diffs)
• crypto/x509-init.cpp (modified) (2 diffs)
• crypto/x509-sanity.cpp (modified) (2 diffs)

trunk/src/VBox/Runtime/common/asn1/asn1-basics.cpp

@@ -75 +75 @@
 
 
-
-RTDECL(int) RTAsn1MemGrowArray(PRTASN1ALLOCATION pAllocation, void **ppvArray, size_t cbEntry,
-                               uint32_t cCurrent, uint32_t cNew)
+RTDECL(int) RTAsn1MemResizeArray(PRTASN1ARRAYALLOCATION pAllocation, void ***ppapvArray, uint32_t cCurrent, uint32_t cNew)
 {
     AssertReturn(pAllocation->pAllocator != NULL, VERR_WRONG_ORDER);
-    AssertReturn(cbEntry > 0, VERR_INVALID_PARAMETER);
-    AssertReturn(cNew > cCurrent, VERR_INVALID_PARAMETER);
+    AssertReturn(pAllocation->cbEntry > 0, VERR_WRONG_ORDER);
+    AssertReturn(cCurrent <= pAllocation->cEntriesAllocated, VERR_INVALID_PARAMETER);
+    AssertReturn(cCurrent <= pAllocation->cPointersAllocated, VERR_INVALID_PARAMETER);
     AssertReturn(cNew < _1M, VERR_OUT_OF_RANGE);
-
-    pAllocation->cReallocs++;
-
-    void *pvOld = *ppvArray;
-
-    /* Initial allocation? */
-    if (cCurrent == 0)
-    {
-        AssertReturn(pvOld == NULL, VERR_INVALID_PARAMETER);
-        AssertReturn(cNew != 0, VERR_INVALID_PARAMETER);
-        return pAllocation->pAllocator->pfnAlloc(pAllocation->pAllocator, pAllocation, ppvArray, cNew * cbEntry);
-    }
-
-    /* Do we need to grow the allocation or did we already allocate sufficient memory in a previous call? */
-    size_t cbNew = cNew * cbEntry;
-    if (pAllocation->cbAllocated < cbNew)
-    {
-        /* Need to grow.  Adjust the new size according to how many times we've been called. */
-        if (pAllocation->cReallocs > 2)
-        {
-            if (pAllocation->cReallocs > 8)
-                cNew += 8;
-            else if (pAllocation->cReallocs < 4)
-                cNew += 2;
-            else
-                cNew += 4;
-            cbNew += cNew * cbEntry;
-        }
-
-        int rc = pAllocation->pAllocator->pfnRealloc(pAllocation->pAllocator, pAllocation, pvOld, ppvArray, cbNew);
-        if (RT_FAILURE(rc))
-            return rc;
-        Assert(pAllocation->cbAllocated >= cbNew);
-
-        /* Clear the memory. */
-        size_t cbOld = cCurrent * cbEntry;
-        RT_BZERO((uint8_t *)*ppvArray + cbOld, pAllocation->cbAllocated - cbOld);
-    }
-
-    return VINF_SUCCESS;
+    Assert(pAllocation->cEntriesAllocated <= pAllocation->cPointersAllocated);
+
+    /*
+     * Is there sufficent space allocated already?
+     *
+     * We keep unused entires ZEROed, therefore we must always call the allocator
+     * when shrinking (this also helps with the electric fence allocator).
+     */
+    if (cNew <= pAllocation->cEntriesAllocated)
+    {
+        if (cCurrent <= cNew)
+            return VINF_SUCCESS;
+        pAllocation->pAllocator->pfnShrinkArray(pAllocation->pAllocator, pAllocation, ppapvArray, cCurrent, cNew);
+        return VINF_SUCCESS;
+    }
+
+    /*
+     * Must grow (or do initial alloc).
+     */
+    pAllocation->cResizeCalls++;
+    return pAllocation->pAllocator->pfnGrowArray(pAllocation->pAllocator, pAllocation, ppapvArray, cNew);
+}
+
+
+RTDECL(void) RTAsn1MemFreeArray(PRTASN1ARRAYALLOCATION pAllocation, void **papvArray)
+{
+    Assert(pAllocation->pAllocator != NULL);
+    if (papvArray)
+    {
+        pAllocation->pAllocator->pfnFreeArray(pAllocation->pAllocator, pAllocation, papvArray);
+        Assert(pAllocation->cPointersAllocated == 0);
+        Assert(pAllocation->cEntriesAllocated == 0);
+    }
 }
 
@@ -171 +163 @@
     pAllocation->uReserved0  = 0;
     pAllocation->pAllocator  = pAllocator;
+    return pAllocation;
+}
+
+
+RTDECL(PRTASN1ARRAYALLOCATION) RTAsn1MemInitArrayAllocation(PRTASN1ARRAYALLOCATION pAllocation,
+                                                            PCRTASN1ALLOCATORVTABLE pAllocator, size_t cbEntry)
+{
+    Assert(cbEntry >= sizeof(RTASN1CORE));
+    Assert(cbEntry < _1M);
+    Assert(RT_ALIGN_Z(cbEntry, sizeof(void *)) == cbEntry);
+    pAllocation->cbEntry            = (uint32_t)cbEntry;
+    pAllocation->cPointersAllocated = 0;
+    pAllocation->cEntriesAllocated  = 0;
+    pAllocation->cResizeCalls       = 0;
+    pAllocation->uReserved0         = 0;
+    pAllocation->pAllocator         = pAllocator;
     return pAllocation;
 }

trunk/src/VBox/Runtime/common/asn1/asn1-cursor.cpp

@@ -202 +202 @@
     pAllocation->uReserved0  = 0;
     pAllocation->pAllocator  = pCursor->pPrimary->pAllocator;
+    return pAllocation;
+}
+
+
+RTDECL(PRTASN1ARRAYALLOCATION) RTAsn1CursorInitArrayAllocation(PRTASN1CURSOR pCursor, PRTASN1ARRAYALLOCATION pAllocation,
+                                                               size_t cbEntry)
+{
+    Assert(cbEntry >= sizeof(RTASN1CORE));
+    Assert(cbEntry < _1M);
+    Assert(RT_ALIGN_Z(cbEntry, sizeof(void *)) == cbEntry);
+    pAllocation->cbEntry            = (uint32_t)cbEntry;
+    pAllocation->cPointersAllocated = 0;
+    pAllocation->cEntriesAllocated  = 0;
+    pAllocation->cResizeCalls       = 0;
+    pAllocation->uReserved0         = 0;
+    pAllocation->pAllocator         = pCursor->pPrimary->pAllocator;
     return pAllocation;
 }

trunk/src/VBox/Runtime/common/asn1/asn1-default-allocator.cpp

@@ -100 +100 @@
 
 
+/** @interface_method_impl{RTASN1ALLOCATORVTABLE, pfnFreeArray} */
+static DECLCALLBACK(void) rtAsn1DefaultAllocator_FreeArray(PCRTASN1ALLOCATORVTABLE pThis, PRTASN1ARRAYALLOCATION pAllocation,
+                                                           void **papvArray)
+{
+    RT_NOREF_PV(pThis);
+    Assert(papvArray);
+    Assert(pAllocation->cbEntry);
+
+    uint32_t i = pAllocation->cEntriesAllocated;
+    while (i-- > 0)
+        RTMemFree(papvArray[i]);
+    RTMemFree(papvArray);
+
+    pAllocation->cEntriesAllocated  = 0;
+    pAllocation->cPointersAllocated = 0;
+}
+
+
+/** @interface_method_impl{RTASN1ALLOCATORVTABLE, pfnGrowArray} */
+static DECLCALLBACK(int) rtAsn1DefaultAllocator_GrowArray(PCRTASN1ALLOCATORVTABLE pThis, PRTASN1ARRAYALLOCATION pAllocation,
+                                                          void ***ppapvArray, uint32_t cMinEntries)
+{
+    RT_NOREF_PV(pThis);
+
+    /*
+     * Resize the pointer array.  We do chunks of 64 bytes for now.
+     */
+    void **papvArray = *ppapvArray;
+    uint32_t cPointers = RT_ALIGN_32(cMinEntries, 64 / sizeof(void *));
+    if (cPointers > pAllocation->cPointersAllocated)
+    {
+        void *pvPointers = RTMemRealloc(papvArray, cPointers * sizeof(void *));
+        if (pvPointers)
+        { /* likely */ }
+        else if (cMinEntries > pAllocation->cPointersAllocated)
+        {
+            cPointers  = cMinEntries;
+            pvPointers = RTMemRealloc(*ppapvArray, cPointers * sizeof(void *));
+            if (!pvPointers)
+                return VERR_NO_MEMORY;
+        }
+        else
+        {
+            cPointers  = pAllocation->cPointersAllocated;
+            pvPointers = papvArray;
+        }
+
+        *ppapvArray = papvArray = (void **)pvPointers;
+        RT_BZERO(&papvArray[pAllocation->cPointersAllocated], (cPointers - pAllocation->cPointersAllocated) * sizeof(void *));
+        pAllocation->cPointersAllocated = cPointers;
+    }
+
+    /*
+     * Add more entries.  Do multiple as the array grows.
+     *
+     * Note! We could possibly optimize this by allocating slabs of entries and
+     *       slice them up.  However, keep things as simple as possible for now.
+     */
+    uint32_t cEntries = cMinEntries;
+    if (cEntries > 2)
+    {
+        if (cEntries > 8)
+            cEntries = RT_ALIGN_32(cEntries, 4);
+        else
+            cEntries = RT_ALIGN_32(cEntries, 2);
+        cEntries = RT_MIN(cEntries, cPointers);
+        Assert(cEntries >= cMinEntries);
+    }
+    Assert(cEntries <= pAllocation->cPointersAllocated);
+
+    while (pAllocation->cEntriesAllocated < cEntries)
+    {
+        void *pv;
+        papvArray[pAllocation->cEntriesAllocated] = pv = RTMemAllocZ(pAllocation->cbEntry);
+        if (pv)
+            pAllocation->cEntriesAllocated++;
+        else if (pAllocation->cEntriesAllocated >= cMinEntries)
+            break;
+        else
+            return VERR_NO_MEMORY;
+    }
+
+    return VINF_SUCCESS;
+}
+
+
+/** @interface_method_impl{RTASN1ALLOCATORVTABLE, pfnShrinkArray} */
+static DECLCALLBACK(void) rtAsn1DefaultAllocator_ShrinkArray(PCRTASN1ALLOCATORVTABLE pThis, PRTASN1ARRAYALLOCATION pAllocation,
+                                                             void ***ppapvArray, uint32_t cNew, uint32_t cCurrent)
+{
+    RT_NOREF_PV(pThis);
+
+    /*
+     * For now we only zero the entries being removed.
+     */
+    void **papvArray = *ppapvArray;
+    while (cNew < cCurrent)
+    {
+        RT_BZERO(papvArray[cNew], pAllocation->cbEntry);
+        cNew++;
+    }
+}
+
+
+
 /** The default ASN.1 allocator. */
+#if 1 || !defined(IN_RING3) || defined(DOXYGEN_RUNNING)
 RT_DECL_DATA_CONST(RTASN1ALLOCATORVTABLE const) g_RTAsn1DefaultAllocator =
+#else
+RT_DECL_DATA_CONST(RTASN1ALLOCATORVTABLE const) g_RTAsn1DefaultAllocatorDisabled =
+#endif
 {
     rtAsn1DefaultAllocator_Free,
     rtAsn1DefaultAllocator_Alloc,
-    rtAsn1DefaultAllocator_Realloc
+    rtAsn1DefaultAllocator_Realloc,
+    rtAsn1DefaultAllocator_FreeArray,
+    rtAsn1DefaultAllocator_GrowArray,
+    rtAsn1DefaultAllocator_ShrinkArray
 };
 

