/src/openssl41/crypto/cmp/cmp_status.c

Source
/*
 * Copyright 2007-2026 The OpenSSL Project Authors. All Rights Reserved.
 * Copyright Nokia 2007-2019
 * Copyright Siemens AG 2015-2019
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

/* CMP functions for PKIStatusInfo handling and PKIMessage decomposition */

#include <stdio.h>

#include "cmp_local.h"

/* CMP functions related to PKIStatus */

int ossl_cmp_pkisi_get_status(const OSSL_CMP_PKISI *si)
{
    int res;

    if (!ossl_assert(si != NULL && si->status != NULL))
        return -1;
    res = ossl_cmp_asn1_get_int(si->status);
    return res == -2 ? -1 : res;
}

const char *ossl_cmp_PKIStatus_to_string(int status)
{
    switch (status) {
    case OSSL_CMP_PKISTATUS_accepted:
        return "PKIStatus: accepted";
    case OSSL_CMP_PKISTATUS_grantedWithMods:
        return "PKIStatus: granted with modifications";
    case OSSL_CMP_PKISTATUS_rejection:
        return "PKIStatus: rejection";
    case OSSL_CMP_PKISTATUS_waiting:
        return "PKIStatus: waiting";
    case OSSL_CMP_PKISTATUS_revocationWarning:
        return "PKIStatus: revocation warning - a revocation of the cert is imminent";
    case OSSL_CMP_PKISTATUS_revocationNotification:
        return "PKIStatus: revocation notification - a revocation of the cert has occurred";
    case OSSL_CMP_PKISTATUS_keyUpdateWarning:
        return "PKIStatus: key update warning - update already done for the cert";
    default:
        ERR_raise_data(ERR_LIB_CMP, CMP_R_ERROR_PARSING_PKISTATUS,
            "PKIStatus: invalid=%d", status);
        return NULL;
    }
}

OSSL_CMP_PKIFREETEXT *ossl_cmp_pkisi_get0_statusString(const OSSL_CMP_PKISI *si)
{
    if (!ossl_assert(si != NULL))
        return NULL;
    return si->statusString;
}

int ossl_cmp_pkisi_get_pkifailureinfo(const OSSL_CMP_PKISI *si)
{
    int i;
    int res = 0;

    if (!ossl_assert(si != NULL))
        return -1;
    if (si->failInfo != NULL)
        for (i = 0; i <= OSSL_CMP_PKIFAILUREINFO_MAX; i++)
            if (ASN1_BIT_STRING_get_bit(si->failInfo, i))
                res |= 1 << i;
    return res;
}

/*-
 * convert PKIFailureInfo number to human-readable string
 * returns pointer to static string, or NULL on error
 */
static const char *CMP_PKIFAILUREINFO_to_string(int number)
{
    switch (number) {
    case OSSL_CMP_PKIFAILUREINFO_badAlg:
        return "badAlg";
    case OSSL_CMP_PKIFAILUREINFO_badMessageCheck:
        return "badMessageCheck";
    case OSSL_CMP_PKIFAILUREINFO_badRequest:
        return "badRequest";
    case OSSL_CMP_PKIFAILUREINFO_badTime:
        return "badTime";
    case OSSL_CMP_PKIFAILUREINFO_badCertId:
        return "badCertId";
    case OSSL_CMP_PKIFAILUREINFO_badDataFormat:
        return "badDataFormat";
    case OSSL_CMP_PKIFAILUREINFO_wrongAuthority:
        return "wrongAuthority";
    case OSSL_CMP_PKIFAILUREINFO_incorrectData:
        return "incorrectData";
    case OSSL_CMP_PKIFAILUREINFO_missingTimeStamp:
        return "missingTimeStamp";
    case OSSL_CMP_PKIFAILUREINFO_badPOP:
        return "badPOP";
    case OSSL_CMP_PKIFAILUREINFO_certRevoked:
        return "certRevoked";
    case OSSL_CMP_PKIFAILUREINFO_certConfirmed:
        return "certConfirmed";
    case OSSL_CMP_PKIFAILUREINFO_wrongIntegrity:
        return "wrongIntegrity";
    case OSSL_CMP_PKIFAILUREINFO_badRecipientNonce:
        return "badRecipientNonce";
    case OSSL_CMP_PKIFAILUREINFO_timeNotAvailable:
        return "timeNotAvailable";
    case OSSL_CMP_PKIFAILUREINFO_unacceptedPolicy:
        return "unacceptedPolicy";
    case OSSL_CMP_PKIFAILUREINFO_unacceptedExtension:
        return "unacceptedExtension";
    case OSSL_CMP_PKIFAILUREINFO_addInfoNotAvailable:
        return "addInfoNotAvailable";
    case OSSL_CMP_PKIFAILUREINFO_badSenderNonce:
        return "badSenderNonce";
    case OSSL_CMP_PKIFAILUREINFO_badCertTemplate:
        return "badCertTemplate";
    case OSSL_CMP_PKIFAILUREINFO_signerNotTrusted:
        return "signerNotTrusted";
    case OSSL_CMP_PKIFAILUREINFO_transactionIdInUse:
        return "transactionIdInUse";
    case OSSL_CMP_PKIFAILUREINFO_unsupportedVersion:
        return "unsupportedVersion";
    case OSSL_CMP_PKIFAILUREINFO_notAuthorized:
        return "notAuthorized";
    case OSSL_CMP_PKIFAILUREINFO_systemUnavail:
        return "systemUnavail";
    case OSSL_CMP_PKIFAILUREINFO_systemFailure:
        return "systemFailure";
    case OSSL_CMP_PKIFAILUREINFO_duplicateCertReq:
        return "duplicateCertReq";
    default:
        return NULL; /* illegal failure number */
    }
}

