1From 44bc6dfcdd2581f64fc869c8863dd590ea947033 Mon Sep 17 00:00:00 2001
2From: Michael Forney <mforney@mforney.org>
3Date: Thu, 2 Apr 2026 23:52:53 -0700
4Subject: [PATCH] Avoid implicit pointer sign conversions
5
6s_client_options:
7All option values for clr and off used here fit in a 32-bit int,
8the largest being SSL_OP_NO_TLSv1_3=0x20000000L, so make these
9fields int.
10
11sm4_ctr_cipher:
12CRYPTO_ctr128_encrypt expects an unsigned int *, but ctx->num is
13an int. Use a local variable with the correct type to avoid aliasing
14issues.
15
16addr_validate_path_internal:
17length is used twice, its address is passed to
18IPAddressFamily_afi_length, expecting an int *, and addr_contains, also
19expecting int, so change its type to int.
20
21tls_decrypt_ticket:
22hlen is used for the result of HMAC_size. Though the manual documents
23this as returning a size_t, it actually returns an int since it
24wraps EVP_MD_size, which can return a negative value. HMAC_Final
25expects an unsigned int *, so we need a separate variable for the
26final length.
27
28tls13_new_session_ticket_recv:
29session_id_length is used twice, its address is passed to EVP_Digest
30which expects an unsigned int, and then it is saved in
31SSL_SESSION.session_id_length, a size_t. So its type from int to
32unsigned int.
33
34All other changes simply make explicit the conversions among pointers
35to character types already being done. These implicit conversions
36are constraint violations in ISO C.
37---
38 apps/openssl/ca.c | 7 ++++---
39 apps/openssl/cms.c | 2 +-
40 apps/openssl/s_client.c | 4 ++--
41 crypto/asn1/a_object.c | 12 ++++++------
42 crypto/asn1/a_time.c | 2 +-
43 crypto/asn1/a_time_tm.c | 22 ++++++++++++----------
44 crypto/bio/b_dump.c | 2 +-
45 crypto/bio/bss_mem.c | 4 ++--
46 crypto/bn/bn_convert.c | 8 ++++----
47 crypto/bn/bn_print.c | 2 +-
48 crypto/evp/e_sm4.c | 4 +++-
49 crypto/ocsp/ocsp_cl.c | 4 ++--
50 crypto/pkcs7/pk7_attr.c | 2 +-
51 crypto/x509/x509_addr.c | 2 +-
52 crypto/x509/x509_constraints.c | 18 +++++++++---------
53 crypto/x509/x509_obj.c | 10 +++++-----
54 crypto/x509/x509_utl.c | 8 ++++----
55 crypto/x509/x509_verify.c | 3 ++-
56 crypto/x509/x509name.c | 3 ++-
57 ssl/s3_lib.c | 2 +-
58 ssl/ssl_clnt.c | 2 +-
59 ssl/ssl_lib.c | 8 ++++----
60 ssl/ssl_srvr.c | 2 +-
61 ssl/ssl_tlsext.c | 3 ++-
62 ssl/ssl_txt.c | 4 ++--
63 ssl/t1_lib.c | 4 +++-
64 ssl/tls13_client.c | 8 ++++----
65 ssl/tls13_key_schedule.c | 12 ++++++------
66 ssl/tls13_legacy.c | 2 +-
67 ssl/tls13_lib.c | 3 ++-
68 ssl/tls13_record_layer.c | 2 +-
69 ssl/tls13_server.c | 10 +++++-----
70 32 files changed, 96 insertions(+), 85 deletions(-)
71
72diff --git a/apps/openssl/ca.c b/apps/openssl/ca.c
73index a2e8a6836..5505983ff 100644
74--- a/apps/openssl/ca.c
75+++ b/apps/openssl/ca.c
76@@ -2197,7 +2197,7 @@ do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
77
78 if ((tm = X509_get_notAfter(ret)) == NULL)
79 goto err;
80- row[DB_exp_date] = strndup(ASN1_STRING_get0_data(tm),
81+ row[DB_exp_date] = strndup((char *)ASN1_STRING_get0_data(tm),
82 ASN1_STRING_length(tm));
83 if (row[DB_type] == NULL || row[DB_exp_date] == NULL) {
84 BIO_printf(bio_err, "Memory allocation failure\n");
85@@ -2325,7 +2325,7 @@ do_revoke(X509 *x509, CA_DB *db, int type, char *value)
86
87 if ((tm = X509_get_notAfter(x509)) == NULL)
88 goto err;
89- row[DB_exp_date] = strndup(ASN1_STRING_get0_data(tm),
90+ row[DB_exp_date] = strndup((char *)ASN1_STRING_get0_data(tm),
91 ASN1_STRING_length(tm));
92 if (row[DB_type] == NULL || row[DB_exp_date] == NULL) {
93 BIO_printf(bio_err, "Memory allocation failure\n");
94@@ -2489,7 +2489,8 @@ do_updatedb(CA_DB *db)
95 cnt = -1;
96 goto err;
97 }
98- a_tm_s = strndup(ASN1_STRING_get0_data(a_tm), ASN1_STRING_length(a_tm));
99+ a_tm_s = strndup((char *)ASN1_STRING_get0_data(a_tm),
100+ ASN1_STRING_length(a_tm));
101 if (a_tm_s == NULL) {
102 cnt = -1;
103 goto err;
104diff --git a/apps/openssl/cms.c b/apps/openssl/cms.c
105index 7430f4c93..a63d6e453 100644
106--- a/apps/openssl/cms.c
107+++ b/apps/openssl/cms.c
108@@ -1512,7 +1512,7 @@ cms_main(int argc, char **argv)
109 cfg.secret_keyid = NULL;
110 }
111 if (cfg.pwri_pass != NULL) {
112- pwri_tmp = strdup(cfg.pwri_pass);
113+ pwri_tmp = (unsigned char *)strdup((char *)cfg.pwri_pass);
114 if (pwri_tmp == NULL)
115 goto end;
116 if (CMS_add0_recipient_password(cms, -1, NID_undef,
117diff --git a/apps/openssl/s_client.c b/apps/openssl/s_client.c
118index 2b05facc1..d12423d0f 100644
119--- a/apps/openssl/s_client.c
120+++ b/apps/openssl/s_client.c