trunk/src/VBox/Runtime/common/asn1/asn1-efence-allocator.cpp

@@ -80 +80 @@
 
 
+/** @interface_method_impl{RTASN1ALLOCATORVTABLE, pfnFreeArray} */
+static DECLCALLBACK(void) rtAsn1EFenceAllocator_FreeArray(PCRTASN1ALLOCATORVTABLE pThis, PRTASN1ARRAYALLOCATION pAllocation,
+                                                          void **papvArray)
+{
+    RT_NOREF_PV(pThis);
+    Assert(papvArray);
+    Assert(pAllocation->cbEntry);
+    Assert(pAllocation->cEntriesAllocated <= pAllocation->cPointersAllocated);
+
+    uint32_t i = pAllocation->cEntriesAllocated;
+    while (i-- > 0)
+    {
+        RTMemEfFreeNP(papvArray[i]);
+        papvArray[i] = NULL;
+    }
+    RTMemEfFreeNP(papvArray);
+
+    pAllocation->cEntriesAllocated  = 0;
+    pAllocation->cPointersAllocated = 0;
+}
+
+
+/** @interface_method_impl{RTASN1ALLOCATORVTABLE, pfnGrowArray} */
+static DECLCALLBACK(int) rtAsn1EFenceAllocator_GrowArray(PCRTASN1ALLOCATORVTABLE pThis, PRTASN1ARRAYALLOCATION pAllocation,
+                                                         void ***ppapvArray, uint32_t cMinEntries)
+{
+    RT_NOREF_PV(pThis);
+    Assert(pAllocation->cbEntry);
+    Assert(pAllocation->cEntriesAllocated <= pAllocation->cPointersAllocated);
+
+    /*
+     * Resize the pointer array.
+     */
+    void **papvArray = *ppapvArray;
+    void *pvPointers = RTMemEfReallocNP(papvArray, cMinEntries * sizeof(void *), RTMEM_TAG);
+    if (pvPointers)
+    {
+        *ppapvArray = papvArray = (void **)pvPointers;
+        if (cMinEntries > pAllocation->cPointersAllocated) /* possible on multiple shrink failures */
+            RT_BZERO(&papvArray[pAllocation->cPointersAllocated],
+                     (cMinEntries - pAllocation->cPointersAllocated) * sizeof(void *));
+        else
+            AssertFailed();
+        pAllocation->cPointersAllocated = cMinEntries;
+    }
+    else if (cMinEntries > pAllocation->cPointersAllocated)
+        return VERR_NO_MEMORY;
+    /* else: possible but unlikely */
+
+    /*
+     * Add more entries.
+     */
+    while (pAllocation->cEntriesAllocated < cMinEntries)
+    {
+        void *pv;
+        papvArray[pAllocation->cEntriesAllocated] = pv = RTMemEfAllocZNP(pAllocation->cbEntry, RTMEM_TAG);
+        if (pv)
+            pAllocation->cEntriesAllocated++;
+        else
+            return VERR_NO_MEMORY;
+    }
+
+    return VINF_SUCCESS;
+}
+
+
+/** @interface_method_impl{RTASN1ALLOCATORVTABLE, pfnShrinkArray} */
+static DECLCALLBACK(void) rtAsn1EFenceAllocator_ShrinkArray(PCRTASN1ALLOCATORVTABLE pThis, PRTASN1ARRAYALLOCATION pAllocation,
+                                                            void ***ppapvArray, uint32_t cNew, uint32_t cCurrent)
+{
+    RT_NOREF_PV(pThis);
+    Assert(pAllocation->cbEntry);
+    Assert(pAllocation->cEntriesAllocated <= pAllocation->cPointersAllocated);
+
+    /*
+     * We always free and resize.
+     */
+    Assert(pAllocation->cEntriesAllocated == cCurrent);
+    Assert(cNew < cCurrent);
+
+    /* Free entries. */
+    void **papvArray = *ppapvArray;
+    while (cCurrent-- > cNew)
+    {
+        RTMemEfFreeNP(papvArray[cCurrent]);
+        papvArray[cCurrent] = NULL;
+    }
+    pAllocation->cEntriesAllocated = cNew;
+
+    /* Try resize pointer array.  Failure here is a genuine possibility since the
+       efence code will try allocate a new block.  This causes extra fun in the
+       grow method above. */
+    void *pvPointers = RTMemEfReallocNP(papvArray, cNew * sizeof(void *), RTMEM_TAG);
+    if (pvPointers)
+    {
+        *ppapvArray = (void **)pvPointers;
+        pAllocation->cPointersAllocated = cNew;
+    }
+}
+
+
 /** The Electric Fence ASN.1 allocator. */
 RT_DECL_DATA_CONST(RTASN1ALLOCATORVTABLE const) g_RTAsn1EFenceAllocator =
@@ -85 +186 @@
     rtAsn1EFenceAllocator_Free,
     rtAsn1EFenceAllocator_Alloc,
-    rtAsn1EFenceAllocator_Realloc
+    rtAsn1EFenceAllocator_Realloc,
+    rtAsn1EFenceAllocator_FreeArray,
+    rtAsn1EFenceAllocator_GrowArray,
+    rtAsn1EFenceAllocator_ShrinkArray
 };
 
+#if 0 && defined(IN_RING3) /* for efence testing */
+RT_DECL_DATA_CONST(RTASN1ALLOCATORVTABLE const) g_RTAsn1DefaultAllocator =
+{
+    rtAsn1EFenceAllocator_Free,
+    rtAsn1EFenceAllocator_Alloc,
+    rtAsn1EFenceAllocator_Realloc,
+    rtAsn1EFenceAllocator_FreeArray,
+    rtAsn1EFenceAllocator_GrowArray,
+    rtAsn1EFenceAllocator_ShrinkArray
+};
+#endif
+

trunk/src/VBox/Runtime/common/crypto/pkcs7-core.cpp

@@ -49 +49 @@
      * Note! We ASSUME a single signing time attribute, which simplifies the interface.
      */
-    uint32_t                cAttrsLeft;
-    PCRTCRPKCS7ATTRIBUTE    pAttr;
+    uint32_t                    cAttrsLeft;
+    PRTCRPKCS7ATTRIBUTE const  *ppAttr;
     if (!ppSignerInfo || *ppSignerInfo == NULL)
     {
         cAttrsLeft = pThis->AuthenticatedAttributes.cItems;
-        pAttr      = pThis->AuthenticatedAttributes.paItems;
+        ppAttr     = pThis->AuthenticatedAttributes.papItems;
         while (cAttrsLeft-- > 0)
         {
+            PCRTCRPKCS7ATTRIBUTE pAttr = *ppAttr;
             if (   pAttr->enmType == RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME
                 && pAttr->uValues.pSigningTime->cItems > 0)
@@ -62 +63 @@
                 if (ppSignerInfo)
                     *ppSignerInfo = pThis;
-                return &pAttr->uValues.pSigningTime->paItems[0];
+                return pAttr->uValues.pSigningTime->papItems[0];
             }
-            pAttr++;
+            ppAttr++;
         }
     }
@@ -74 +75 @@
      */
     cAttrsLeft = pThis->UnauthenticatedAttributes.cItems;
-    pAttr      = pThis->UnauthenticatedAttributes.paItems;
+    ppAttr     = pThis->UnauthenticatedAttributes.papItems;
     while (cAttrsLeft-- > 0)
     {
+        PCRTCRPKCS7ATTRIBUTE pAttr = *ppAttr;
         if (pAttr->enmType == RTCRPKCS7ATTRIBUTETYPE_COUNTER_SIGNATURES)
         {
-            uint32_t              cSignatures = pAttr->uValues.pCounterSignatures->cItems;
-            PCRTCRPKCS7SIGNERINFO pSignature  = pAttr->uValues.pCounterSignatures->paItems;
+            uint32_t               cSignatures = pAttr->uValues.pCounterSignatures->cItems;
+            PRTCRPKCS7SIGNERINFO  *ppSignature = pAttr->uValues.pCounterSignatures->papItems;
 