int ossl_cmp_pkisi_check_pkifailureinfo(const OSSL_CMP_PKISI *si, int bit_index)
{
    if (!ossl_assert(si != NULL && si->failInfo != NULL))
        return -1;
    if (bit_index < 0 || bit_index > OSSL_CMP_PKIFAILUREINFO_MAX) {
        ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
        return -1;
    }

    return ASN1_BIT_STRING_get_bit(si->failInfo, bit_index);
}

/*-
 * place human-readable error string created from PKIStatusInfo in given buffer
 * returns pointer to the same buffer containing the string, or NULL on error
 */
static char *snprint_PKIStatusInfo_parts(int status, int fail_info,
    const OSSL_CMP_PKIFREETEXT *status_strings,
    char *buf, size_t bufsize)
{
    int failure;
    const char *status_string, *failure_string;
    ASN1_UTF8STRING *text;
    int i;
    int printed_chars;
    int failinfo_found = 0;
    int n_status_strings;
    char *write_ptr = buf;

    if (buf == NULL
        || status < 0
        || (status_string = ossl_cmp_PKIStatus_to_string(status)) == NULL)
        return NULL;

#define ADVANCE_BUFFER                                         \
    if (printed_chars < 0 || (size_t)printed_chars >= bufsize) \
        return NULL;                                           \
    write_ptr += printed_chars;                                \
    bufsize -= printed_chars;

    printed_chars = snprintf(write_ptr, bufsize, "%s", status_string);
    ADVANCE_BUFFER;

    /*
     * failInfo is optional and may be empty;
     * if present, print failInfo before statusString because it is more concise
     */
    if (fail_info != -1 && fail_info != 0) {
        printed_chars = snprintf(write_ptr, bufsize, "; PKIFailureInfo: ");
        ADVANCE_BUFFER;
        for (failure = 0; failure <= OSSL_CMP_PKIFAILUREINFO_MAX; failure++) {
            if ((fail_info & (1 << failure)) != 0) {
                failure_string = CMP_PKIFAILUREINFO_to_string(failure);
                if (failure_string != NULL) {
                    printed_chars = snprintf(write_ptr, bufsize, "%s%s",
                        failinfo_found ? ", " : "",
                        failure_string);
                    ADVANCE_BUFFER;
                    failinfo_found = 1;
                }
            }
        }
    }
    if (!failinfo_found && status != OSSL_CMP_PKISTATUS_accepted
        && status != OSSL_CMP_PKISTATUS_grantedWithMods) {
        printed_chars = snprintf(write_ptr, bufsize, "; <no failure info>");
        ADVANCE_BUFFER;
    }