121@@ -194,7 +194,7 @@ static struct {
122 char *cert_file;
123 int cert_format;
124 char *cipher;
125- unsigned int clr;
126+ int clr;
127 char *connect;
128 int crlf;
129 int debug;
130@@ -215,7 +215,7 @@ static struct {
131 int nbio_test;
132 int no_servername;
133 char *npn_in;
134- unsigned int off;
135+ int off;
136 char *passarg;
137 int peekaboo;
138 char *port;
139diff --git a/crypto/asn1/a_object.c b/crypto/asn1/a_object.c
140index 333ac6034..25e7a2ae6 100644
141--- a/crypto/asn1/a_object.c
142+++ b/crypto/asn1/a_object.c
143@@ -182,7 +182,7 @@ oid_add_arc_txt(CBB *cbb, uint64_t arc, int first)
144 n = snprintf(s, sizeof(s), fmt, (unsigned long long)arc);
145 if (n < 0 || (size_t)n >= sizeof(s))
146 return 0;
147- if (!CBB_add_bytes(cbb, s, n))
148+ if (!CBB_add_bytes(cbb, (uint8_t *)s, n))
149 return 0;
150
151 return 1;
152@@ -343,7 +343,7 @@ a2d_ASN1_OBJECT(unsigned char *out, int out_len, const char *in, int in_len)
153 if (in_len <= 0)
154 goto err;
155
156- CBS_init(&cbs, in, in_len);
157+ CBS_init(&cbs, (uint8_t *)in, in_len);
158
159 if (!CBB_init(&cbb, 0))
160 goto err;
161@@ -401,7 +401,7 @@ i2t_ASN1_OBJECT_name(const ASN1_OBJECT *aobj, CBB *cbb, const char **out_name)
162
163 *out_name = name;
164
165- if (!CBB_add_bytes(cbb, name, strlen(name)))
166+ if (!CBB_add_bytes(cbb, (uint8_t *)name, strlen(name)))
167 return 0;
168
169 /* NUL terminate. */
170@@ -448,7 +448,7 @@ i2t_ASN1_OBJECT_internal(const ASN1_OBJECT *aobj, char *buf, int buf_len, int no
171 if (!CBB_finish(&cbb, &data, &data_len))
172 goto err;
173
174- ret = strlcpy(buf, data, buf_len);
175+ ret = strlcpy(buf, (char *)data, buf_len);
176 err:
177 CBB_cleanup(&cbb);
178 free(data);
179@@ -474,7 +474,7 @@ t2i_ASN1_OBJECT_internal(const char *oid)
180
181 memset(&cbb, 0, sizeof(cbb));
182
183- CBS_init(&cbs, oid, strlen(oid));
184+ CBS_init(&cbs, (uint8_t *)oid, strlen(oid));
185
186 if (!CBB_init(&cbb, 0))
187 goto err;
188@@ -521,7 +521,7 @@ i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *aobj)
189 if (!CBB_finish(&cbb, &data, &data_len))
190 goto err;
191
192- ret = BIO_write(bp, data, strlen(data));
193+ ret = BIO_write(bp, data, strlen((char *)data));
194
195 err:
196 CBB_cleanup(&cbb);
197diff --git a/crypto/asn1/a_time.c b/crypto/asn1/a_time.c
198index 3deff56ed..10634c067 100644
199--- a/crypto/asn1/a_time.c
200+++ b/crypto/asn1/a_time.c
201@@ -99,7 +99,7 @@ ASN1_TIME_to_tm(const ASN1_TIME *s, struct tm *tm)
202 time_t now;
203
204 if (s != NULL)
205- return ASN1_time_parse(s->data, s->length, tm, 0) != -1;
206+ return ASN1_time_parse((char *)s->data, s->length, tm, 0) != -1;
207
208 time(&now);
209 memset(tm, 0, sizeof(*tm));
210diff --git a/crypto/asn1/a_time_tm.c b/crypto/asn1/a_time_tm.c
211index dd2893167..c0e0d6245 100644
212--- a/crypto/asn1/a_time_tm.c
213+++ b/crypto/asn1/a_time_tm.c
214@@ -96,7 +96,7 @@ tm_to_gentime(struct tm *tm, ASN1_TIME *atime)
215 }
216
217 free(atime->data);
218- atime->data = time_str;
219+ atime->data = (unsigned char *)time_str;
220 atime->length = GENTIME_LENGTH;
221 atime->type = V_ASN1_GENERALIZEDTIME;
222
223@@ -122,7 +122,7 @@ tm_to_utctime(struct tm *tm, ASN1_TIME *atime)
224 }
225
226 free(atime->data);
227- atime->data = time_str;
228+ atime->data = (unsigned char *)time_str;
229 atime->length = UTCTIME_LENGTH;
230 atime->type = V_ASN1_UTCTIME;
231
232@@ -293,7 +293,7 @@ ASN1_time_parse(const char *bytes, size_t len, struct tm *tm, int mode)
233 if (bytes == NULL)
234 return -1;
235
236- CBS_init(&cbs, bytes, len);
237+ CBS_init(&cbs, (uint8_t *)bytes, len);
238
239 if (CBS_len(&cbs) == UTCTIME_LENGTH)
240 type = V_ASN1_UTCTIME;
241@@ -401,7 +401,8 @@ ASN1_TIME_check(const ASN1_TIME *t)
242 {
243 if (t->type != V_ASN1_GENERALIZEDTIME && t->type != V_ASN1_UTCTIME)
244 return 0;
245- return t->type == ASN1_time_parse(t->data, t->length, NULL, t->type);
246+ return t->type == ASN1_time_parse((char *)t->data, t->length, NULL,
247+ t->type);
248 }
249 LCRYPTO_ALIAS(ASN1_TIME_check);
250
251@@ -414,7 +415,7 @@ ASN1_TIME_to_generalizedtime(const ASN1_TIME *t, ASN1_GENERALIZEDTIME **out)
252 if (t->type != V_ASN1_GENERALIZEDTIME && t->type != V_ASN1_UTCTIME)
253 goto err;
254
255- if (t->type != ASN1_time_parse(t->data, t->length, &tm, t->type))
256+ if (t->type != ASN1_time_parse((char *)t->data, t->length, &tm, t->type))
257 goto err;
258
259 if (out == NULL || (agt = *out) == NULL)
260@@ -460,7 +461,7 @@ ASN1_TIME_cmp_time_t_internal(const ASN1_TIME *s, time_t t2, int mode)
261 * one of those pervasive things from OpenSSL we must continue with.