             /* Skip past the previous counter signature. */
@@ -87 +89 @@
                 {
                     cSignatures--;
-                    if (pSignature == *ppSignerInfo)
+                    if (*ppSignature == *ppSignerInfo)
                     {
                         *ppSignerInfo = NULL;
-                        pSignature++;
+                        ppSignature++;
                         break;
                     }
-                    pSignature++;
+                    ppSignature++;
                 }
 
@@ -99 +101 @@
             while (cSignatures-- > 0)
             {
-                uint32_t                cCounterAttrsLeft = pSignature->AuthenticatedAttributes.cItems;
-                PCRTCRPKCS7ATTRIBUTE    pCounterAttr      = pSignature->AuthenticatedAttributes.paItems;
+                PCRTCRPKCS7SIGNERINFO       pSignature        = *ppSignature;
+                uint32_t                    cCounterAttrsLeft = pSignature->AuthenticatedAttributes.cItems;
+                PRTCRPKCS7ATTRIBUTE const  *ppCounterAttr     = pSignature->AuthenticatedAttributes.papItems;
                 while (cCounterAttrsLeft-- > 0)
                 {
+                    PCRTCRPKCS7ATTRIBUTE pCounterAttr = *ppCounterAttr;
                     if (   pCounterAttr->enmType == RTCRPKCS7ATTRIBUTETYPE_SIGNING_TIME
                         && pCounterAttr->uValues.pSigningTime->cItems > 0)
@@ -108 +112 @@
                         if (ppSignerInfo)
                             *ppSignerInfo = pSignature;
-                        return &pCounterAttr->uValues.pSigningTime->paItems[0];
+                        return pCounterAttr->uValues.pSigningTime->papItems[0];
                     }
-                    pCounterAttr++;
+                    ppCounterAttr++;
                 }
-                pSignature++;
+                ppSignature++;
             }
         }
-        pAttr++;
+        ppAttr++;
     }
 
@@ -128 +132 @@
 
 
-RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetMsTimestamp(PCRTCRPKCS7SIGNERINFO pThis, PCRTCRPKCS7CONTENTINFO *ppContentInfo)
+RTDECL(PCRTASN1TIME) RTCrPkcs7SignerInfo_GetMsTimestamp(PCRTCRPKCS7SIGNERINFO pThis, PCRTCRPKCS7CONTENTINFO *ppContentInfoRet)
 {
     /*
      * Assume there is only one, so no need to enumerate anything here.
      */
-    uint32_t             cAttrsLeft = pThis->UnauthenticatedAttributes.cItems;
-    PCRTCRPKCS7ATTRIBUTE pAttr      = pThis->UnauthenticatedAttributes.paItems;
+    uint32_t                    cAttrsLeft  = pThis->UnauthenticatedAttributes.cItems;
+    PRTCRPKCS7ATTRIBUTE const  *ppAttr      = pThis->UnauthenticatedAttributes.papItems;
     while (cAttrsLeft-- > 0)
     {
+        PCRTCRPKCS7ATTRIBUTE pAttr = *ppAttr;
         if (pAttr->enmType == RTCRPKCS7ATTRIBUTETYPE_MS_TIMESTAMP)
         {
-            uint32_t                cLeft        = pAttr->uValues.pContentInfos->cItems;
-            PCRTCRPKCS7CONTENTINFO  pContentInfo = &pAttr->uValues.pContentInfos->paItems[0];
+            uint32_t                     cLeft         = pAttr->uValues.pContentInfos->cItems;
+            PRTCRPKCS7CONTENTINFO const *ppContentInfo = pAttr->uValues.pContentInfos->papItems;
             while (cLeft-- > 0)
             {
+                PCRTCRPKCS7CONTENTINFO pContentInfo = *ppContentInfo;
                 if (RTAsn1ObjId_CompareWithString(&pContentInfo->ContentType, RTCRPKCS7SIGNEDDATA_OID) == 0)
                 {
@@ -148 +154 @@
                                                       RTCRTSPTSTINFO_OID) == 0)
                     {
-                        if (ppContentInfo)
-                            *ppContentInfo = pContentInfo;
+                        if (ppContentInfoRet)
+                            *ppContentInfoRet = pContentInfo;
                         return &pContentInfo->u.pSignedData->ContentInfo.u.pTstInfo->GenTime;
                     }
@@ -157 +163 @@
             }
         }
-        pAttr++;
+        ppAttr++;
     }
 
@@ -163 +169 @@
      * No signature was found.
      */
-    if (ppContentInfo)
-        *ppContentInfo = NULL;
+    if (ppContentInfoRet)
+        *ppContentInfoRet = NULL;
 
     return NULL;
@@ -189 +195 @@
 {
     for (uint32_t i = 0; i < pCertificates->cItems; i++)
-        if (   pCertificates->paItems[i].enmChoice == RTCRPKCS7CERTCHOICE_X509
-            && RTCrX509Certificate_MatchIssuerAndSerialNumber(pCertificates->paItems[i].u.pX509Cert, pIssuer, pSerialNumber))
-            return pCertificates->paItems[i].u.pX509Cert;
+    {
+        PCRTCRPKCS7CERT pCert = pCertificates->papItems[i];
+        if (   pCert->enmChoice == RTCRPKCS7CERTCHOICE_X509
+            && RTCrX509Certificate_MatchIssuerAndSerialNumber(pCert->u.pX509Cert, pIssuer, pSerialNumber))
+            return pCert->u.pX509Cert;
+    }
     return NULL;
 }

trunk/src/VBox/Runtime/common/crypto/pkcs7-sanity.cpp

@@ -68 +68 @@
         for (uint32_t i = 0; i < pSignedData->DigestAlgorithms.cItems; i++)
         {
-            if (RTCrX509AlgorithmIdentifier_QueryDigestType(&pSignedData->DigestAlgorithms.paItems[i]) == RTDIGESTTYPE_INVALID)
+            if (RTCrX509AlgorithmIdentifier_QueryDigestType(pSignedData->DigestAlgorithms.papItems[i]) == RTDIGESTTYPE_INVALID)
                 return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_UNKNOWN_DIGEST_ALGORITHM,
                                      "%s: SignedData.DigestAlgorithms[%i] is not known: %s",
-                                     pszErrorTag, i, pSignedData->DigestAlgorithms.paItems[i].Algorithm.szObjId);
-            if (pSignedData->DigestAlgorithms.paItems[i].Parameters.enmType != RTASN1TYPE_NULL)
+                                     pszErrorTag, i, pSignedData->DigestAlgorithms.papItems[i]->Algorithm.szObjId);
+            if (pSignedData->DigestAlgorithms.papItems[i]->Parameters.enmType != RTASN1TYPE_NULL)
                 return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_DIGEST_PARAMS_NOT_IMPL,
                                      "%s: SignedData.DigestAlgorithms[%i] has parameters: tag=%u",
-                                     pszErrorTag, i, pSignedData->DigestAlgorithms.paItems[i].Parameters.u.Core.uTag);
+                                     pszErrorTag, i, pSignedData->DigestAlgorithms.papItems[i]->Parameters.u.Core.uTag);
         }
 
@@ -106 +106 @@
     for (uint32_t i = 0; i < pSignedData->SignerInfos.cItems; i++)
     {
-        PCRTCRPKCS7SIGNERINFO pSignerInfo = &pSignedData->SignerInfos.paItems[i];
+        PCRTCRPKCS7SIGNERINFO pSignerInfo = pSignedData->SignerInfos.papItems[i];
 
         if (RTAsn1Integer_UnsignedCompareWithU32(&pSignerInfo->Version, RTCRPKCS7SIGNERINFO_V1) != 0)
@@ -136 +136 @@
         uint32_t j = 0;
         while (   j < pSignedData->DigestAlgorithms.cItems
-               && RTCrX509AlgorithmIdentifier_Compare(&pSignedData->DigestAlgorithms.paItems[j],
+               && RTCrX509AlgorithmIdentifier_Compare(pSignedData->DigestAlgorithms.papItems[j],
                                                       &pSignerInfo->DigestAlgorithm) != 0)
             j++;
@@ -162 +162 @@
             for (j = 0; j < pSignerInfo->AuthenticatedAttributes.cItems; j++)
             {
-                PCRTCRPKCS7ATTRIBUTE pAttrib = &pSignerInfo->AuthenticatedAttributes.paItems[j];
+                PCRTCRPKCS7ATTRIBUTE pAttrib = pSignerInfo->AuthenticatedAttributes.papItems[j];
                 if (RTAsn1ObjId_CompareWithString(&pAttrib->Type, RTCR_PKCS9_ID_CONTENT_TYPE_OID) == 0)
                 {

trunk/src/VBox/Runtime/common/crypto/pkcs7-verify.cpp

@@ -75 +75 @@
             PCRTCRPKCS7SETOFCERTS pCerts = &pContentInfo->u.pSignedData->Certificates;
             for (uint32_t i = 0; i < pCerts->cItems; i++)
-                if (pCerts->paItems[i].enmChoice == RTCRPKCS7CERTCHOICE_X509)
-                    rtCrOpenSslAddX509CertToStack(pAddCerts, pCerts->paItems[i].u.pX509Cert);
+                if (pCerts->papItems[i]->enmChoice == RTCRPKCS7CERTCHOICE_X509)
+                    rtCrOpenSslAddX509CertToStack(pAddCerts, pCerts->papItems[i]->u.pX509Cert);
 
