Embed X509_CINF

Reviewed-by: Rich Salz <rsalz@openssl.org>

12 files changed, 82 insertions, 90 deletions

diff --git a/crypto/asn1/t_x509.c b/crypto/asn1/t_x509.c
index 12a9ed4940..cebf441363 100644
--- a/crypto/asn1/t_x509.c
+++ b/crypto/asn1/t_x509.c
@@ -122,7 +122,7 @@ int X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags,
     if (nmflags == X509_FLAG_COMPAT)
         nmindent = 16;
 
-    ci = x->cert_info;
+    ci = &x->cert_info;
     if (!(cflag & X509_FLAG_NO_HEADER)) {
         if (BIO_write(bp, "Certificate:\n", 13) <= 0)
             goto err;
@@ -272,10 +272,10 @@ int X509_ocspid_print(BIO *bp, X509 *x)
      */
     if (BIO_printf(bp, "        Subject OCSP hash: ") <= 0)
         goto err;
-    derlen = i2d_X509_NAME(x->cert_info->subject, NULL);
+    derlen = i2d_X509_NAME(x->cert_info.subject, NULL);
     if ((der = dertmp = OPENSSL_malloc(derlen)) == NULL)
         goto err;
-    i2d_X509_NAME(x->cert_info->subject, &dertmp);
+    i2d_X509_NAME(x->cert_info.subject, &dertmp);
 
     if (!EVP_Digest(der, derlen, SHA1md, NULL, EVP_sha1(), NULL))
         goto err;
@@ -292,8 +292,8 @@ int X509_ocspid_print(BIO *bp, X509 *x)
     if (BIO_printf(bp, "\n        Public key OCSP hash: ") <= 0)
         goto err;
 
-    if (!EVP_Digest(x->cert_info->key->public_key->data,
-                    x->cert_info->key->public_key->length,
+    if (!EVP_Digest(x->cert_info.key->public_key->data,
+                    x->cert_info.key->public_key->length,
                     SHA1md, NULL, EVP_sha1(), NULL))
         goto err;
     for (i = 0; i < SHA_DIGEST_LENGTH; i++) {
diff --git a/crypto/asn1/x_x509.c b/crypto/asn1/x_x509.c
index c276874e69..76dfa35796 100644
--- a/crypto/asn1/x_x509.c
+++ b/crypto/asn1/x_x509.c
@@ -106,7 +106,7 @@ static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
 
     case ASN1_OP_D2I_POST:
         OPENSSL_free(ret->name);
-        ret->name = X509_NAME_oneline(ret->cert_info->subject, NULL, 0);
+        ret->name = X509_NAME_oneline(ret->cert_info.subject, NULL, 0);
         break;
 
     case ASN1_OP_FREE_POST:
@@ -132,7 +132,7 @@ static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
 }
 
 ASN1_SEQUENCE_ref(X509, x509_cb, CRYPTO_LOCK_X509) = {
-        ASN1_SIMPLE(X509, cert_info, X509_CINF),
+        ASN1_EMBED(X509, cert_info, X509_CINF),
         ASN1_SIMPLE(X509, sig_alg, X509_ALGOR),
         ASN1_SIMPLE(X509, signature, ASN1_BIT_STRING)
 } ASN1_SEQUENCE_END_ref(X509, X509)
@@ -209,8 +209,8 @@ int i2d_X509_AUX(X509 *a, unsigned char **pp)
 
 int i2d_re_X509_tbs(X509 *x, unsigned char **pp)
 {
-    x->cert_info->enc.modified = 1;
-    return i2d_X509_CINF(x->cert_info, pp);
+    x->cert_info.enc.modified = 1;
+    return i2d_X509_CINF(&x->cert_info, pp);
 }
 