262 */
263
264- if (ASN1_time_parse(s->data, s->length, &tm1, mode) == -1)
265+ if (ASN1_time_parse((char *)s->data, s->length, &tm1, mode) == -1)
266 return -2;
267
268 if (!asn1_time_time_t_to_tm(&t2, &tm2))
269@@ -480,10 +481,10 @@ ASN1_TIME_compare(const ASN1_TIME *t1, const ASN1_TIME *t2)
270 if (t2->type != V_ASN1_UTCTIME && t2->type != V_ASN1_GENERALIZEDTIME)
271 return -2;
272
273- if (ASN1_time_parse(t1->data, t1->length, &tm1, t1->type) == -1)
274+ if (ASN1_time_parse((char *)t1->data, t1->length, &tm1, t1->type) == -1)
275 return -2;
276
277- if (ASN1_time_parse(t2->data, t2->length, &tm2, t2->type) == -1)
278+ if (ASN1_time_parse((char *)t2->data, t2->length, &tm2, t2->type) == -1)
279 return -2;
280
281 return ASN1_time_tm_cmp(&tm1, &tm2);
282@@ -511,7 +512,7 @@ ASN1_UTCTIME_check(const ASN1_UTCTIME *d)
283 {
284 if (d->type != V_ASN1_UTCTIME)
285 return 0;
286- return d->type == ASN1_time_parse(d->data, d->length, NULL, d->type);
287+ return d->type == ASN1_time_parse((char *)d->data, d->length, NULL, d->type);
288 }
289 LCRYPTO_ALIAS(ASN1_UTCTIME_check);
290
291@@ -557,7 +558,8 @@ ASN1_GENERALIZEDTIME_check(const ASN1_GENERALIZEDTIME *d)
292 {
293 if (d->type != V_ASN1_GENERALIZEDTIME)
294 return 0;
295- return d->type == ASN1_time_parse(d->data, d->length, NULL, d->type);
296+ return d->type == ASN1_time_parse((char *)d->data, d->length, NULL,
297+ d->type);
298 }
299 LCRYPTO_ALIAS(ASN1_GENERALIZEDTIME_check);
300
301diff --git a/crypto/bio/b_dump.c b/crypto/bio/b_dump.c
302index 3f673205c..40b09dc23 100644
303--- a/crypto/bio/b_dump.c
304+++ b/crypto/bio/b_dump.c
305@@ -86,7 +86,7 @@ BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
306
307 if (len < 0)
308 goto err;
309- CBS_init(&cbs, s, len);
310+ CBS_init(&cbs, (uint8_t *)s, len);
311
312 if (indent < 0)
313 indent = 0;
314diff --git a/crypto/bio/bss_mem.c b/crypto/bio/bss_mem.c
315index 0fa6317a2..afcd6b216 100644
316--- a/crypto/bio/bss_mem.c
317+++ b/crypto/bio/bss_mem.c
318@@ -84,7 +84,7 @@ bio_mem_pending(struct bio_mem *bm)
319 static uint8_t *
320 bio_mem_read_ptr(struct bio_mem *bm)
321 {
322- return &bm->buf->data[bm->read_offset];
323+ return (uint8_t *)&bm->buf->data[bm->read_offset];
324 }
325
326 static int mem_new(BIO *bio);
327@@ -349,7 +349,7 @@ mem_gets(BIO *bio, char *out, int out_len)
328 return 0;
329 }
330
331- p = bio_mem_read_ptr(bm);
332+ p = (char *)bio_mem_read_ptr(bm);
333 for (i = 0; i < out_max; i++) {
334 if (p[i] == '\n') {
335 i++;
336diff --git a/crypto/bn/bn_convert.c b/crypto/bn/bn_convert.c
337index ab5bc519c..cb006a209 100644
338--- a/crypto/bn/bn_convert.c
339+++ b/crypto/bn/bn_convert.c
340@@ -261,7 +261,7 @@ BN_asc2bn(BIGNUM **bnp, const char *s)
341 if ((s_len = strlen(s)) == 0)
342 return 0;
343
344- CBS_init(&cbs, s, s_len);
345+ CBS_init(&cbs, (uint8_t *)s, s_len);
346
347 /* Handle negative sign. */
348 if (!CBS_peek_u8(&cbs, &v))
349@@ -373,7 +373,7 @@ BN_bn2dec(const BIGNUM *bn)
350 CBB_cleanup(&cbb);
351 freezero(data, data_len);
352
353- return s;
354+ return (char *)s;
355 }
356 LCRYPTO_ALIAS(BN_bn2dec);
357
358@@ -476,7 +476,7 @@ BN_dec2bn(BIGNUM **bnp, const char *s)
359 if ((s_len = strlen(s)) == 0)
360 return 0;
361
362- CBS_init(&cbs, s, s_len);
363+ CBS_init(&cbs, (uint8_t *)s, s_len);
364
365 return bn_dec2bn_cbs(bnp, &cbs);
366 }
367@@ -677,7 +677,7 @@ BN_hex2bn(BIGNUM **bnp, const char *s)
368 if ((s_len = strlen(s)) == 0)
369 return 0;
370
371- CBS_init(&cbs, s, s_len);
372+ CBS_init(&cbs, (uint8_t *)s, s_len);
373
374 return bn_hex2bn_cbs(bnp, &cbs);
375 }
376diff --git a/crypto/bn/bn_print.c b/crypto/bn/bn_print.c
377index cd8b66360..655732413 100644
378--- a/crypto/bn/bn_print.c
379+++ b/crypto/bn/bn_print.c
380@@ -82,7 +82,7 @@ bn_print_bignum(BIO *bio, const BIGNUM *bn, int indent)
381 if (!bn_bn2hex_nosign(bn, &hex, &hex_len))
382 goto err;
383
384- CBS_init(&cbs, hex, hex_len);
385+ CBS_init(&cbs, (uint8_t *)hex, hex_len);
386
387 if (BN_is_negative(bn)) {
388 if (BIO_printf(bio, " (Negative)") <= 0)
389diff --git a/crypto/evp/e_sm4.c b/crypto/evp/e_sm4.c
