sk_*_push() returns the number of items on the stack, not the index of the

pushed item.  The index is the number of items - 1.  And if a NULL item was
found, actually use it.
Finally, provide a little bit of safety in CRYPTO_lock() by asserting the a
requested dynamic lock really must exist, instead of just being silent about it

1 files changed, 13 insertions, 3 deletions

diff --git a/crypto/cryptlib.c b/crypto/cryptlib.c
index 38e2a53394..830ccc9816 100644
--- a/crypto/cryptlib.c
+++ b/crypto/cryptlib.c
@@ -269,10 +269,18 @@ int CRYPTO_get_new_dynlockid(void)
 	i=sk_CRYPTO_dynlock_find(dyn_locks,NULL);
 	/* If there was none, push, thereby creating a new one */
 	if (i == -1)
-		i=sk_CRYPTO_dynlock_push(dyn_locks,pointer);
+		/* Since sk_push() returns the number of items on the
+		   stack, not the location of the pushed item, we need
+		   to transform the returned number into a position,
+		   by decreasing it.  */
+		i=sk_CRYPTO_dynlock_push(dyn_locks,pointer) - 1;
+	else
+		/* If we found a place with a NULL pointer, put our pointer
+		   in it.  */
+		sk_CRYPTO_dynlock_set(dyn_locks,i,pointer);
 	CRYPTO_w_unlock(CRYPTO_LOCK_DYNLOCK);
 
-	if (!i)
+	if (i == -1)
 		{
 		dynlock_destroy_callback(pointer->data,__FILE__,__LINE__);
 		OPENSSL_free(pointer);
@@ -467,7 +475,9 @@ void CRYPTO_lock(int mode, int type, const char *file, int line)
 		struct CRYPTO_dynlock_value *pointer
 			= CRYPTO_get_dynlock_value(type);
 
-		if (pointer && dynlock_lock_callback)
+		OPENSSL_assert(pointer != NULL);
+
+		if (dynlock_lock_callback)
 			{
 			dynlock_lock_callback(mode, pointer, file, line);
 			}