 void X509_get0_signature(ASN1_BIT_STRING **psig, X509_ALGOR **palg,
diff --git a/crypto/x509/by_dir.c b/crypto/x509/by_dir.c
index 5f423e0c4a..5241cad639 100644
--- a/crypto/x509/by_dir.c
+++ b/crypto/x509/by_dir.c
@@ -253,10 +253,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
 {
     BY_DIR *ctx;
     union {
-        struct {
-            X509 st_x509;
-            X509_CINF st_x509_cinf;
-        } x509;
+        X509 st_x509;
         X509_CRL crl;
     } data;
     int ok = 0;
@@ -271,9 +268,8 @@ static int get_cert_by_subject(X509_LOOKUP *xl, X509_LOOKUP_TYPE type,
 
     stmp.type = type;
     if (type == X509_LU_X509) {
-        data.x509.st_x509.cert_info = &data.x509.st_x509_cinf;
-        data.x509.st_x509_cinf.subject = name;
-        stmp.data.x509 = &data.x509.st_x509;
+        data.st_x509.cert_info.subject = name;
+        stmp.data.x509 = &data.st_x509;
         postfix = "";
     } else if (type == X509_LU_CRL) {
         data.crl.crl.issuer = name;
diff --git a/crypto/x509/x509_cmp.c b/crypto/x509/x509_cmp.c
index 1afc7f8dfa..6f8199b6b4 100644
--- a/crypto/x509/x509_cmp.c
+++ b/crypto/x509/x509_cmp.c
@@ -68,10 +68,10 @@
 int X509_issuer_and_serial_cmp(const X509 *a, const X509 *b)
 {
     int i;
-    X509_CINF *ai, *bi;
+    const X509_CINF *ai, *bi;
 
-    ai = a->cert_info;
-    bi = b->cert_info;
+    ai = &a->cert_info;
+    bi = &b->cert_info;
     i = ASN1_INTEGER_cmp(ai->serialNumber, bi->serialNumber);
     if (i)
         return (i);
@@ -87,15 +87,15 @@ unsigned long X509_issuer_and_serial_hash(X509 *a)
     char *f;
 
     EVP_MD_CTX_init(&ctx);
-    f = X509_NAME_oneline(a->cert_info->issuer, NULL, 0);
+    f = X509_NAME_oneline(a->cert_info.issuer, NULL, 0);
     if (!EVP_DigestInit_ex(&ctx, EVP_md5(), NULL))
         goto err;
     if (!EVP_DigestUpdate(&ctx, (unsigned char *)f, strlen(f)))
         goto err;
     OPENSSL_free(f);
     if (!EVP_DigestUpdate
-        (&ctx, (unsigned char *)a->cert_info->serialNumber->data,
-         (unsigned long)a->cert_info->serialNumber->length))
+        (&ctx, (unsigned char *)a->cert_info.serialNumber->data,
+         (unsigned long)a->cert_info.serialNumber->length))
         goto err;
     if (!EVP_DigestFinal_ex(&ctx, &(md[0]), NULL))
         goto err;
@@ -110,12 +110,12 @@ unsigned long X509_issuer_and_serial_hash(X509 *a)
 
 int X509_issuer_name_cmp(const X509 *a, const X509 *b)
 {
-    return (X509_NAME_cmp(a->cert_info->issuer, b->cert_info->issuer));
+    return (X509_NAME_cmp(a->cert_info.issuer, b->cert_info.issuer));
 }
 
 int X509_subject_name_cmp(const X509 *a, const X509 *b)
 {
-    return (X509_NAME_cmp(a->cert_info->subject, b->cert_info->subject));
+    return (X509_NAME_cmp(a->cert_info.subject, b->cert_info.subject));
 }
 
 int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b)
@@ -130,40 +130,40 @@ int X509_CRL_match(const X509_CRL *a, const X509_CRL *b)
 
 X509_NAME *X509_get_issuer_name(X509 *a)
 {
-    return (a->cert_info->issuer);
+    return (a->cert_info.issuer);
 }
 
 unsigned long X509_issuer_name_hash(X509 *x)
 {
-    return (X509_NAME_hash(x->cert_info->issuer));
+    return (X509_NAME_hash(x->cert_info.issuer));
 }
 
 #ifndef OPENSSL_NO_MD5
 unsigned long X509_issuer_name_hash_old(X509 *x)
 {
-    return (X509_NAME_hash_old(x->cert_info->issuer));
+    return (X509_NAME_hash_old(x->cert_info.issuer));
 }
 #endif
 