390index cde2f6c64..9f8b13ed1 100644
391--- a/crypto/evp/e_sm4.c
392+++ b/crypto/evp/e_sm4.c
393@@ -237,9 +237,11 @@ sm4_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in,
394 size_t len)
395 {
396 EVP_SM4_KEY *key = ((EVP_SM4_KEY *)(ctx)->cipher_data);
397+ unsigned int num;
398
399 CRYPTO_ctr128_encrypt(in, out, len, &key->ks, ctx->iv, ctx->buf,
400- &ctx->num, (block128_f)SM4_encrypt);
401+ &num, (block128_f)SM4_encrypt);
402+ ctx->num = num;
403 return 1;
404 }
405
406diff --git a/crypto/ocsp/ocsp_cl.c b/crypto/ocsp/ocsp_cl.c
407index 460c1bce5..15a70b1c5 100644
408--- a/crypto/ocsp/ocsp_cl.c
409+++ b/crypto/ocsp/ocsp_cl.c
410@@ -410,7 +410,7 @@ OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
411 * (such as UTCTIME permitted/required by RFC 5280 for certificates)
412 */
413 /* Check that thisUpdate is valid. */
414- if (ASN1_time_parse(thisupd->data, thisupd->length, &tm_this,
415+ if (ASN1_time_parse((char *)thisupd->data, thisupd->length, &tm_this,
416 V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) {
417 OCSPerror(OCSP_R_ERROR_IN_THISUPDATE_FIELD);
418 return 0;
419@@ -433,7 +433,7 @@ OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
420 return 1;
421
422 /* Check that nextUpdate is valid. */
423- if (ASN1_time_parse(nextupd->data, nextupd->length, &tm_next,
424+ if (ASN1_time_parse((char *)nextupd->data, nextupd->length, &tm_next,
425 V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) {
426 OCSPerror(OCSP_R_ERROR_IN_NEXTUPDATE_FIELD);
427 return 0;
428diff --git a/crypto/pkcs7/pk7_attr.c b/crypto/pkcs7/pk7_attr.c
429index f2e17806d..cb6b2e84f 100644
430--- a/crypto/pkcs7/pk7_attr.c
431+++ b/crypto/pkcs7/pk7_attr.c
432@@ -192,7 +192,7 @@ PKCS7_add0_attrib_signing_time(PKCS7_SIGNER_INFO *si, ASN1_TIME *t)
433 }
434
435 /* RFC 5652, section 11.3 - UTCTime for the years 1950-2049. */
436- if (ASN1_time_parse(tm->data, tm->length, NULL, tm->type) == -1)
437+ if (ASN1_time_parse((char *)tm->data, tm->length, NULL, tm->type) == -1)
438 goto err;
439 if (!PKCS7_add_signed_attribute(si, NID_pkcs9_signingTime, tm->type, tm))
440 goto err;
441diff --git a/crypto/x509/x509_addr.c b/crypto/x509/x509_addr.c
442index b4ee92a14..615375dd6 100644
443--- a/crypto/x509/x509_addr.c
444+++ b/crypto/x509/x509_addr.c
445@@ -1875,7 +1875,7 @@ addr_validate_path_internal(X509_STORE_CTX *ctx, STACK_OF(X509) *chain,
446 X509 *cert = NULL;
447 int depth = -1;
448 int i;
449- unsigned int length;
450+ int length;
451 int ret = 1;
452
453 /* We need a non-empty chain to test against. */
454diff --git a/crypto/x509/x509_constraints.c b/crypto/x509/x509_constraints.c
455index c4f32c9cf..597fdde06 100644
456--- a/crypto/x509/x509_constraints.c
457+++ b/crypto/x509/x509_constraints.c
458@@ -347,7 +347,7 @@ x509_constraints_parse_mailbox(CBS *candidate,
459
460 for (i = 0; i < len; i++) {
461 char c;
462- if (!CBS_get_u8(©, &c))
463+ if (!CBS_get_u8(©, (uint8_t *)&c))
464 goto bad;
465 /* non ascii, cr, lf, or nul is never allowed */
466 if (!isascii(c) || c == '\r' || c == '\n' || c == '\0')
467@@ -445,7 +445,7 @@ x509_constraints_parse_mailbox(CBS *candidate,
468 }
469 if (candidate_local == NULL || candidate_domain == NULL)
470 goto bad;
471- CBS_init(&domain_cbs, candidate_domain, strlen(candidate_domain));
472+ CBS_init(&domain_cbs, (uint8_t *)candidate_domain, strlen(candidate_domain));
473 if (!x509_constraints_valid_host(&domain_cbs, 0))
474 goto bad;
475
476@@ -549,7 +549,7 @@ x509_constraints_uri_host(uint8_t *uri, size_t len, char **hostpart)
477 if (host != NULL)
478 break;
479 /* start after the userinfo part */
480- host = uri + i + 1;
481+ host = (char *)uri + i + 1;
482 continue;
483 }
484 /* did we find the end? */
485@@ -561,8 +561,8 @@ x509_constraints_uri_host(uint8_t *uri, size_t len, char **hostpart)
486 if (hostlen == 0)
487 return 0;
488 if (host == NULL)
489- host = authority;
490- CBS_init(&host_cbs, host, hostlen);
491+ host = (char *)authority;
492+ CBS_init(&host_cbs, (uint8_t *)host, hostlen);
493 if (!x509_constraints_valid_host(&host_cbs, 1))
494 return 0;