 
@@ -238 +238 @@
     while (i-- > 0)
     {
-        PCRTCRPKCS7ATTRIBUTE pAttrib = &pSignerInfo->AuthenticatedAttributes.paItems[i];
+        PCRTCRPKCS7ATTRIBUTE pAttrib = pSignerInfo->AuthenticatedAttributes.papItems[i];
 
         if (RTAsn1ObjId_CompareWithString(&pAttrib->Type, RTCR_PKCS9_ID_CONTENT_TYPE_OID) == 0)
@@ -247 +247 @@
 
             if (   !(fFlags & RTCRPKCS7VERIFY_SD_F_COUNTER_SIGNATURE) /* See note about microsoft below. */
-                && RTAsn1ObjId_Compare(&pAttrib->uValues.pObjIds->paItems[0], &pSignedData->ContentInfo.ContentType) != 0)
+                && RTAsn1ObjId_Compare(pAttrib->uValues.pObjIds->papItems[0], &pSignedData->ContentInfo.ContentType) != 0)
                    return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_CONTENT_TYPE_ATTRIB_MISMATCH,
-                                        "Expected content-type %s, found %s",
-                                        &pAttrib->uValues.pObjIds->paItems[0], pSignedData->ContentInfo.ContentType.szObjId);
+                                        "Expected content-type %s, found %s", pAttrib->uValues.pObjIds->papItems[0]->szObjId,
+                                        pSignedData->ContentInfo.ContentType.szObjId);
             cContentTypes++;
         }
@@ -260 +260 @@
 
             if (!RTCrDigestMatch(*phDigest,
-                                 pAttrib->uValues.pOctetStrings->paItems[0].Asn1Core.uData.pv,
-                                 pAttrib->uValues.pOctetStrings->paItems[0].Asn1Core.cb))
+                                 pAttrib->uValues.pOctetStrings->papItems[0]->Asn1Core.uData.pv,
+                                 pAttrib->uValues.pOctetStrings->papItems[0]->Asn1Core.cb))
             {
                 size_t cbHash = RTCrDigestGetHashSize(*phDigest);
-                if (cbHash != pAttrib->uValues.pOctetStrings->paItems[0].Asn1Core.cb)
+                if (cbHash != pAttrib->uValues.pOctetStrings->papItems[0]->Asn1Core.cb)
                     return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_MESSAGE_DIGEST_ATTRIB_MISMATCH,
                                          "Authenticated message-digest attribute mismatch: cbHash=%#zx cbValue=%#x",
-                                         cbHash, pAttrib->uValues.pOctetStrings->paItems[0].Asn1Core.cb);
+                                         cbHash, pAttrib->uValues.pOctetStrings->papItems[0]->Asn1Core.cb);
                 return RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_MESSAGE_DIGEST_ATTRIB_MISMATCH,
                                      "Authenticated message-digest attribute mismatch (cbHash=%#zx):\n"
@@ -273 +273 @@
                                      "our:    %.*Rhxs\n",
                                      cbHash,
-                                     cbHash, pAttrib->uValues.pOctetStrings->paItems[0].Asn1Core.uData.pv,
+                                     cbHash, pAttrib->uValues.pOctetStrings->papItems[0]->Asn1Core.uData.pv,
                                      cbHash, RTCrDigestGetHash(*phDigest));
             }
@@ -342 +342 @@
     uint32_t iDigest = pSignedData->DigestAlgorithms.cItems;
     while (iDigest-- > 0)
-        if (RTCrX509AlgorithmIdentifier_Compare(&pSignedData->DigestAlgorithms.paItems[iDigest],
+        if (RTCrX509AlgorithmIdentifier_Compare(pSignedData->DigestAlgorithms.papItems[iDigest],
                                                 &pSignerInfo->DigestAlgorithm) == 0)
         {
@@ -620 +620 @@
     for (i = 0; i < cDigests; i++)
     {
-        rc = RTCrDigestCreateByObjId(&ahDigests[i], &pSignedData->DigestAlgorithms.paItems[i].Algorithm);
+        rc = RTCrDigestCreateByObjId(&ahDigests[i], &pSignedData->DigestAlgorithms.papItems[i]->Algorithm);
         if (RT_FAILURE(rc))
         {
             rc = RTErrInfoSetF(pErrInfo, VERR_CR_PKCS7_DIGEST_CREATE_ERROR, "Error creating digest for '%s': %Rrc",
-                               pSignedData->DigestAlgorithms.paItems[i].Algorithm.szObjId, rc);
+                               pSignedData->DigestAlgorithms.papItems[i]->Algorithm.szObjId, rc);
             break;
         }
@@ -647 +647 @@
             for (i = 0; i < pSignedData->SignerInfos.cItems; i++)
             {
-                PCRTCRPKCS7SIGNERINFO   pSignerInfo = &pSignedData->SignerInfos.paItems[i];
+                PCRTCRPKCS7SIGNERINFO   pSignerInfo = pSignedData->SignerInfos.papItems[i];
                 RTCRDIGEST              hThisDigest = NIL_RTCRDIGEST; /* (gcc maybe incredible stupid.) */
                 rc = rtCrPkcs7VerifyFindDigest(&hThisDigest, pSignedData, pSignerInfo, ahDigests, pErrInfo);

trunk/src/VBox/Runtime/common/crypto/spc-core.cpp

@@ -69 +69 @@
                 if (pData)
                     for (uint32_t i = 0; i < pData->cItems; i++)
-                        if (pData->paItems[i].enmType == enmType)
-                            return &pData->paItems[i];
+                        if (pData->papItems[i]->enmType == enmType)
+                            return pData->papItems[i];
             }
         }

trunk/src/VBox/Runtime/common/crypto/spc-sanity.cpp

@@ -57 +57 @@
 
     if (RTCrX509AlgorithmIdentifier_Compare(&pIndData->DigestInfo.DigestAlgorithm, /** @todo not entirely sure about this check... */
-                                            &pSignedData->SignerInfos.paItems[0].DigestAlgorithm) != 0)
+                                            &pSignedData->SignerInfos.papItems[0]->DigestAlgorithm) != 0)
         return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_SIGNED_IND_DATA_DIGEST_ALGO_MISMATCH,
                              "SpcIndirectDataContent DigestInfo and SignerInfos algorithms mismatch: %s vs %s",
                              pIndData->DigestInfo.DigestAlgorithm.Algorithm.szObjId,
-                             pSignedData->SignerInfos.paItems[0].DigestAlgorithm.Algorithm.szObjId);
+                             pSignedData->SignerInfos.papItems[0]->DigestAlgorithm.Algorithm.szObjId);
 
     if (RTCrX509AlgorithmIdentifier_Compare(&pIndData->DigestInfo.DigestAlgorithm,
-                                            &pSignedData->DigestAlgorithms.paItems[0]) != 0)
+                                            pSignedData->DigestAlgorithms.papItems[0]) != 0)
         return RTErrInfoSetF(pErrInfo, VERR_CR_SPC_IND_DATA_DIGEST_ALGO_NOT_IN_DIGEST_ALGOS,
                              "SpcIndirectDataContent DigestInfo and SignedData.DigestAlgorithms[0] mismatch: %s vs %s",
                              pIndData->DigestInfo.DigestAlgorithm.Algorithm.szObjId,
-                             pSignedData->DigestAlgorithms.paItems[0].Algorithm.szObjId);
+                             pSignedData->DigestAlgorithms.papItems[0]->Algorithm.szObjId);
 
     if (fFlags & RTCRSPCINDIRECTDATACONTENT_SANITY_F_ONLY_KNOWN_HASH)
@@ -126 +126 @@
             for (uint32_t i = 0; i < pObj->u.pData->cItems; i++)
             {
-                PCRTCRSPCSERIALIZEDOBJECTATTRIBUTE pAttr = &pObj->u.pData->paItems[i];
+                PCRTCRSPCSERIALIZEDOBJECTATTRIBUTE pAttr = pObj->u.pData->papItems[i];
                 if (   RTAsn1ObjId_CompareWithString(&pAttr->Type, RTCRSPC_PE_IMAGE_HASHES_V1_OID) == 0
                     || RTAsn1ObjId_CompareWithString(&pAttr->Type, RTCRSPC_PE_IMAGE_HASHES_V2_OID) == 0 )