 X509_NAME *X509_get_subject_name(X509 *a)
 {
-    return (a->cert_info->subject);
+    return (a->cert_info.subject);
 }
 
 ASN1_INTEGER *X509_get_serialNumber(X509 *a)
 {
-    return (a->cert_info->serialNumber);
+    return (a->cert_info.serialNumber);
 }
 
 unsigned long X509_subject_name_hash(X509 *x)
 {
-    return (X509_NAME_hash(x->cert_info->subject));
+    return (X509_NAME_hash(x->cert_info.subject));
 }
 
 #ifndef OPENSSL_NO_MD5
 unsigned long X509_subject_name_hash_old(X509 *x)
 {
-    return (X509_NAME_hash_old(x->cert_info->subject));
+    return (X509_NAME_hash_old(x->cert_info.subject));
 }
 #endif
 
@@ -186,12 +186,12 @@ int X509_cmp(const X509 *a, const X509 *b)
     if (rv)
         return rv;
     /* Check for match against stored encoding too */
-    if (!a->cert_info->enc.modified && !b->cert_info->enc.modified) {
-        rv = (int)(a->cert_info->enc.len - b->cert_info->enc.len);
+    if (!a->cert_info.enc.modified && !b->cert_info.enc.modified) {
+        rv = (int)(a->cert_info.enc.len - b->cert_info.enc.len);
         if (rv)
             return rv;
-        return memcmp(a->cert_info->enc.enc, b->cert_info->enc.enc,
-                      a->cert_info->enc.len);
+        return memcmp(a->cert_info.enc.enc, b->cert_info.enc.enc,
+                      a->cert_info.enc.len);
     }
     return rv;
 }
@@ -273,15 +273,13 @@ X509 *X509_find_by_issuer_and_serial(STACK_OF(X509) *sk, X509_NAME *name,
                                      ASN1_INTEGER *serial)
 {
     int i;
-    X509_CINF cinf;
     X509 x, *x509 = NULL;
 
     if (!sk)
         return NULL;
 
-    x.cert_info = &cinf;
-    cinf.serialNumber = serial;
-    cinf.issuer = name;
+    x.cert_info.serialNumber = serial;
+    x.cert_info.issuer = name;
 
     for (i = 0; i < sk_X509_num(sk); i++) {
         x509 = sk_X509_value(sk, i);
@@ -306,16 +304,16 @@ X509 *X509_find_by_subject(STACK_OF(X509) *sk, X509_NAME *name)
 
 EVP_PKEY *X509_get_pubkey(X509 *x)
 {
-    if ((x == NULL) || (x->cert_info == NULL))
+    if (x == NULL)
         return (NULL);
-    return (X509_PUBKEY_get(x->cert_info->key));
+    return (X509_PUBKEY_get(x->cert_info.key));
 }
 
 ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x)
 {
     if (!x)
         return NULL;
-    return x->cert_info->key->public_key;
+    return x->cert_info.key->public_key;
 }
 
 int X509_check_private_key(X509 *x, EVP_PKEY *k)
diff --git a/crypto/x509/x509_ext.c b/crypto/x509/x509_ext.c
index 4437d8425f..5d951f66fa 100644
--- a/crypto/x509/x509_ext.c
+++ b/crypto/x509/x509_ext.c
@@ -114,49 +114,49 @@ int X509_CRL_add_ext(X509_CRL *x, X509_EXTENSION *ex, int loc)
 
 int X509_get_ext_count(X509 *x)
 {
-    return (X509v3_get_ext_count(x->cert_info->extensions));
+    return (X509v3_get_ext_count(x->cert_info.extensions));
 }
 
 int X509_get_ext_by_NID(X509 *x, int nid, int lastpos)
 {
-    return (X509v3_get_ext_by_NID(x->cert_info->extensions, nid, lastpos));
+    return (X509v3_get_ext_by_NID(x->cert_info.extensions, nid, lastpos));
 }
 
 int X509_get_ext_by_OBJ(X509 *x, ASN1_OBJECT *obj, int lastpos)
 {
-    return (X509v3_get_ext_by_OBJ(x->cert_info->extensions, obj, lastpos));
+    return (X509v3_get_ext_by_OBJ(x->cert_info.extensions, obj, lastpos));
 }
 
 int X509_get_ext_by_critical(X509 *x, int crit, int lastpos)
 {
     return (X509v3_get_ext_by_critical
-            (x->cert_info->extensions, crit, lastpos));
+            (x->cert_info.extensions, crit, lastpos));
 }
 