495 if (hostpart != NULL && !CBS_strdup(&host_cbs, hostpart))
496@@ -667,8 +667,8 @@ x509_constraints_uri(uint8_t *uri, size_t ulen, uint8_t *constraint,
497 *error = X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX;
498 goto err;
499 }
500- ret = x509_constraints_domain(hostpart, strlen(hostpart), constraint,
501- len);
502+ ret = x509_constraints_domain(hostpart, strlen(hostpart),
503+ (char *)constraint, len);
504 err:
505 free(hostpart);
506 return ret;
507@@ -1018,7 +1018,7 @@ x509_constraints_validate(GENERAL_NAME *constraint,
508 case GEN_DNS:
509 if (!x509_constraints_valid_domain_constraint(&cbs))
510 goto err;
511- if ((name->name = strndup(bytes, len)) == NULL) {
512+ if ((name->name = strndup((char *)bytes, len)) == NULL) {
513 error = X509_V_ERR_OUT_OF_MEM;
514 goto err;
515 }
516@@ -1064,7 +1064,7 @@ x509_constraints_validate(GENERAL_NAME *constraint,
517 case GEN_URI:
518 if (!x509_constraints_valid_domain_constraint(&cbs))
519 goto err;
520- if ((name->name = strndup(bytes, len)) == NULL) {
521+ if ((name->name = strndup((char *)bytes, len)) == NULL) {
522 error = X509_V_ERR_OUT_OF_MEM;
523 goto err;
524 }
525diff --git a/crypto/x509/x509_obj.c b/crypto/x509/x509_obj.c
526index db1741cc9..43afeb8cf 100644
527--- a/crypto/x509/x509_obj.c
528+++ b/crypto/x509/x509_obj.c
529@@ -78,13 +78,13 @@ X509_NAME_ENTRY_add_object_cbb(CBB *cbb, const ASN1_OBJECT *aobj)
530 /* Prefer SN over LN, and fall back to textual representation of OID. */
531 if ((nid = OBJ_obj2nid(aobj)) != NID_undef) {
532 if ((str = OBJ_nid2sn(nid)) != NULL)
533- return CBB_add_bytes(cbb, str, strlen(str));
534+ return CBB_add_bytes(cbb, (uint8_t *)str, strlen(str));
535 if ((str = OBJ_nid2ln(nid)) != NULL)
536- return CBB_add_bytes(cbb, str, strlen(str));
537+ return CBB_add_bytes(cbb, (uint8_t *)str, strlen(str));
538 }
539 if (OBJ_obj2txt(buf, sizeof(buf), aobj, 1) == 0)
540 return 0;
541- return CBB_add_bytes(cbb, buf, strlen(buf));
542+ return CBB_add_bytes(cbb, (uint8_t *)buf, strlen(buf));
543 }
544
545 static int
546@@ -183,9 +183,9 @@ X509_NAME_oneline(const X509_NAME *a, char *buf, int len)
547 goto err;
548
549 if (buf == NULL)
550- return line;
551+ return (char *)line;
552
553- strlcpy(buf, line, len);
554+ strlcpy(buf, (char *)line, len);
555 free(line);
556
557 return buf;
558diff --git a/crypto/x509/x509_utl.c b/crypto/x509/x509_utl.c
559index 2e60834ed..0746ac0c5 100644
560--- a/crypto/x509/x509_utl.c
561+++ b/crypto/x509/x509_utl.c
562@@ -504,7 +504,7 @@ hex_to_string(const unsigned char *buffer, long len)
563 err:
564 CBB_cleanup(&cbb);
565
566- return out;
567+ return (char *)out;
568 }
569 LCRYPTO_ALIAS(hex_to_string);
570
571@@ -569,7 +569,7 @@ string_to_hex(const char *str, long *len)
572 goto err;
573 }
574
575- CBS_init(&cbs, str, strlen(str));
576+ CBS_init(&cbs, (uint8_t *)str, strlen(str));
577 while (CBS_len(&cbs) > 0) {
578 /*
579 * Skipping only a single colon between two pairs of digits
580@@ -813,7 +813,7 @@ equal_nocase(const unsigned char *pattern, size_t pattern_len,
581 skip_prefix(&pattern, &pattern_len, subject, subject_len, flags);
582 if (pattern_len != subject_len)
583 return 0;
584- return (strncasecmp(pattern, subject, pattern_len) == 0);
585+ return (strncasecmp((char *)pattern, (char *)subject, pattern_len) == 0);
586 }
587
588 /* Compare using strncmp. */
589@@ -828,7 +828,7 @@ equal_case(const unsigned char *pattern, size_t pattern_len,
590 skip_prefix(&pattern, &pattern_len, subject, subject_len, flags);
591 if (pattern_len != subject_len)
592 return 0;
593- return (strncmp(pattern, subject, pattern_len) == 0);
594+ return (strncmp((char *)pattern, (char *)subject, pattern_len) == 0);
595 }
596
597 /*
598diff --git a/crypto/x509/x509_verify.c b/crypto/x509/x509_verify.c
599index fc3fbc14d..95c6cf359 100644
600--- a/crypto/x509/x509_verify.c
601+++ b/crypto/x509/x509_verify.c
602@@ -55,7 +55,8 @@ x509_verify_asn1_time_to_time_t(const ASN1_TIME *atime, int notAfter,
603 if (atime == NULL)
604 return 0;
605
606- type = ASN1_time_parse(atime->data, atime->length, &tm, atime->type);