    /* statusString sequence is optional and may be empty */
    n_status_strings = sk_ASN1_UTF8STRING_num(status_strings);
    if (n_status_strings > 0) {
        printed_chars = snprintf(write_ptr, bufsize, "; StatusString%s: ",
            n_status_strings > 1 ? "s" : "");
        ADVANCE_BUFFER;
        for (i = 0; i < n_status_strings; i++) {
            text = sk_ASN1_UTF8STRING_value(status_strings, i);
            printed_chars = snprintf(write_ptr, bufsize, "\"%.*s\"%s",
                (int)ASN1_STRING_get_length(text),
                ASN1_STRING_get_length(text) ? ASN1_STRING_get0_data(text)
                                             : (const unsigned char *)"",
                i < n_status_strings - 1 ? ", " : "");
            ADVANCE_BUFFER;
        }
    }
#undef ADVANCE_BUFFER
    return buf;
}

char *OSSL_CMP_snprint_PKIStatusInfo(const OSSL_CMP_PKISI *statusInfo,
    char *buf, size_t bufsize)
{
    int failure_info;

    if (statusInfo == NULL) {
        ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
        return NULL;
    }

    failure_info = ossl_cmp_pkisi_get_pkifailureinfo(statusInfo);

    return snprint_PKIStatusInfo_parts(ASN1_INTEGER_get(statusInfo->status),
        failure_info,
        statusInfo->statusString, buf, bufsize);
}

char *OSSL_CMP_CTX_snprint_PKIStatus(const OSSL_CMP_CTX *ctx, char *buf,
    size_t bufsize)
{
    if (ctx == NULL) {
        ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
        return NULL;
    }

    return snprint_PKIStatusInfo_parts(OSSL_CMP_CTX_get_status(ctx),
        OSSL_CMP_CTX_get_failInfoCode(ctx),
        OSSL_CMP_CTX_get0_statusString(ctx),
        buf, bufsize);
}

/*-
 * Creates a new PKIStatusInfo structure and fills it in
 * returns a pointer to the structure on success, NULL on error
 * note: strongly overlaps with TS_RESP_CTX_set_status_info()
 * and TS_RESP_CTX_add_failure_info() in ../ts/ts_rsp_sign.c
 */
OSSL_CMP_PKISI *OSSL_CMP_STATUSINFO_new(int status, int fail_info,
    const char *text)
{
    OSSL_CMP_PKISI *si = OSSL_CMP_PKISI_new();
    ASN1_UTF8STRING *utf8_text = NULL;
    int failure;

    if (si == NULL)
        goto err;
    if (!ASN1_INTEGER_set(si->status, status))
        goto err;

    if (text != NULL) {
        if ((utf8_text = ASN1_UTF8STRING_new()) == NULL
            || !ASN1_STRING_set1_string(utf8_text, text))
            goto err;
        if ((si->statusString = sk_ASN1_UTF8STRING_new_null()) == NULL)
            goto err;
        if (!sk_ASN1_UTF8STRING_push(si->statusString, utf8_text))
            goto err;
        /* Ownership is lost. */
        utf8_text = NULL;
    }

    for (failure = 0; failure <= OSSL_CMP_PKIFAILUREINFO_MAX; failure++) {
        if ((fail_info & (1 << failure)) != 0) {
            if (si->failInfo == NULL
                && (si->failInfo = ASN1_BIT_STRING_new()) == NULL)
                goto err;
            if (!ASN1_BIT_STRING_set_bit(si->failInfo, failure, 1))
                goto err;
        }
    }
    return si;

err:
    OSSL_CMP_PKISI_free(si);
    ASN1_UTF8STRING_free(utf8_text);
    return NULL;
}