trunk/src/VBox/Runtime/common/crypto/x509-certpaths.cpp

@@ -723 +723 @@
     if (pThis->pUntrustedCertsSet)
     {
-        uint32_t const  cCerts  = pThis->pUntrustedCertsSet->cItems;
-        PCRTCRPKCS7CERT paCerts = pThis->pUntrustedCertsSet->paItems;
+        uint32_t const        cCerts   = pThis->pUntrustedCertsSet->cItems;
+        PRTCRPKCS7CERT const *papCerts = pThis->pUntrustedCertsSet->papItems;
         for (uint32_t i = 0; i < cCerts; i++)
-            if (   paCerts[i].enmChoice == RTCRPKCS7CERTCHOICE_X509
-                && RTCrX509Certificate_MatchSubjectOrAltSubjectByRfc5280(paCerts[i].u.pX509Cert, pIssuer))
-                rtCrX509CertPathsAddIssuer(pThis, pNode, paCerts[i].u.pX509Cert, NULL, RTCRX509CERTPATHNODE_SRC_UNTRUSTED_SET);
+        {
+            PCRTCRPKCS7CERT pCert = papCerts[i];
+            if (   pCert->enmChoice == RTCRPKCS7CERTCHOICE_X509
+                && RTCrX509Certificate_MatchSubjectOrAltSubjectByRfc5280(pCert->u.pX509Cert, pIssuer))
+                rtCrX509CertPathsAddIssuer(pThis, pNode, pCert->u.pX509Cert, NULL, RTCRX509CERTPATHNODE_SRC_UNTRUSTED_SET);
+        }
     }
 }
@@ -1057 +1060 @@
 {
     for (uint32_t i = 0; i < pName->cItems; i++)
-        for (uint32_t j = 0; j < pName->paItems[i].cItems; j++)
-        {
-            PRTCRX509ATTRIBUTETYPEANDVALUE pAttrib = &pName->paItems[i].paItems[j];
+    {
+        PCRTCRX509RELATIVEDISTINGUISHEDNAME const pRdn = pName->papItems[i];
+        for (uint32_t j = 0; j < pRdn->cItems; j++)
+        {
+            PRTCRX509ATTRIBUTETYPEANDVALUE pAttrib = pRdn->papItems[j];
 
             const char *pszType = pAttrib->Type.szObjId;
@@ -1118 +1123 @@
                 rtDumpPrintf(pfnPrintfV, pvUser, "<not-string: uTag=%#x>", pAttrib->Value.u.Core.uTag);
         }
+    }
 }
 
@@ -1350 +1356 @@
  * @param   pThis               The validator instance.
  * @param   cSubtrees           The number of sub-trees to add.
- * @param   paSubtrees          Array of sub-trees to add.
- */
-static bool rtCrX509CpvAddPermittedSubtrees(PRTCRX509CERTPATHSINT pThis, uint32_t cSubtrees, PCRTCRX509GENERALSUBTREE paSubtrees)
+ * @param   papSubtrees         Array of sub-trees to add.
+ */
+static bool rtCrX509CpvAddPermittedSubtrees(PRTCRX509CERTPATHSINT pThis, uint32_t cSubtrees,
+                                            PRTCRX509GENERALSUBTREE const *papSubtrees)
 {
     /*
@@ -1375 +1382 @@
     for (uint32_t iSrc = 0; iSrc < cSubtrees; iSrc++)
     {
-        if (!rtCrX509CpvCheckSubtreeValidity(pThis, &paSubtrees[iSrc]))
+        if (!rtCrX509CpvCheckSubtreeValidity(pThis, papSubtrees[iSrc]))
             return false;
-        pThis->v.papPermittedSubtrees[iDst] = &paSubtrees[iSrc];
+        pThis->v.papPermittedSubtrees[iDst] = papSubtrees[iSrc];
         iDst++;
     }
@@ -1383 +1390 @@
 
     return true;
+}
+
+
+/**
+ * Adds a one permitted sub-tree.
+ *
+ * We store reference to each individual sub-tree because we must support
+ * intersection calculation.
+ *
+ * @returns success indiciator.
+ * @param   pThis               The validator instance.
+ * @param   pSubtree            Array of sub-trees to add.
+ */
+static bool rtCrX509CpvAddPermittedSubtree(PRTCRX509CERTPATHSINT pThis, PCRTCRX509GENERALSUBTREE pSubtree)
+{
+    return rtCrX509CpvAddPermittedSubtrees(pThis, 1, (PRTCRX509GENERALSUBTREE const *)&pSubtree);
 }
 
@@ -1405 +1428 @@
     }
 
-    uint32_t                    cRight  = pSubtrees->cItems;
-    PCRTCRX509GENERALSUBTREE    paRight = pSubtrees->paItems;
+    uint32_t                       cRight   = pSubtrees->cItems;
+    PRTCRX509GENERALSUBTREE const *papRight = pSubtrees->papItems;
     if (cRight == 0)
     {
@@ -1417 +1440 @@
     PCRTCRX509GENERALSUBTREE   *papLeft = pThis->v.papPermittedSubtrees;
     if (!cLeft) /* first name constraint, no initial constraint */
-        return rtCrX509CpvAddPermittedSubtrees(pThis, cRight, paRight);
+        return rtCrX509CpvAddPermittedSubtrees(pThis, cRight, papRight);
 
     /*
@@ -1431 +1454 @@
     for (uint32_t iRight = 0; iRight < cRight; iRight++)
     {
-        if (!rtCrX509CpvCheckSubtreeValidity(pThis, &paRight[iRight]))
+        if (!rtCrX509CpvCheckSubtreeValidity(pThis, papRight[iRight]))
             return false;
 
-        RTCRX509GENERALNAMECHOICE const enmRightChoice = paRight[iRight].Base.enmChoice;
+        RTCRX509GENERALNAMECHOICE const enmRightChoice = papRight[iRight]->Base.enmChoice;
         afRightTags[enmRightChoice] = true;
 
@@ -1441 +1464 @@
             if (papLeft[iLeft]->Base.enmChoice == enmRightChoice)
             {
-                if (RTCrX509GeneralSubtree_Compare(papLeft[iLeft], &paRight[iRight]) == 0)
+                if (RTCrX509GeneralSubtree_Compare(papLeft[iLeft], papRight[iRight]) == 0)
                 {
                     if (!fHaveRight)
                     {
                         fHaveRight = true;
-                        rtCrX509CpvAddPermittedSubtrees(pThis, 1, papLeft[iLeft]);
+                        rtCrX509CpvAddPermittedSubtree(pThis, papLeft[iLeft]);
                     }
                 }
-                else if (RTCrX509GeneralSubtree_ConstraintMatch(papLeft[iLeft], &paRight[iRight]))
+                else if (RTCrX509GeneralSubtree_ConstraintMatch(papLeft[iLeft], papRight[iRight]))
                 {
                     if (!fHaveRight)
                     {
                         fHaveRight = true;
-                        rtCrX509CpvAddPermittedSubtrees(pThis, 1, &paRight[iRight]);
+                        rtCrX509CpvAddPermittedSubtree(pThis, papRight[iRight]);
                     }
                 }
-                else if (RTCrX509GeneralSubtree_ConstraintMatch(&paRight[iRight], papLeft[iLeft]))
-                    rtCrX509CpvAddPermittedSubtrees(pThis, 1, papLeft[iLeft]);
+                else if (RTCrX509GeneralSubtree_ConstraintMatch(papRight[iRight], papLeft[iLeft]))
+                    rtCrX509CpvAddPermittedSubtree(pThis, papLeft[iLeft]);
             }
     }
@@ -1467 +1490 @@
     for (uint32_t iLeft = 0; iLeft < cLeft; iLeft++)
         if (!afRightTags[papLeft[iLeft]->Base.enmChoice])
-            rtCrX509CpvAddPermittedSubtrees(pThis, 1, papLeft[iLeft]);
+            rtCrX509CpvAddPermittedSubtree(pThis, papLeft[iLeft]);
 