607+ type = ASN1_time_parse((char *)atime->data, atime->length, &tm,
608+ atime->type);
609 if (type == -1)
610 return 0;
611
612diff --git a/crypto/x509/x509name.c b/crypto/x509/x509name.c
613index e60d8b7a3..5fc4d2ee0 100644
614--- a/crypto/x509/x509name.c
615+++ b/crypto/x509/x509name.c
616@@ -107,7 +107,8 @@ X509_NAME_get_text_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj, char *buf,
617 goto err;
618 /* We still support the "pass NULL to find out how much" API */
619 if (buf != NULL) {
620- if (len <= 0 || !CBS_write_bytes(&cbs, buf, len - 1, NULL))
621+ if (len <= 0 || !CBS_write_bytes(&cbs, (uint8_t *)buf,
622+ len - 1, NULL))
623 goto err;
624 /* It must be a C string */
625 buf[text_len] = '\0';
626diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
627index bcf26bec4..431af32f2 100644
628--- a/ssl/s3_lib.c
629+++ b/ssl/s3_lib.c
630@@ -1551,7 +1551,7 @@ _SSL_set_tlsext_host_name(SSL *s, const char *name)
631 if (name == NULL)
632 return 1;
633
634- CBS_init(&cbs, name, strlen(name));
635+ CBS_init(&cbs, (uint8_t *)name, strlen(name));
636
637 if (!tlsext_sni_is_valid_hostname(&cbs, &is_ip)) {
638 SSLerror(s, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
639diff --git a/ssl/ssl_clnt.c b/ssl/ssl_clnt.c
640index 6ef81a170..ffc55e5f9 100644
641--- a/ssl/ssl_clnt.c
642+++ b/ssl/ssl_clnt.c
643@@ -2337,7 +2337,7 @@ ssl3_send_client_change_cipher_spec(SSL *s)
644 memset(&cbb, 0, sizeof(cbb));
645
646 if (s->s3->hs.state == SSL3_ST_CW_CHANGE_A) {
647- if (!CBB_init_fixed(&cbb, s->init_buf->data,
648+ if (!CBB_init_fixed(&cbb, (uint8_t *)s->init_buf->data,
649 s->init_buf->length))
650 goto err;
651 if (!CBB_add_u8(&cbb, SSL3_MT_CCS))
652diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
653index 630724e67..32ab5332a 100644
654--- a/ssl/ssl_lib.c
655+++ b/ssl/ssl_lib.c
656@@ -2004,12 +2004,12 @@ SSL_export_keying_material(SSL *s, unsigned char *out, size_t out_len,
657 context = NULL;
658 context_len = 0;
659 }
660- return tls13_exporter(s->tls13, label, label_len, context,
661- context_len, out, out_len);
662+ return tls13_exporter(s->tls13, (uint8_t *)label, label_len,
663+ context, context_len, out, out_len);
664 }
665
666- return tls12_exporter(s, label, label_len, context, context_len,
667- use_context, out, out_len);
668+ return tls12_exporter(s, (uint8_t *)label, label_len, context,
669+ context_len, use_context, out, out_len);
670 }
671 LSSL_ALIAS(SSL_export_keying_material);
672
673diff --git a/ssl/ssl_srvr.c b/ssl/ssl_srvr.c
674index af4b20f6c..e877bb3f9 100644
675--- a/ssl/ssl_srvr.c
676+++ b/ssl/ssl_srvr.c
677@@ -2378,7 +2378,7 @@ ssl3_send_server_change_cipher_spec(SSL *s)
678 memset(&cbb, 0, sizeof(cbb));
679
680 if (s->s3->hs.state == SSL3_ST_SW_CHANGE_A) {
681- if (!CBB_init_fixed(&cbb, s->init_buf->data,
682+ if (!CBB_init_fixed(&cbb, (uint8_t *)s->init_buf->data,
683 s->init_buf->length))
684 goto err;
685 if (!CBB_add_u8(&cbb, SSL3_MT_CCS))
686diff --git a/ssl/ssl_tlsext.c b/ssl/ssl_tlsext.c
687index d879b3304..2b75b0fbb 100644
688--- a/ssl/ssl_tlsext.c
689+++ b/ssl/ssl_tlsext.c
690@@ -808,7 +808,8 @@ tlsext_sni_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
691 *alert = SSL_AD_UNRECOGNIZED_NAME;
692 goto err;
693 }
694- if (!CBS_mem_equal(&host_name, s->session->tlsext_hostname,
695+ if (!CBS_mem_equal(&host_name,
696+ (uint8_t *)s->session->tlsext_hostname,
697 strlen(s->session->tlsext_hostname))) {
698 *alert = SSL_AD_UNRECOGNIZED_NAME;
699 goto err;
700diff --git a/ssl/ssl_txt.c b/ssl/ssl_txt.c
701index 4ed76c95a..1ad3b9255 100644
702--- a/ssl/ssl_txt.c
703+++ b/ssl/ssl_txt.c
704@@ -170,8 +170,8 @@ SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
705 if (x->tlsext_tick != NULL) {
706 if (BIO_puts(bp, "\n TLS session ticket:\n") <= 0)
707 goto err;
708- if (BIO_dump_indent(bp, x->tlsext_tick, x->tlsext_ticklen,
709- 4) <= 0)
710+ if (BIO_dump_indent(bp, (char *)x->tlsext_tick,
711+ x->tlsext_ticklen, 4) <= 0)
712 goto err;
713 }
714
715diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
716index 912bea592..c93107383 100644
717--- a/ssl/t1_lib.c