Coverage Report

Created: 2026-09-12 06:55

Line	Count	Source
1		/*
2		* Copyright 2007-2026 The OpenSSL Project Authors. All Rights Reserved.
3		* Copyright Nokia 2007-2019
4		* Copyright Siemens AG 2015-2019
5		*
6		* Licensed under the Apache License 2.0 (the "License"). You may not use
7		* this file except in compliance with the License. You can obtain a copy
8		* in the file LICENSE in the source distribution or at
9		* https://www.openssl.org/source/license.html
10		*/
11
12		/* CMP functions for PKIStatusInfo handling and PKIMessage decomposition */
13
14		#include <stdio.h>
15
16		#include "cmp_local.h"
17
18		/* CMP functions related to PKIStatus */
19
20		int ossl_cmp_pkisi_get_status(const OSSL_CMP_PKISI *si)
21	0	{
22	0	int res;
23
24	0	if (!ossl_assert(si != NULL && si->status != NULL))
25	0	return -1;
26	0	res = ossl_cmp_asn1_get_int(si->status);
27	0	return res == -2 ? -1 : res;
28	0	}
29
30		const char *ossl_cmp_PKIStatus_to_string(int status)
31	0	{
32	0	switch (status) {
33	0	case OSSL_CMP_PKISTATUS_accepted:
34	0	return "PKIStatus: accepted";
35	0	case OSSL_CMP_PKISTATUS_grantedWithMods:
36	0	return "PKIStatus: granted with modifications";
37	0	case OSSL_CMP_PKISTATUS_rejection:
38	0	return "PKIStatus: rejection";
39	0	case OSSL_CMP_PKISTATUS_waiting:
40	0	return "PKIStatus: waiting";
41	0	case OSSL_CMP_PKISTATUS_revocationWarning:
42	0	return "PKIStatus: revocation warning - a revocation of the cert is imminent";
43	0	case OSSL_CMP_PKISTATUS_revocationNotification:
44	0	return "PKIStatus: revocation notification - a revocation of the cert has occurred";
45	0	case OSSL_CMP_PKISTATUS_keyUpdateWarning:
46	0	return "PKIStatus: key update warning - update already done for the cert";
47	0	default:
48	0	ERR_raise_data(ERR_LIB_CMP, CMP_R_ERROR_PARSING_PKISTATUS,
49	0	"PKIStatus: invalid=%d", status);
50	0	return NULL;
51	0	}
52	0	}
53
54		OSSL_CMP_PKIFREETEXT ossl_cmp_pkisi_get0_statusString(const OSSL_CMP_PKISI si)
55	0	{
56	0	if (!ossl_assert(si != NULL))
57	0	return NULL;
58	0	return si->statusString;
59	0	}
60
61		int ossl_cmp_pkisi_get_pkifailureinfo(const OSSL_CMP_PKISI *si)
62	0	{
63	0	int i;
64	0	int res = 0;
65
66	0	if (!ossl_assert(si != NULL))
67	0	return -1;
68	0	if (si->failInfo != NULL)
69	0	for (i = 0; i <= OSSL_CMP_PKIFAILUREINFO_MAX; i++)
70	0	if (ASN1_BIT_STRING_get_bit(si->failInfo, i))
71	0	res \|= 1 << i;
72	0	return res;
73	0	}
74
75		/*-
76		* convert PKIFailureInfo number to human-readable string
77		* returns pointer to static string, or NULL on error
78		*/
79		static const char *CMP_PKIFAILUREINFO_to_string(int number)
80	0	{
81	0	switch (number) {
82	0	case OSSL_CMP_PKIFAILUREINFO_badAlg:
83	0	return "badAlg";
84	0	case OSSL_CMP_PKIFAILUREINFO_badMessageCheck:
85	0	return "badMessageCheck";
86	0	case OSSL_CMP_PKIFAILUREINFO_badRequest:
87	0	return "badRequest";
88	0	case OSSL_CMP_PKIFAILUREINFO_badTime:
89	0	return "badTime";
90	0	case OSSL_CMP_PKIFAILUREINFO_badCertId:
91	0	return "badCertId";
92	0	case OSSL_CMP_PKIFAILUREINFO_badDataFormat:
93	0	return "badDataFormat";
94	0	case OSSL_CMP_PKIFAILUREINFO_wrongAuthority:
95	0	return "wrongAuthority";
96	0	case OSSL_CMP_PKIFAILUREINFO_incorrectData:
97	0	return "incorrectData";
98	0	case OSSL_CMP_PKIFAILUREINFO_missingTimeStamp:
99	0	return "missingTimeStamp";
100	0	case OSSL_CMP_PKIFAILUREINFO_badPOP:
101	0	return "badPOP";
102	0	case OSSL_CMP_PKIFAILUREINFO_certRevoked:
103	0	return "certRevoked";
