if (sk_SSL_CIPHER_num(cipherstack) == 0) { SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH); sk_SSL_CIPHER_free(cipherstack); return NULL; }
STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,		STACK_OF(SSL_CIPHER) **cipher_list,		STACK_OF(SSL_CIPHER) **cipher_list_by_id,		const char *rule_str)	{	int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;	unsigned long disabled_mask;	STACK_OF(SSL_CIPHER) *cipherstack;	const char *rule_p;	CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;	SSL_CIPHER **ca_list = NULL;	/*	 * Return with error if nothing to do.	 */	if (rule_str == NULL) return(NULL);	if (init_ciphers)		{		CRYPTO_w_lock(CRYPTO_LOCK_SSL);		if (init_ciphers) load_ciphers();		CRYPTO_w_unlock(CRYPTO_LOCK_SSL);		}	/*	 * To reduce the work to do we only want to process the compiled	 * in algorithms, so we first get the mask of disabled ciphers.	 */	disabled_mask = ssl_cipher_get_disabled();	/*	 * Now we have to collect the available ciphers from the compiled	 * in ciphers. We cannot get more than the number compiled in, so	 * it is used for allocation.	 */	num_of_ciphers = ssl_method->num_ciphers();#ifdef KSSL_DEBUG	printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers);#endif    /* KSSL_DEBUG */	co_list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);	if (co_list == NULL)		{		SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);		return(NULL);	/* Failure */		}	ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, disabled_mask,				   co_list, &head, &tail);	/*	 * We also need cipher aliases for selecting based on the rule_str.	 * There might be two types of entries in the rule_str: 1) names	 * of ciphers themselves 2) aliases for groups of ciphers.	 * For 1) we need the available ciphers and for 2) the cipher	 * groups of cipher_aliases added together in one list (otherwise	 * we would be happy with just the cipher_aliases table).	 */	num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);	num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;	ca_list =		(SSL_CIPHER **)OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);	if (ca_list == NULL)		{		OPENSSL_free(co_list);		SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);		return(NULL);	/* Failure */		}	ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, disabled_mask,				   head);	/*	 * If the rule_string begins with DEFAULT, apply the default rule	 * before using the (possibly available) additional rules.	 */	ok = 1;	rule_p = rule_str;	if (strncmp(rule_str,"DEFAULT",7) == 0)		{		ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,			co_list, &head, &tail, ca_list);		rule_p += 7;		if (*rule_p == ':')			rule_p++;		}	if (ok && (strlen(rule_p) > 0))		ok = ssl_cipher_process_rulestr(rule_p, co_list, &head, &tail,						ca_list);	OPENSSL_free(ca_list);	/* Not needed anymore */	if (!ok)		{	/* Rule processing failure */		OPENSSL_free(co_list);		return(NULL);		}	/*	 * Allocate new "cipherstack" for the result, return with error	 * if we cannot get one.	 */	if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL)		{		OPENSSL_free(co_list);		return(NULL);		}	/*	 * The cipher selection for the list is done. The ciphers are added	 * to the resulting precedence to the STACK_OF(SSL_CIPHER).	 */	for (curr = head; curr != NULL; curr = curr->next)		{		if (curr->active)			{			sk_SSL_CIPHER_push(cipherstack, curr->cipher);#ifdef CIPHER_DEBUG			printf("<%s>\n",curr->cipher->name);#endif			}		}	OPENSSL_free(co_list);	/* Not needed any longer */	/*	 * The following passage is a little bit odd. If pointer variables	 * were supplied to hold STACK_OF(SSL_CIPHER) return information,	 * the old memory pointed to is free()ed. Then, however, the	 * cipher_list entry will be assigned just a copy of the returned	 * cipher stack. For cipher_list_by_id a copy of the cipher stack	 * will be created. See next comment...	 */	if (cipher_list != NULL)		{		if (*cipher_list != NULL)			sk_SSL_CIPHER_free(*cipher_list);		*cipher_list = cipherstack;		}	if (cipher_list_by_id != NULL)		{		if (*cipher_list_by_id != NULL)			sk_SSL_CIPHER_free(*cipher_list_by_id);		*cipher_list_by_id = sk_SSL_CIPHER_dup(cipherstack);		}	/*	 * Now it is getting really strange. If something failed during	 * the previous pointer assignment or if one of the pointers was	 * not requested, the error condition is met. That might be	 * discussable. The strange thing is however that in this case	 * the memory "ret" pointed to is "free()ed" and hence the pointer	 * cipher_list becomes wild. The memory reserved for	 * cipher_list_by_id however is not "free()ed" and stays intact.	 */	if (	(cipher_list_by_id == NULL) ||		(*cipher_list_by_id == NULL) ||		(cipher_list == NULL) ||		(*cipher_list == NULL))		{		sk_SSL_CIPHER_free(cipherstack);		return(NULL);		}	sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);	return(cipherstack);	}