 X509_EXTENSION *X509_get_ext(X509 *x, int loc)
 {
-    return (X509v3_get_ext(x->cert_info->extensions, loc));
+    return (X509v3_get_ext(x->cert_info.extensions, loc));
 }
 
 X509_EXTENSION *X509_delete_ext(X509 *x, int loc)
 {
-    return (X509v3_delete_ext(x->cert_info->extensions, loc));
+    return (X509v3_delete_ext(x->cert_info.extensions, loc));
 }
 
 int X509_add_ext(X509 *x, X509_EXTENSION *ex, int loc)
 {
-    return (X509v3_add_ext(&(x->cert_info->extensions), ex, loc) != NULL);
+    return (X509v3_add_ext(&(x->cert_info.extensions), ex, loc) != NULL);
 }
 
 void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx)
 {
-    return X509V3_get_d2i(x->cert_info->extensions, nid, crit, idx);
+    return X509V3_get_d2i(x->cert_info.extensions, nid, crit, idx);
 }
 
 int X509_add1_ext_i2d(X509 *x, int nid, void *value, int crit,
                       unsigned long flags)
 {
-    return X509V3_add1_i2d(&x->cert_info->extensions, nid, value, crit,
+    return X509V3_add1_i2d(&x->cert_info.extensions, nid, value, crit,
                            flags);
 }
 
diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c
index 1c08eb044d..71a22d0385 100644
--- a/crypto/x509/x509_lu.c
+++ b/crypto/x509/x509_lu.c
@@ -420,7 +420,6 @@ static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,
 {
     X509_OBJECT stmp;
     X509 x509_s;
-    X509_CINF cinf_s;
     X509_CRL crl_s;
     int idx;
 
@@ -428,8 +427,7 @@ static int x509_object_idx_cnt(STACK_OF(X509_OBJECT) *h, int type,
     switch (type) {
     case X509_LU_X509:
         stmp.data.x509 = &x509_s;
-        x509_s.cert_info = &cinf_s;
-        cinf_s.subject = name;
+        x509_s.cert_info.subject = name;
         break;
     case X509_LU_CRL:
         stmp.data.crl = &crl_s;
diff --git a/crypto/x509/x509_r2x.c b/crypto/x509/x509_r2x.c
index 5d576e91e5..00f772a373 100644
--- a/crypto/x509/x509_r2x.c
+++ b/crypto/x509/x509_r2x.c
@@ -78,7 +78,7 @@ X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
     }
 
     /* duplicate the request */
-    xi = ret->cert_info;
+    xi = &ret->cert_info;
 
     if (sk_X509_ATTRIBUTE_num(r->req_info->attributes) != 0) {
         if ((xi->version = ASN1_INTEGER_new()) == NULL)
diff --git a/crypto/x509/x509_set.c b/crypto/x509/x509_set.c
index 0b0d4f5ab8..b5209f23cd 100644
--- a/crypto/x509/x509_set.c
+++ b/crypto/x509/x509_set.c
@@ -68,15 +68,15 @@ int X509_set_version(X509 *x, long version)
     if (x == NULL)
         return (0);
     if (version == 0) {
-        ASN1_INTEGER_free(x->cert_info->version);
-        x->cert_info->version = NULL;
+        ASN1_INTEGER_free(x->cert_info.version);
+        x->cert_info.version = NULL;
         return (1);
     }
-    if (x->cert_info->version == NULL) {
-        if ((x->cert_info->version = ASN1_INTEGER_new()) == NULL)
+    if (x->cert_info.version == NULL) {
+        if ((x->cert_info.version = ASN1_INTEGER_new()) == NULL)
             return (0);
     }
-    return (ASN1_INTEGER_set(x->cert_info->version, version));
+    return (ASN1_INTEGER_set(x->cert_info.version, version));
 }
 