104	0	case OSSL_CMP_PKIFAILUREINFO_certConfirmed:
105	0	return "certConfirmed";
106	0	case OSSL_CMP_PKIFAILUREINFO_wrongIntegrity:
107	0	return "wrongIntegrity";
108	0	case OSSL_CMP_PKIFAILUREINFO_badRecipientNonce:
109	0	return "badRecipientNonce";
110	0	case OSSL_CMP_PKIFAILUREINFO_timeNotAvailable:
111	0	return "timeNotAvailable";
112	0	case OSSL_CMP_PKIFAILUREINFO_unacceptedPolicy:
113	0	return "unacceptedPolicy";
114	0	case OSSL_CMP_PKIFAILUREINFO_unacceptedExtension:
115	0	return "unacceptedExtension";
116	0	case OSSL_CMP_PKIFAILUREINFO_addInfoNotAvailable:
117	0	return "addInfoNotAvailable";
118	0	case OSSL_CMP_PKIFAILUREINFO_badSenderNonce:
119	0	return "badSenderNonce";
120	0	case OSSL_CMP_PKIFAILUREINFO_badCertTemplate:
121	0	return "badCertTemplate";
122	0	case OSSL_CMP_PKIFAILUREINFO_signerNotTrusted:
123	0	return "signerNotTrusted";
124	0	case OSSL_CMP_PKIFAILUREINFO_transactionIdInUse:
125	0	return "transactionIdInUse";
126	0	case OSSL_CMP_PKIFAILUREINFO_unsupportedVersion:
127	0	return "unsupportedVersion";
128	0	case OSSL_CMP_PKIFAILUREINFO_notAuthorized:
129	0	return "notAuthorized";
130	0	case OSSL_CMP_PKIFAILUREINFO_systemUnavail:
131	0	return "systemUnavail";
132	0	case OSSL_CMP_PKIFAILUREINFO_systemFailure:
133	0	return "systemFailure";
134	0	case OSSL_CMP_PKIFAILUREINFO_duplicateCertReq:
135	0	return "duplicateCertReq";
136	0	default:
137	0	return NULL; /* illegal failure number */
138	0	}
139	0	}
140
141		int ossl_cmp_pkisi_check_pkifailureinfo(const OSSL_CMP_PKISI *si, int bit_index)
142	0	{
143	0	if (!ossl_assert(si != NULL && si->failInfo != NULL))
144	0	return -1;
145	0	if (bit_index < 0 \|\| bit_index > OSSL_CMP_PKIFAILUREINFO_MAX) {
146	0	ERR_raise(ERR_LIB_CMP, CMP_R_INVALID_ARGS);
147	0	return -1;
148	0	}
149
150	0	return ASN1_BIT_STRING_get_bit(si->failInfo, bit_index);
151	0	}
152
153		/*-
154		* place human-readable error string created from PKIStatusInfo in given buffer
155		* returns pointer to the same buffer containing the string, or NULL on error
156		*/
157		static char *snprint_PKIStatusInfo_parts(int status, int fail_info,
158		const OSSL_CMP_PKIFREETEXT *status_strings,
159		char *buf, size_t bufsize)
160	0	{
161	0	int failure;
162	0	const char status_string, failure_string;
163	0	ASN1_UTF8STRING *text;
164	0	int i;
165	0	int printed_chars;
166	0	int failinfo_found = 0;
167	0	int n_status_strings;
168	0	char *write_ptr = buf;
169
170	0	if (buf == NULL
171	0	\|\| status < 0
172	0	\|\| (status_string = ossl_cmp_PKIStatus_to_string(status)) == NULL)
173	0	return NULL;
174
175	0	#define ADVANCE_BUFFER \
176	0	if (printed_chars < 0 \|\| (size_t)printed_chars >= bufsize) \
177	0	return NULL; \
178	0	write_ptr += printed_chars; \
179	0	bufsize -= printed_chars;
180
181	0	printed_chars = snprintf(write_ptr, bufsize, "%s", status_string);
182	0	ADVANCE_BUFFER;
183
184		/*
185		* failInfo is optional and may be empty;
186		* if present, print failInfo before statusString because it is more concise
187		*/
188	0	if (fail_info != -1 && fail_info != 0) {
189	0	printed_chars = snprintf(write_ptr, bufsize, "; PKIFailureInfo: ");
190	0	ADVANCE_BUFFER;
191	0	for (failure = 0; failure <= OSSL_CMP_PKIFAILUREINFO_MAX; failure++) {
192	0	if ((fail_info & (1 << failure)) != 0) {
193	0	failure_string = CMP_PKIFAILUREINFO_to_string(failure);
194	0	if (failure_string != NULL) {
195	0	printed_chars = snprintf(write_ptr, bufsize, "%s%s",
196	0	failinfo_found ? ", " : "",
197	0	failure_string);