718+++ b/ssl/t1_lib.c
719@@ -1014,6 +1014,7 @@ tls_decrypt_ticket(SSL *s, CBS *ticket, int *alert, SSL_SESSION **psess)
720 EVP_CIPHER_CTX *cctx = NULL;
721 SSL_CTX *tctx = s->initial_ctx;
722 int slen, hlen, iv_len;
723+ unsigned int hlenu;
724 int alert_desc = SSL_AD_INTERNAL_ERROR;
725 int ret = TLS1_TICKET_FATAL_ERROR;
726
727@@ -1108,8 +1109,9 @@ tls_decrypt_ticket(SSL *s, CBS *ticket, int *alert, SSL_SESSION **psess)
728 if (HMAC_Update(hctx, CBS_data(&ticket_encdata),
729 CBS_len(&ticket_encdata)) <= 0)
730 goto err;
731- if (HMAC_Final(hctx, hmac, &hlen) <= 0)
732+ if (HMAC_Final(hctx, hmac, &hlenu) <= 0)
733 goto err;
734+ hlen = hlenu;
735
736 if (!CBS_mem_equal(&ticket_hmac, hmac, hlen))
737 goto derr;
738diff --git a/ssl/tls13_client.c b/ssl/tls13_client.c
739index 21d396079..a837b85fe 100644
740--- a/ssl/tls13_client.c
741+++ b/ssl/tls13_client.c
742@@ -668,7 +668,7 @@ tls13_server_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs)
743 sizeof(tls13_cert_verify_pad)))
744 goto err;
745 if (!CBB_add_bytes(&cbb, tls13_cert_server_verify_context,
746- strlen(tls13_cert_server_verify_context)))
747+ strlen((char *)tls13_cert_server_verify_context)))
748 goto err;
749 if (!CBB_add_u8(&cbb, 0))
750 goto err;
751@@ -722,7 +722,7 @@ int
752 tls13_server_finished_recv(struct tls13_ctx *ctx, CBS *cbs)
753 {
754 struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
755- struct tls13_secret context = { .data = "", .len = 0 };
756+ struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
757 struct tls13_secret finished_key;
758 uint8_t transcript_hash[EVP_MAX_MD_SIZE];
759 size_t transcript_hash_len;
760@@ -944,7 +944,7 @@ tls13_client_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
761 sizeof(tls13_cert_verify_pad)))
762 goto err;
763 if (!CBB_add_bytes(&sig_cbb, tls13_cert_client_verify_context,
764- strlen(tls13_cert_client_verify_context)))
765+ strlen((char *)tls13_cert_client_verify_context)))
766 goto err;
767 if (!CBB_add_u8(&sig_cbb, 0))
768 goto err;
769@@ -1005,7 +1005,7 @@ int
770 tls13_client_finished_send(struct tls13_ctx *ctx, CBB *cbb)
771 {
772 struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
773- struct tls13_secret context = { .data = "", .len = 0 };
774+ struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
775 struct tls13_secret finished_key = { .data = NULL, .len = 0 };
776 uint8_t transcript_hash[EVP_MAX_MD_SIZE];
777 size_t transcript_hash_len;
778diff --git a/ssl/tls13_key_schedule.c b/ssl/tls13_key_schedule.c
779index 05bcf0f00..19afc7999 100644
780--- a/ssl/tls13_key_schedule.c
781+++ b/ssl/tls13_key_schedule.c
782@@ -160,8 +160,8 @@ tls13_hkdf_expand_label(struct tls13_secret *out, const EVP_MD *digest,
783 const struct tls13_secret *secret, const char *label,
784 const struct tls13_secret *context)
785 {
786- return tls13_hkdf_expand_label_with_length(out, digest, secret, label,
787- strlen(label), context);
788+ return tls13_hkdf_expand_label_with_length(out, digest, secret,
789+ (uint8_t *)label, strlen(label), context);
790 }
791
792 int
793@@ -185,7 +185,7 @@ tls13_hkdf_expand_label_with_length(struct tls13_secret *out,
794 goto err;
795 if (!CBB_add_u8_length_prefixed(&cbb, &child))
796 goto err;
797- if (!CBB_add_bytes(&child, tls13_plabel, strlen(tls13_plabel)))
798+ if (!CBB_add_bytes(&child, (uint8_t *)tls13_plabel, strlen(tls13_plabel)))
799 goto err;
800 if (!CBB_add_bytes(&child, label, label_len))
801 goto err;
802@@ -362,7 +362,7 @@ tls13_derive_application_secrets(struct tls13_secrets *secrets,
803 int
804 tls13_update_client_traffic_secret(struct tls13_secrets *secrets)
805 {
806- struct tls13_secret context = { .data = "", .len = 0 };
807+ struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
808
809 if (!secrets->init_done || !secrets->early_done ||
810 !secrets->handshake_done || !secrets->schedule_done)
811@@ -376,7 +376,7 @@ tls13_update_client_traffic_secret(struct tls13_secrets *secrets)
812 int
813 tls13_update_server_traffic_secret(struct tls13_secrets *secrets)
814 {
815- struct tls13_secret context = { .data = "", .len = 0 };