 int X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial)
@@ -85,12 +85,12 @@ int X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial)
 
     if (x == NULL)
         return (0);
-    in = x->cert_info->serialNumber;
+    in = x->cert_info.serialNumber;
     if (in != serial) {
         in = ASN1_INTEGER_dup(serial);
         if (in != NULL) {
-            ASN1_INTEGER_free(x->cert_info->serialNumber);
-            x->cert_info->serialNumber = in;
+            ASN1_INTEGER_free(x->cert_info.serialNumber);
+            x->cert_info.serialNumber = in;
         }
     }
     return (in != NULL);
@@ -98,16 +98,16 @@ int X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial)
 
 int X509_set_issuer_name(X509 *x, X509_NAME *name)
 {
-    if ((x == NULL) || (x->cert_info == NULL))
+    if (x == NULL)
         return (0);
-    return (X509_NAME_set(&x->cert_info->issuer, name));
+    return (X509_NAME_set(&x->cert_info.issuer, name));
 }
 
 int X509_set_subject_name(X509 *x, X509_NAME *name)
 {
-    if ((x == NULL) || (x->cert_info == NULL))
+    if (x == NULL)
         return (0);
-    return (X509_NAME_set(&x->cert_info->subject, name));
+    return (X509_NAME_set(&x->cert_info.subject, name));
 }
 
 int X509_set_notBefore(X509 *x, const ASN1_TIME *tm)
@@ -116,12 +116,12 @@ int X509_set_notBefore(X509 *x, const ASN1_TIME *tm)
 
     if (x == NULL)
         return (0);
-    in = x->cert_info->validity.notBefore;
+    in = x->cert_info.validity.notBefore;
     if (in != tm) {
         in = ASN1_STRING_dup(tm);
         if (in != NULL) {
-            ASN1_TIME_free(x->cert_info->validity.notBefore);
-            x->cert_info->validity.notBefore = in;
+            ASN1_TIME_free(x->cert_info.validity.notBefore);
+            x->cert_info.validity.notBefore = in;
         }
     }
     return (in != NULL);
@@ -133,12 +133,12 @@ int X509_set_notAfter(X509 *x, const ASN1_TIME *tm)
 
     if (x == NULL)
         return (0);
-    in = x->cert_info->validity.notAfter;
+    in = x->cert_info.validity.notAfter;
     if (in != tm) {
         in = ASN1_STRING_dup(tm);
         if (in != NULL) {
-            ASN1_TIME_free(x->cert_info->validity.notAfter);
-            x->cert_info->validity.notAfter = in;
+            ASN1_TIME_free(x->cert_info.validity.notAfter);
+            x->cert_info.validity.notAfter = in;
         }
     }
     return (in != NULL);
@@ -146,9 +146,9 @@ int X509_set_notAfter(X509 *x, const ASN1_TIME *tm)
 
 int X509_set_pubkey(X509 *x, EVP_PKEY *pkey)
 {
-    if ((x == NULL) || (x->cert_info == NULL))
+    if (x == NULL)
         return (0);
-    return (X509_PUBKEY_set(&(x->cert_info->key), pkey));
+    return (X509_PUBKEY_set(&(x->cert_info.key), pkey));
 }
 
 void X509_up_ref(X509 *x)
@@ -158,17 +158,17 @@ void X509_up_ref(X509 *x)
 
 long X509_get_version(X509 *x)
 {
-    return ASN1_INTEGER_get(x->cert_info->version);
+    return ASN1_INTEGER_get(x->cert_info.version);
 }
 
 ASN1_TIME * X509_get_notBefore(X509 *x)
 {
-    return x->cert_info->validity.notBefore;
+    return x->cert_info.validity.notBefore;
 }
 
