Const-correct X509_STORE_add_{cert,crl}

Bug: 505090843
Change-Id: I461fb1a7eafb1ace9926c096af2c55a9ac09e20f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/104229
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Xiangfei Ding <xfding@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>

crypto/x509/x509_lu.cc

diff --git a/crypto/x509/x509_lu.cc b/crypto/x509/x509_lu.cc
index c112679..5b60327 100644
--- a/crypto/x509/x509_lu.cc
+++ b/crypto/x509/x509_lu.cc
@@ -211,7 +211,7 @@
   return 1;
 }
 
-static int x509_store_add(X509Store *ctx, void *x, int is_crl) {
+static int x509_store_add(X509Store *ctx, const void *x, int is_crl) {
   if (x == nullptr) {
     return 0;
   }
@@ -223,12 +223,11 @@
 
   if (is_crl) {
     obj->type = X509_LU_CRL;
-    obj->data.crl = (X509_CRL *)x;
+    obj->data.crl = X509_CRL_dup_ref(static_cast<const X509_CRL *>(x));
   } else {
     obj->type = X509_LU_X509;
-    obj->data.x509 = (X509 *)x;
+    obj->data.x509 = X509_dup_ref(static_cast<const X509 *>(x));
   }
-  X509_OBJECT_up_ref_count(obj);
 
   ctx->objs_lock.LockWrite();
 
@@ -248,11 +247,11 @@
   return ret;
 }
 
-int X509_STORE_add_cert(X509_STORE *ctx, X509 *x) {
+int X509_STORE_add_cert(X509_STORE *ctx, const X509 *x) {
   return x509_store_add(FromOpaque(ctx), x, /*is_crl=*/0);
 }
 
-int X509_STORE_add_crl(X509_STORE *ctx, X509_CRL *x) {
+int X509_STORE_add_crl(X509_STORE *ctx, const X509_CRL *x) {
   return x509_store_add(FromOpaque(ctx), x, /*is_crl=*/1);
 }
 

include/openssl/x509.h

diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 5a2e711..6e2fa75 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -2822,7 +2822,7 @@
 // is a race condition whether `x509` is available for issuer lookups.
 // Moreover, the result may differ for each issuer lookup performed by a single
 // `X509_verify_cert` call.
-OPENSSL_EXPORT int X509_STORE_add_cert(X509_STORE *store, X509 *x509);
+OPENSSL_EXPORT int X509_STORE_add_cert(X509_STORE *store, const X509 *x509);
 
 // X509_STORE_add_crl adds `crl` to `store`. It returns one on success and zero
 // on error. This function internally increments `crl`'s reference count, so the
@@ -2839,7 +2839,7 @@
 // To vary the set of CRLs over time, callers should either create a new
 // `X509_STORE` or configure CRLs on a per-verification basis with
 // `X509_STORE_CTX_set0_crls`.
-OPENSSL_EXPORT int X509_STORE_add_crl(X509_STORE *store, X509_CRL *crl);
+OPENSSL_EXPORT int X509_STORE_add_crl(X509_STORE *store, const X509_CRL *crl);
 
 // X509_STORE_get0_param returns `store`'s verification parameters. This object
 // is mutable and may be modified by the caller. For an individual certificate