     /*
@@ -1541 +1564 @@
         uint32_t j = pSubTrees->cItems;
         while (j-- > 0)
-            if (   RTCRX509GENERALNAME_IS_DIRECTORY_NAME(&pSubTrees->paItems[j].Base)
-                && RTCrX509Name_ConstraintMatch(&pSubTrees->paItems[j].Base.u.pT4->DirectoryName, pName))
+        {
+            PCRTCRX509GENERALSUBTREE const pSubTree = pSubTrees->papItems[j];
+            if (   RTCRX509GENERALNAME_IS_DIRECTORY_NAME(&pSubTree->Base)
+                && RTCrX509Name_ConstraintMatch(&pSubTree->Base.u.pT4->DirectoryName, pName))
                 return true;
+        }
     }
     return false;
@@ -1566 +1592 @@
         uint32_t j = pSubTrees->cItems;
         while (j-- > 0)
-            if (RTCrX509GeneralName_ConstraintMatch(&pSubTrees->paItems[j].Base, pGeneralName))
+            if (RTCrX509GeneralName_ConstraintMatch(&pSubTrees->papItems[j]->Base, pGeneralName))
                 return true;
     }
@@ -1951 +1977 @@
     if (pThis->pInitialPermittedSubtrees)
         rtCrX509CpvAddPermittedSubtrees(pThis, pThis->pInitialPermittedSubtrees->cItems,
-                                        pThis->pInitialPermittedSubtrees->paItems);
+                                        pThis->pInitialPermittedSubtrees->papItems);
     if (pThis->pInitialExcludedSubtrees)
         rtCrX509CpvAddExcludedSubtrees(pThis, pThis->pInitialExcludedSubtrees);
@@ -2053 +2079 @@
         uint32_t i = pAltSubjectName->cItems;
         while (i-- > 0)
-            if (   !rtCrX509CpvIsGeneralNamePermitted(pThis, &pAltSubjectName->paItems[i])
-                || rtCrX509CpvIsGeneralNameExcluded(pThis, &pAltSubjectName->paItems[i]))
+            if (   !rtCrX509CpvIsGeneralNamePermitted(pThis, pAltSubjectName->papItems[i])
+                || rtCrX509CpvIsGeneralNameExcluded(pThis, pAltSubjectName->papItems[i]))
                 return rtCrX509CpvFailed(pThis, VERR_CR_X509_CPV_ALT_NAME_NOT_PERMITTED,
                                          "Alternative name #%u is is not permitted by current name constraints", i);
@@ -2081 +2107 @@
         while (i-- > 0)
         {
-            PCRTCRX509POLICYQUALIFIERINFOS const    pQualifiers = &pPolicies->paItems[i].PolicyQualifiers;
-            PCRTASN1OBJID const                     pIdP        = &pPolicies->paItems[i].PolicyIdentifier;
+            PCRTCRX509POLICYQUALIFIERINFOS const    pQualifiers = &pPolicies->papItems[i]->PolicyQualifiers;
+            PCRTASN1OBJID const                     pIdP        = &pPolicies->papItems[i]->PolicyIdentifier;
             if (RTAsn1ObjId_CompareWithString(pIdP, RTCRX509_ID_CE_CP_ANY_POLICY_OID) == 0)
             {
@@ -2132 +2158 @@
                 || (pNode->pParent && fSelfIssued) ) )
         {
-            PCRTCRX509POLICYQUALIFIERINFOS pApQ = &pPolicies->paItems[iAnyPolicy].PolicyQualifiers;
+            PCRTCRX509POLICYQUALIFIERINFOS pApQ = &pPolicies->papItems[iAnyPolicy]->PolicyQualifiers;
             RTListForEach(pListAbove, pCur, RTCRX509CERTPATHSPOLICYNODE, DepthEntry)
             {
@@ -2183 +2209 @@
     while (i-- > 0)
     {
-        if (RTAsn1ObjId_CompareWithString(&pPolicyMappings->paItems[i].IssuerDomainPolicy, RTCRX509_ID_CE_CP_ANY_POLICY_OID) == 0)
+        PCRTCRX509POLICYMAPPING const pOne = pPolicyMappings->papItems[i];
+        if (RTAsn1ObjId_CompareWithString(&pOne->IssuerDomainPolicy, RTCRX509_ID_CE_CP_ANY_POLICY_OID) == 0)
             return rtCrX509CpvFailed(pThis, VERR_CR_X509_CPV_INVALID_POLICY_MAPPING,
                                      "Invalid policy mapping %#u: IssuerDomainPolicy is anyPolicy.", i);
 
-        if (RTAsn1ObjId_CompareWithString(&pPolicyMappings->paItems[i].SubjectDomainPolicy, RTCRX509_ID_CE_CP_ANY_POLICY_OID) == 0)
+        if (RTAsn1ObjId_CompareWithString(&pOne->SubjectDomainPolicy, RTCRX509_ID_CE_CP_ANY_POLICY_OID) == 0)
             return rtCrX509CpvFailed(pThis, VERR_CR_X509_CPV_INVALID_POLICY_MAPPING,
                                      "Invalid policy mapping %#u: SubjectDomainPolicy is anyPolicy.", i);
@@ -2201 +2228 @@
         while (i-- > 0)
         {
+            PCRTCRX509POLICYMAPPING const pOne = pPolicyMappings->papItems[i];
+
             uint32_t cFound = 0;
             RTListForEach(&pThis->v.paValidPolicyDepthLists[iDepth], pCur, RTCRX509CERTPATHSPOLICYNODE, DepthEntry)
             {
-                if (RTAsn1ObjId_Compare(pCur->pValidPolicy, &pPolicyMappings->paItems[i].IssuerDomainPolicy))
+                if (RTAsn1ObjId_Compare(pCur->pValidPolicy, &pOne->IssuerDomainPolicy))
                 {
                     if (!pCur->fAlreadyMapped)
                     {
                         pCur->fAlreadyMapped = true;
-                        pCur->pExpectedPolicyFirst = &pPolicyMappings->paItems[i].SubjectDomainPolicy;
+                        pCur->pExpectedPolicyFirst = &pOne->SubjectDomainPolicy;
                     }
                     else
@@ -2221 +2250 @@
                                                      pCur->cMoreExpectedPolicySet, iDepth);
                         pCur->papMoreExpectedPolicySet = (PCRTASN1OBJID *)pvNew;
-                        pCur->papMoreExpectedPolicySet[iExpected] = &pPolicyMappings->paItems[i].SubjectDomainPolicy;
+                        pCur->papMoreExpectedPolicySet[iExpected] = &pOne->SubjectDomainPolicy;
                         pCur->cMoreExpectedPolicySet = iExpected  + 1;
                     }
@@ -2238 +2267 @@
                     {
                         if (!rtCrX509CpvPolicyTreeInsertNew(pThis, pCur->pParent, iDepth,
-                                                            &pPolicyMappings->paItems[i].IssuerDomainPolicy,
+                                                            &pOne->IssuerDomainPolicy,
                                                             pCur->pPolicyQualifiers,
-                                                            &pPolicyMappings->paItems[i].SubjectDomainPolicy))
+                                                            &pOne->SubjectDomainPolicy))
                             return false;
                         break;
@@ -2258 +2287 @@
         while (i-- > 0)
         {
+            PCRTCRX509POLICYMAPPING const pOne = pPolicyMappings->papItems[i];
             RTListForEachSafe(&pThis->v.paValidPolicyDepthLists[iDepth], pCur, pNext, RTCRX509CERTPATHSPOLICYNODE, DepthEntry)
             {
-                if (RTAsn1ObjId_Compare(pCur->pValidPolicy, &pPolicyMappings->paItems[i].IssuerDomainPolicy))
+                if (RTAsn1ObjId_Compare(pCur->pValidPolicy, &pOne->IssuerDomainPolicy))
                 {
                     rtCrX509CpvPolicyTreeDestroyNode(pThis, pCur);
@@ -2410 +2440 @@
 static bool rtCrX509CpvCheckCriticalExtensions(PRTCRX509CERTPATHSINT pThis, PRTCRX509CERTPATHNODE pNode)
 {
-    uint32_t                cLeft = pNode->pCert->TbsCertificate.T3.Extensions.cItems;
-    PCRTCRX509EXTENSION     pCur  = pNode->pCert->TbsCertificate.T3.Extensions.paItems;
+    uint32_t                  cLeft = pNode->pCert->TbsCertificate.T3.Extensions.cItems;
+    PRTCRX509EXTENSION const *ppCur = pNode->pCert->TbsCertificate.T3.Extensions.papItems;
     while (cLeft-- > 0)
     {
+        PCRTCRX509EXTENSION const pCur = *ppCur;
         if (pCur->Critical.fValue)
         {
@@ -2431 +2462 @@
         }
 
-        pCur++;
+        ppCur++;
     }
 

trunk/src/VBox/Runtime/common/crypto/x509-core.cpp

@@ -608 +608 @@
         for (uint32_t iLeft = 0; iLeft < cItems; iLeft++)
         {
-            PCRTCRX509ATTRIBUTETYPEANDVALUE pLeftAttr = &pLeft->paItems[iLeft];
+            PCRTCRX509ATTRIBUTETYPEANDVALUE pLeftAttr = pLeft->papItems[iLeft];
             bool fFound = false;
             for (uint32_t iRight = 0; iRight < cItems; iRight++)
-                if (RTCrX509AttributeTypeAndValue_MatchAsRdnByRfc5280(pLeftAttr, &pRight->paItems[iRight]))
+                if (RTCrX509AttributeTypeAndValue_MatchAsRdnByRfc5280(pLeftAttr, pRight->papItems[iRight]))
                 {
                     fFound = true;
@@ -637 +637 @@
         /* Require exact order. */
         for (uint32_t iRdn = 0; iRdn < cItems; iRdn++)
-            if (!RTCrX509RelativeDistinguishedName_MatchByRfc5280(&pLeft->paItems[iRdn], &pRight->paItems[iRdn]))
+            if (!RTCrX509RelativeDistinguishedName_MatchByRfc5280(pLeft->papItems[iRdn], pRight->papItems[iRdn]))
                 return false;
         return true;
@@ -658 +658 @@
         for (uint32_t i = 0; pConstraint->cItems; i++)
         {
-            PCRTCRX509RELATIVEDISTINGUISHEDNAME pConstrRdns = &pConstraint->paItems[i];
-            PCRTCRX509RELATIVEDISTINGUISHEDNAME pNameRdns   = &pName->paItems[i];
+            PCRTCRX509RELATIVEDISTINGUISHEDNAME pConstrRdns = pConstraint->papItems[i];
+            PCRTCRX509RELATIVEDISTINGUISHEDNAME pNameRdns   = pName->papItems[i];
 