816+ struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
817
818 if (!secrets->init_done || !secrets->early_done ||
819 !secrets->handshake_done || !secrets->schedule_done)
820@@ -423,7 +423,7 @@ tls13_exporter(struct tls13_ctx *ctx, const uint8_t *label, size_t label_len,
821
822 /* In TLSv1.3 no context is equivalent to an empty context. */
823 if (context_value == NULL) {
824- context_value = "";
825+ context_value = (uint8_t *)"";
826 context_value_len = 0;
827 }
828
829diff --git a/ssl/tls13_legacy.c b/ssl/tls13_legacy.c
830index 6a06330b2..220999745 100644
831--- a/ssl/tls13_legacy.c
832+++ b/ssl/tls13_legacy.c
833@@ -359,7 +359,7 @@ tls13_use_legacy_stack(struct tls13_ctx *ctx)
834 tls13_handshake_msg_data(ctx->hs_msg, &cbs);
835 if (!BUF_MEM_grow_clean(s->init_buf, CBS_len(&cbs)))
836 goto err;
837- if (!CBS_write_bytes(&cbs, s->init_buf->data,
838+ if (!CBS_write_bytes(&cbs, (uint8_t *)s->init_buf->data,
839 s->init_buf->length, NULL))
840 goto err;
841
842diff --git a/ssl/tls13_lib.c b/ssl/tls13_lib.c
843index c3470b293..5d9f15950 100644
844--- a/ssl/tls13_lib.c
845+++ b/ssl/tls13_lib.c
846@@ -378,7 +378,8 @@ tls13_new_session_ticket_recv(struct tls13_ctx *ctx, CBS *cbs)
847 uint32_t ticket_lifetime, ticket_age_add;
848 CBS ticket_nonce, ticket;
849 SSL_SESSION *sess = NULL;
850- int alert, session_id_length;
851+ int alert;
852+ unsigned int session_id_length;
853 ssize_t ret = 0;
854
855 memset(&nonce, 0, sizeof(nonce));
856diff --git a/ssl/tls13_record_layer.c b/ssl/tls13_record_layer.c
857index f5604adbe..9bdd61c91 100644
858--- a/ssl/tls13_record_layer.c
859+++ b/ssl/tls13_record_layer.c
860@@ -467,7 +467,7 @@ static int
861 tls13_record_layer_set_traffic_key(const EVP_AEAD *aead, const EVP_MD *hash,
862 struct tls13_record_protection *rp, struct tls13_secret *traffic_key)
863 {
864- struct tls13_secret context = { .data = "", .len = 0 };
865+ struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
866 struct tls13_secret key = { .data = NULL, .len = 0 };
867 int ret = 0;
868
869diff --git a/ssl/tls13_server.c b/ssl/tls13_server.c
870index 604dab4cb..2beb72636 100644
871--- a/ssl/tls13_server.c
872+++ b/ssl/tls13_server.c
873@@ -728,7 +728,7 @@ tls13_server_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
874 sizeof(tls13_cert_verify_pad)))
875 goto err;
876 if (!CBB_add_bytes(&sig_cbb, tls13_cert_server_verify_context,
877- strlen(tls13_cert_server_verify_context)))
878+ strlen((char *)tls13_cert_server_verify_context)))
879 goto err;
880 if (!CBB_add_u8(&sig_cbb, 0))
881 goto err;
882@@ -783,7 +783,7 @@ int
883 tls13_server_finished_send(struct tls13_ctx *ctx, CBB *cbb)
884 {
885 struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
886- struct tls13_secret context = { .data = "", .len = 0 };
887+ struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
888 struct tls13_secret finished_key = { .data = NULL, .len = 0 } ;
889 uint8_t transcript_hash[EVP_MAX_MD_SIZE];
890 size_t transcript_hash_len;
891@@ -840,7 +840,7 @@ int
892 tls13_server_finished_sent(struct tls13_ctx *ctx)
893 {
894 struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
895- struct tls13_secret context = { .data = "", .len = 0 };
896+ struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
897
898 /*
899 * Derive application traffic keys.
900@@ -959,7 +959,7 @@ tls13_client_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs)
901 sizeof(tls13_cert_verify_pad)))
902 goto err;
903 if (!CBB_add_bytes(&cbb, tls13_cert_client_verify_context,
904- strlen(tls13_cert_client_verify_context)))
905+ strlen((char *)tls13_cert_client_verify_context)))
906 goto err;
907 if (!CBB_add_u8(&cbb, 0))
908 goto err;
909@@ -1020,7 +1020,7 @@ int
910 tls13_client_finished_recv(struct tls13_ctx *ctx, CBS *cbs)
911 {
912 struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
913- struct tls13_secret context = { .data = "", .len = 0 };
914+ struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
915 struct tls13_secret finished_key;
916 uint8_t *verify_data = NULL;
917 size_t verify_data_len;
918--
9192.49.0
920