198	0	ADVANCE_BUFFER;
199	0	failinfo_found = 1;
200	0	}
201	0	}
202	0	}
203	0	}
204	0	if (!failinfo_found && status != OSSL_CMP_PKISTATUS_accepted
205	0	&& status != OSSL_CMP_PKISTATUS_grantedWithMods) {
206	0	printed_chars = snprintf(write_ptr, bufsize, "; <no failure info>");
207	0	ADVANCE_BUFFER;
208	0	}
209
210		/* statusString sequence is optional and may be empty */
211	0	n_status_strings = sk_ASN1_UTF8STRING_num(status_strings);
212	0	if (n_status_strings > 0) {
213	0	printed_chars = snprintf(write_ptr, bufsize, "; StatusString%s: ",
214	0	n_status_strings > 1 ? "s" : "");
215	0	ADVANCE_BUFFER;
216	0	for (i = 0; i < n_status_strings; i++) {
217	0	text = sk_ASN1_UTF8STRING_value(status_strings, i);
218	0	printed_chars = snprintf(write_ptr, bufsize, "\"%.*s\"%s",
219	0	(int)ASN1_STRING_get_length(text),
220	0	ASN1_STRING_get_length(text) ? ASN1_STRING_get0_data(text)
221	0	: (const unsigned char *)"",
222	0	i < n_status_strings - 1 ? ", " : "");
223	0	ADVANCE_BUFFER;
224	0	}
225	0	}
226	0	#undef ADVANCE_BUFFER
227	0	return buf;
228	0	}
229
230		char OSSL_CMP_snprint_PKIStatusInfo(const OSSL_CMP_PKISI statusInfo,
231		char *buf, size_t bufsize)
232	0	{
233	0	int failure_info;
234
235	0	if (statusInfo == NULL) {
236	0	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
237	0	return NULL;
238	0	}
239
240	0	failure_info = ossl_cmp_pkisi_get_pkifailureinfo(statusInfo);
241
242	0	return snprint_PKIStatusInfo_parts(ASN1_INTEGER_get(statusInfo->status),
243	0	failure_info,
244	0	statusInfo->statusString, buf, bufsize);
245	0	}
246
247		char OSSL_CMP_CTX_snprint_PKIStatus(const OSSL_CMP_CTX ctx, char *buf,
248		size_t bufsize)
249	0	{
250	0	if (ctx == NULL) {
251	0	ERR_raise(ERR_LIB_CMP, CMP_R_NULL_ARGUMENT);
252	0	return NULL;
253	0	}
254
255	0	return snprint_PKIStatusInfo_parts(OSSL_CMP_CTX_get_status(ctx),
256	0	OSSL_CMP_CTX_get_failInfoCode(ctx),
257	0	OSSL_CMP_CTX_get0_statusString(ctx),
258	0	buf, bufsize);
259	0	}
260
261		/*-
262		* Creates a new PKIStatusInfo structure and fills it in
263		* returns a pointer to the structure on success, NULL on error
264		* note: strongly overlaps with TS_RESP_CTX_set_status_info()
265		* and TS_RESP_CTX_add_failure_info() in ../ts/ts_rsp_sign.c
266		*/
267		OSSL_CMP_PKISI *OSSL_CMP_STATUSINFO_new(int status, int fail_info,
268		const char *text)
269	30.4k	{
270	30.4k	OSSL_CMP_PKISI *si = OSSL_CMP_PKISI_new();
271	30.4k	ASN1_UTF8STRING *utf8_text = NULL;
272	30.4k	int failure;
273
274	30.4k	if (si == NULL)
275	0	goto err;
276	30.4k	if (!ASN1_INTEGER_set(si->status, status))
277	0	goto err;
278
279	30.4k	if (text != NULL) {
280	30.4k	if ((utf8_text = ASN1_UTF8STRING_new()) == NULL
281	30.4k	\|\| !ASN1_STRING_set1_string(utf8_text, text))
282	0	goto err;
283	30.4k	if ((si->statusString = sk_ASN1_UTF8STRING_new_null()) == NULL)
284	0	goto err;
285	30.4k	if (!sk_ASN1_UTF8STRING_push(si->statusString, utf8_text))
286	0	goto err;
287		/* Ownership is lost. */
288	30.4k	utf8_text = NULL;
289	30.4k	}
290
291	853k	for (failure = 0; failure <= OSSL_CMP_PKIFAILUREINFO_MAX; failure++) {
292	822k	if ((fail_info & (1 << failure)) != 0) {
293	30.4k	if (si->failInfo == NULL
294	30.4k	&& (si->failInfo = ASN1_BIT_STRING_new()) == NULL)
295	0	goto err;
296	30.4k	if (!ASN1_BIT_STRING_set_bit(si->failInfo, failure, 1))
297	0	goto err;
298	30.4k	}
299	822k	}
300	30.4k	return si;
301
302	0	err:
303	0	OSSL_CMP_PKISI_free(si);
304	0	ASN1_UTF8STRING_free(utf8_text);
305		return NULL;
306	30.4k	}