             /*
@@ -666 +666 @@
             for (uint32_t iConstrAttrib = 0; iConstrAttrib < pConstrRdns->cItems; iConstrAttrib++)
             {
-                PCRTCRX509ATTRIBUTETYPEANDVALUE pConstrAttrib = &pConstrRdns->paItems[iConstrAttrib];
+                PCRTCRX509ATTRIBUTETYPEANDVALUE pConstrAttrib = pConstrRdns->papItems[iConstrAttrib];
 
                 /*
@@ -673 +673 @@
                 bool fFound = false;
                 for (uint32_t iNameAttrib = 0; iNameAttrib < pNameRdns->cItems; iNameAttrib++)
-                    if (RTCrX509AttributeTypeAndValue_MatchAsRdnByRfc5280(pConstrAttrib, &pNameRdns->paItems[iNameAttrib]))
+                    if (RTCrX509AttributeTypeAndValue_MatchAsRdnByRfc5280(pConstrAttrib, pNameRdns->papItems[iNameAttrib]))
                     {
                         fFound = true;
@@ -737 +737 @@
     for (uint32_t i = 0; i < pThis->cItems; i++)
     {
-        PCRTCRX509RELATIVEDISTINGUISHEDNAME pRdn = &pThis->paItems[i];
+        PCRTCRX509RELATIVEDISTINGUISHEDNAME pRdn = pThis->papItems[i];
         for (uint32_t j = 0; j < pRdn->cItems; j++)
         {
-            PCRTCRX509ATTRIBUTETYPEANDVALUE pComponent = &pRdn->paItems[j];
+            PCRTCRX509ATTRIBUTETYPEANDVALUE pComponent = pRdn->papItems[j];
 
             /*
@@ -816 +816 @@
     for (uint32_t i = 0; i < pThis->cItems; i++)
     {
-        PCRTCRX509RELATIVEDISTINGUISHEDNAME pRdn = &pThis->paItems[i];
+        PCRTCRX509RELATIVEDISTINGUISHEDNAME pRdn = pThis->papItems[i];
         for (uint32_t j = 0; j < pRdn->cItems; j++)
         {
-            PCRTCRX509ATTRIBUTETYPEANDVALUE pComponent = &pRdn->paItems[j];
+            PCRTCRX509ATTRIBUTETYPEANDVALUE pComponent = pRdn->papItems[j];
 
             /*
@@ -1332 +1332 @@
     {
 
-        if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_ANY_EXTENDED_KEY_USAGE_OID) == 0)
+        if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_ANY_EXTENDED_KEY_USAGE_OID) == 0)
             pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_ANY;
-        else if (RTAsn1ObjId_StartsWith(&pObjIds->paItems[i], RTCRX509_ID_KP_OID))
-        {
-            if (RTAsn1ObjIdCountComponents(&pObjIds->paItems[i]) == 9)
-                switch (RTAsn1ObjIdGetLastComponentsAsUInt32(&pObjIds->paItems[i]))
+        else if (RTAsn1ObjId_StartsWith(pObjIds->papItems[i], RTCRX509_ID_KP_OID))
+        {
+            if (RTAsn1ObjIdCountComponents(pObjIds->papItems[i]) == 9)
+                switch (RTAsn1ObjIdGetLastComponentsAsUInt32(pObjIds->papItems[i]))
                 {
                     case  1: pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_SERVER_AUTH; break;
@@ -1357 +1357 @@
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_OTHER;
         }
-        else if (RTAsn1ObjId_StartsWith(&pObjIds->paItems[i], RTCRX509_APPLE_EKU_APPLE_EXTENDED_KEY_USAGE_OID))
-        {
-            if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_APPLE_EKU_CODE_SIGNING_OID) == 0)
+        else if (RTAsn1ObjId_StartsWith(pObjIds->papItems[i], RTCRX509_APPLE_EKU_APPLE_EXTENDED_KEY_USAGE_OID))
+        {
+            if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_APPLE_EKU_CODE_SIGNING_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_APPLE_EKU_CODE_SIGNING_DEVELOPMENT_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_APPLE_EKU_CODE_SIGNING_DEVELOPMENT_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING_DEVELOPMENT;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_APPLE_EKU_SOFTWARE_UPDATE_SIGNING_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_APPLE_EKU_SOFTWARE_UPDATE_SIGNING_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_APPLE_SOFTWARE_UPDATE_SIGNING;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_APPLE_EKU_CODE_SIGNING_THRID_PARTY_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_APPLE_EKU_CODE_SIGNING_THRID_PARTY_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_APPLE_CODE_SIGNING_THIRD_PARTY;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_APPLE_EKU_RESOURCE_SIGNING_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_APPLE_EKU_RESOURCE_SIGNING_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_APPLE_RESOURCE_SIGNING;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_APPLE_EKU_SYSTEM_IDENTITY_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_APPLE_EKU_SYSTEM_IDENTITY_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_APPLE_SYSTEM_IDENTITY;
             else
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_OTHER;
         }
-        else if (RTAsn1ObjId_StartsWith(&pObjIds->paItems[i], "1.3.6.1.4.1.311"))
-        {
-            if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_MS_EKU_TIMESTAMP_SIGNING_OID) == 0)
+        else if (RTAsn1ObjId_StartsWith(pObjIds->papItems[i], "1.3.6.1.4.1.311"))
+        {
+            if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_MS_EKU_TIMESTAMP_SIGNING_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_MS_TIMESTAMP_SIGNING;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_MS_EKU_NT5_CRYPTO_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_MS_EKU_NT5_CRYPTO_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_MS_NT5_CRYPTO;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_MS_EKU_OEM_WHQL_CRYPTO_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_MS_EKU_OEM_WHQL_CRYPTO_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_MS_OEM_WHQL_CRYPTO;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_MS_EKU_EMBEDDED_NT_CRYPTO_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_MS_EKU_EMBEDDED_NT_CRYPTO_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_MS_EMBEDDED_NT_CRYPTO;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_MS_EKU_KERNEL_MODE_CODE_SIGNING_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_MS_EKU_KERNEL_MODE_CODE_SIGNING_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_MS_KERNEL_MODE_CODE_SIGNING;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_MS_EKU_LIFETIME_SIGNING_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_MS_EKU_LIFETIME_SIGNING_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_MS_LIFETIME_SIGNING;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_MS_EKU_DRM_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_MS_EKU_DRM_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_MS_DRM;
-            else if (RTAsn1ObjId_CompareWithString(&pObjIds->paItems[i], RTCRX509_MS_EKU_DRM_INDIVIDUALIZATION_OID) == 0)
+            else if (RTAsn1ObjId_CompareWithString(pObjIds->papItems[i], RTCRX509_MS_EKU_DRM_INDIVIDUALIZATION_OID) == 0)
                 pThis->T3.fExtKeyUsage |= RTCRX509CERT_EKU_F_MS_DRM_INDIVIDUALIZATION;
             else
@@ -1443 +1443 @@
     for (uint32_t i = 0; i < pThis->T3.Extensions.cItems; i++)
     {
-        PCRTASN1OBJID       pExtnId   = &pThis->T3.Extensions.paItems[i].ExtnId;
-        PCRTASN1OCTETSTRING pExtValue = &pThis->T3.Extensions.paItems[i].ExtnValue;
+        PCRTASN1OBJID       pExtnId   = &pThis->T3.Extensions.papItems[i]->ExtnId;
+        PCRTASN1OCTETSTRING pExtValue = &pThis->T3.Extensions.papItems[i]->ExtnValue;
         if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_KEY_USAGE_OID) == 0)
         {
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_KEY_USAGE);
-            rtCrx509TbsCertificate_AddKeyUsageFlags(pThis, &pThis->T3.Extensions.paItems[i]);
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_BIT_STRING);
+            rtCrx509TbsCertificate_AddKeyUsageFlags(pThis, pThis->T3.Extensions.papItems[i]);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_BIT_STRING);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_EXT_KEY_USAGE_OID) == 0)
         {
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_EXT_KEY_USAGE);
-            rtCrx509TbsCertificate_AddExtKeyUsageFlags(pThis, &pThis->T3.Extensions.paItems[i]);
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_SEQ_OF_OBJ_IDS);
+            rtCrx509TbsCertificate_AddExtKeyUsageFlags(pThis, pThis->T3.Extensions.papItems[i]);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_SEQ_OF_OBJ_IDS);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_AUTHORITY_KEY_IDENTIFIER_OID) == 0)
@@ -1461 +1461 @@
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_AUTHORITY_KEY_IDENTIFIER);
             pThis->T3.pAuthorityKeyIdentifier = (PCRTCRX509AUTHORITYKEYIDENTIFIER)pExtValue->pEncapsulated;
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_AUTHORITY_KEY_IDENTIFIER);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_AUTHORITY_KEY_IDENTIFIER);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_OLD_AUTHORITY_KEY_IDENTIFIER_OID) == 0)
@@ -1467 +1467 @@
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_OLD_AUTHORITY_KEY_IDENTIFIER);
             pThis->T3.pOldAuthorityKeyIdentifier = (PCRTCRX509OLDAUTHORITYKEYIDENTIFIER)pExtValue->pEncapsulated;
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_OLD_AUTHORITY_KEY_IDENTIFIER);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_OLD_AUTHORITY_KEY_IDENTIFIER);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_SUBJECT_KEY_IDENTIFIER_OID) == 0)
@@ -1473 +1473 @@
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_SUBJECT_KEY_IDENTIFIER);
             pThis->T3.pSubjectKeyIdentifier = (PCRTASN1OCTETSTRING)pExtValue->pEncapsulated;
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_OCTET_STRING);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_OCTET_STRING);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_SUBJECT_ALT_NAME_OID) == 0)
@@ -1479 +1479 @@
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_SUBJECT_ALT_NAME);
             pThis->T3.pAltSubjectName = (PCRTCRX509GENERALNAMES)pExtValue->pEncapsulated;
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_GENERAL_NAMES);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_GENERAL_NAMES);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_ISSUER_ALT_NAME_OID) == 0)
@@ -1485 +1485 @@
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_ISSUER_ALT_NAME);
             pThis->T3.pAltIssuerName = (PCRTCRX509GENERALNAMES)pExtValue->pEncapsulated;
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_GENERAL_NAMES);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_GENERAL_NAMES);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_CERTIFICATE_POLICIES_OID) == 0)
@@ -1491 +1491 @@
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_CERTIFICATE_POLICIES);
             pThis->T3.pCertificatePolicies = (PCRTCRX509CERTIFICATEPOLICIES)pExtValue->pEncapsulated;
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_CERTIFICATE_POLICIES);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_CERTIFICATE_POLICIES);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_POLICY_MAPPINGS_OID) == 0)
@@ -1497 +1497 @@
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_POLICY_MAPPINGS);
             pThis->T3.pPolicyMappings = (PCRTCRX509POLICYMAPPINGS)pExtValue->pEncapsulated;
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_POLICY_MAPPINGS);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_POLICY_MAPPINGS);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_BASIC_CONSTRAINTS_OID) == 0)
@@ -1503 +1503 @@
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_BASIC_CONSTRAINTS);
             pThis->T3.pBasicConstraints = (PCRTCRX509BASICCONSTRAINTS)pExtValue->pEncapsulated;
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_BASIC_CONSTRAINTS);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_BASIC_CONSTRAINTS);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_NAME_CONSTRAINTS_OID) == 0)
@@ -1509 +1509 @@
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_NAME_CONSTRAINTS);
             pThis->T3.pNameConstraints = (PCRTCRX509NAMECONSTRAINTS)pExtValue->pEncapsulated;
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_NAME_CONSTRAINTS);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_NAME_CONSTRAINTS);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_POLICY_CONSTRAINTS_OID) == 0)
@@ -1515 +1515 @@
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_POLICY_CONSTRAINTS);
             pThis->T3.pPolicyConstraints = (PCRTCRX509POLICYCONSTRAINTS)pExtValue->pEncapsulated;
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_POLICY_CONSTRAINTS);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_POLICY_CONSTRAINTS);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_INHIBIT_ANY_POLICY_OID) == 0)
@@ -1521 +1521 @@
             CHECK_SET_PRESENT_RET_ON_DUP(pThis, pErrInfo, RTCRX509TBSCERTIFICATE_F_PRESENT_INHIBIT_ANY_POLICY);
             pThis->T3.pInhibitAnyPolicy = (PCRTASN1INTEGER)pExtValue->pEncapsulated;
-            Assert(pThis->T3.Extensions.paItems[i].enmValue == RTCRX509EXTENSIONVALUE_INTEGER);
+            Assert(pThis->T3.Extensions.papItems[i]->enmValue == RTCRX509EXTENSIONVALUE_INTEGER);
         }
         else if (RTAsn1ObjId_CompareWithString(pExtnId, RTCRX509_ID_CE_ACCEPTABLE_CERT_POLICIES_OID) == 0)
@@ -1560 +1560 @@
         for (uint32_t i = 0; i < pThis->TbsCertificate.T3.Extensions.cItems; i++)
         {
-            PCRTCRX509EXTENSION pExt = &pThis->TbsCertificate.T3.Extensions.paItems[i];
+            PCRTCRX509EXTENSION pExt = pThis->TbsCertificate.T3.Extensions.papItems[i];
             if (   pExt->enmValue == RTCRX509EXTENSIONVALUE_GENERAL_NAMES
                 && RTAsn1ObjId_CompareWithString(&pExt->ExtnId, RTCRX509_ID_CE_SUBJECT_ALT_NAME_OID))
@@ -1566 +1566 @@
                 PCRTCRX509GENERALNAMES pGeneralNames = (PCRTCRX509GENERALNAMES)pExt->ExtnValue.pEncapsulated;
                 for (uint32_t j = 0; j < pGeneralNames->cItems; j++)
-                    if (   RTCRX509GENERALNAME_IS_DIRECTORY_NAME(&pGeneralNames->paItems[j])
-                        && RTCrX509Name_MatchByRfc5280(&pGeneralNames->paItems[j].u.pT4->DirectoryName, pName))
+                    if (   RTCRX509GENERALNAME_IS_DIRECTORY_NAME(pGeneralNames->papItems[j])
+                        && RTCrX509Name_MatchByRfc5280(&pGeneralNames->papItems[j]->u.pT4->DirectoryName, pName))
                         return true;
             }
@@ -1595 +1595 @@
 {
     for (uint32_t i = 0; i < pCertificates->cItems; i++)
-        if (RTCrX509Certificate_MatchIssuerAndSerialNumber(&pCertificates->paItems[i], pIssuer, pSerialNumber))
-            return &pCertificates->paItems[i];
+        if (RTCrX509Certificate_MatchIssuerAndSerialNumber(pCertificates->papItems[i], pIssuer, pSerialNumber))
+            return pCertificates->papItems[i];
     return NULL;
 }

