Add CBB_flush_asn1_set_of calls to pkcs7_add_signed_data

Not that we support, or plan to support, any cases where there are
multiple SignerInfos, but may as well add these (no-op) calls so we
don't forget to resort them if that ever comes up.

Change-Id: I8317bc420d721db4bc0a71f9f560d07a8310d252
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/78450
Reviewed-by: Adam Langley <agl@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

crypto/pkcs7/pkcs7.cc

diff --git a/crypto/pkcs7/pkcs7.cc b/crypto/pkcs7/pkcs7.cc
index 4d6c05f..db225ff 100644
--- a/crypto/pkcs7/pkcs7.cc
+++ b/crypto/pkcs7/pkcs7.cc
@@ -180,12 +180,14 @@
       !CBB_add_u8(&version_bytes, 1) ||
       !CBB_add_asn1(&seq, &digest_algos_set, CBS_ASN1_SET) ||
       (digest_algos_cb != NULL && !digest_algos_cb(&digest_algos_set, arg)) ||
+      !CBB_flush_asn1_set_of(&digest_algos_set) ||
       !CBB_add_asn1(&seq, &content_info, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1(&content_info, &oid, CBS_ASN1_OBJECT) ||
       !CBB_add_bytes(&oid, kPKCS7Data, sizeof(kPKCS7Data)) ||
       (cert_crl_cb != NULL && !cert_crl_cb(&seq, arg)) ||
       !CBB_add_asn1(&seq, &signer_infos, CBS_ASN1_SET) ||
-      (signer_infos_cb != NULL && !signer_infos_cb(&signer_infos, arg))) {
+      (signer_infos_cb != NULL && !signer_infos_cb(&signer_infos, arg)) ||
+      !CBB_flush_asn1_set_of(&signer_infos)) {
     return 0;
   }