 ASN1_TIME *X509_get_notAfter(X509 *x)
 {
-    return x->cert_info->validity.notAfter;
+    return x->cert_info.validity.notAfter;
 }
 
 int X509_get_signature_type(const X509 *x)
@@ -178,5 +178,5 @@ int X509_get_signature_type(const X509 *x)
 
 X509_PUBKEY *X509_get_X509_PUBKEY(const X509 *x)
 {
-    return x->cert_info->key;
+    return x->cert_info.key;
 }
diff --git a/crypto/x509/x_all.c b/crypto/x509/x_all.c
index ab258bea54..ca5a95a08f 100644
--- a/crypto/x509/x_all.c
+++ b/crypto/x509/x_all.c
@@ -74,10 +74,10 @@
 
 int X509_verify(X509 *a, EVP_PKEY *r)
 {
-    if (X509_ALGOR_cmp(a->sig_alg, a->cert_info->signature))
+    if (X509_ALGOR_cmp(a->sig_alg, a->cert_info.signature))
         return 0;
     return (ASN1_item_verify(ASN1_ITEM_rptr(X509_CINF), a->sig_alg,
-                             a->signature, a->cert_info, r));
+                             a->signature, &a->cert_info, r));
 }
 
 int X509_REQ_verify(X509_REQ *a, EVP_PKEY *r)
@@ -94,17 +94,17 @@ int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *a, EVP_PKEY *r)
 
 int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
 {
-    x->cert_info->enc.modified = 1;
-    return (ASN1_item_sign(ASN1_ITEM_rptr(X509_CINF), x->cert_info->signature,
-                           x->sig_alg, x->signature, x->cert_info, pkey, md));
+    x->cert_info.enc.modified = 1;
+    return (ASN1_item_sign(ASN1_ITEM_rptr(X509_CINF), x->cert_info.signature,
+                           x->sig_alg, x->signature, &x->cert_info, pkey, md));
 }
 
 int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx)
 {
-    x->cert_info->enc.modified = 1;
+    x->cert_info.enc.modified = 1;
     return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CINF),
-                              x->cert_info->signature,
-                              x->sig_alg, x->signature, x->cert_info, ctx);
+                              x->cert_info.signature,
+                              x->sig_alg, x->signature, &x->cert_info, ctx);
 }
 
 int X509_http_nbio(OCSP_REQ_CTX *rctx, X509 **pcert)
diff --git a/crypto/x509v3/v3_conf.c b/crypto/x509v3/v3_conf.c
index 3d5963cc40..0b6ff4f87f 100644
--- a/crypto/x509v3/v3_conf.c
+++ b/crypto/x509v3/v3_conf.c
@@ -376,7 +376,7 @@ int X509V3_EXT_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section,
 {
     STACK_OF(X509_EXTENSION) **sk = NULL;
     if (cert)
-        sk = &cert->cert_info->extensions;
+        sk = &cert->cert_info.extensions;
     return X509V3_EXT_add_nconf_sk(conf, ctx, section, sk);
 }
 
diff --git a/crypto/x509v3/v3_skey.c b/crypto/x509v3/v3_skey.c
index 4b55fd815f..641104ab08 100644
--- a/crypto/x509v3/v3_skey.c
+++ b/crypto/x509v3/v3_skey.c
@@ -128,7 +128,7 @@ static ASN1_OCTET_STRING *s2i_skey_id(X509V3_EXT_METHOD *method,
     if (ctx->subject_req)
         pk = ctx->subject_req->req_info->pubkey->public_key;
     else
-        pk = ctx->subject_cert->cert_info->key->public_key;
+        pk = ctx->subject_cert->cert_info.key->public_key;
 
     if (!pk) {
         X509V3err(X509V3_F_S2I_SKEY_ID, X509V3_R_NO_PUBLIC_KEY);
diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index d0933b0cb0..c7c81ecbd3 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -181,7 +181,7 @@ typedef struct x509_cinf_st {
 typedef struct x509_cert_aux_st X509_CERT_AUX;
 
 struct x509_st {
-    X509_CINF *cert_info;
+    X509_CINF cert_info;
     X509_ALGOR *sig_alg;
     ASN1_BIT_STRING *signature;
     int valid;