trunk/src/VBox/Runtime/common/crypto/x509-init.cpp

@@ -49 +49 @@
 {
     uint32_t                            cRdns = pThis->cItems;
-    PRTCRX509RELATIVEDISTINGUISHEDNAME  pRdn   = &pThis->paItems[0];
+    PRTCRX509RELATIVEDISTINGUISHEDNAME *ppRdn = pThis->papItems;
     while (cRdns-- > 0)
     {
-        uint32_t                        cAttribs = pRdn->cItems;
-        PRTCRX509ATTRIBUTETYPEANDVALUE  pAttrib  = &pRdn->paItems[0];
+        PRTCRX509RELATIVEDISTINGUISHEDNAME const pRdn     = *ppRdn;
+        uint32_t                                 cAttribs = pRdn->cItems;
+        PRTCRX509ATTRIBUTETYPEANDVALUE          *ppAttrib = pRdn->papItems;
         while (cAttribs-- > 0)
         {
+            PRTCRX509ATTRIBUTETYPEANDVALUE const pAttrib = *ppAttrib;
             if (pAttrib->Value.enmType == RTASN1TYPE_STRING)
             {
@@ -62 +64 @@
                     return rc;
             }
-            pAttrib++;
+            ppAttrib++;
         }
-        pRdn++;
+        ppRdn++;
     }
     return VINF_SUCCESS;

trunk/src/VBox/Runtime/common/crypto/x509-sanity.cpp

@@ -59 +59 @@
     for (uint32_t i = 0; i < pThis->cItems; i++)
     {
-        if (pThis->cItems == 0)
+        PCRTCRX509RELATIVEDISTINGUISHEDNAME const pRdn = pThis->papItems[i];
+        if (pRdn->cItems == 0)
             return RTErrInfoSetF(pErrInfo, VERR_CR_X509_NAME_EMPTY_SUB_SET,
                                  "%s: Items[%u] has no sub components.", pszErrorTag, i);
 
-        for (uint32_t j = 0; j < pThis->paItems[i].cItems; j++)
+        for (uint32_t j = 0; j < pRdn->cItems; j++)
         {
-            if (pThis->paItems[i].paItems[j].Value.enmType != RTASN1TYPE_STRING)
+            PCRTCRX509ATTRIBUTETYPEANDVALUE const pAttr = pRdn->papItems[j];
+
+            if (pAttr->Value.enmType != RTASN1TYPE_STRING)
                 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_NAME_NOT_STRING,
                                      "%s: Items[%u].paItems[%u].enmType is %d instead of string (%d).",
-                                     pszErrorTag, i, j, pThis->paItems[i].paItems[j].Value.enmType, RTASN1TYPE_STRING);
-            if (pThis->paItems[i].paItems[j].Value.u.String.Asn1Core.cb == 0)
+                                     pszErrorTag, i, j, pAttr->Value.enmType, RTASN1TYPE_STRING);
+            if (pAttr->Value.u.String.Asn1Core.cb == 0)
                 return RTErrInfoSetF(pErrInfo, VERR_CR_X509_NAME_EMPTY_STRING,
                                      "%s: Items[%u].paItems[%u] is an empty string", pszErrorTag, i, j);
-            switch (pThis->paItems[i].paItems[j].Value.u.String.Asn1Core.uTag)
+            switch (pAttr->Value.u.String.Asn1Core.uTag)
             {
                 case ASN1_TAG_PRINTABLE_STRING:
@@ -86 +89 @@
                     return RTErrInfoSetF(pErrInfo, VERR_CR_X509_INVALID_NAME_STRING_TAG,
                                          "%s: Items[%u].paItems[%u] invalid string type: %u",  pszErrorTag, i, j,
-                                         pThis->paItems[i].paItems[j].Value.u.String.Asn1Core.uTag);
+                                         pAttr->Value.u.String.Asn1Core.uTag);
             }
         }