Don't stack-allocate incomplete X509/X509_CRL objects

As we start putting more types with destructors into our types, we won't
be able to just stack-allocate them and ignore object lifetimes. In
particular, using a proper std::atomic<uint32_t> as the refcount is
incompatible this pattern.

This particular file needs loads more work, but I've just done the
minimal change needed here.

Change-Id: If55244303e5b2ff7212ad4eba0c184a2ce1a15c0
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/79067
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Auto-Submit: David Benjamin <davidben@google.com>

crypto/x509/by_dir.cc

diff --git a/crypto/x509/by_dir.cc b/crypto/x509/by_dir.cc
index 5287d3e..e036362 100644
--- a/crypto/x509/by_dir.cc
+++ b/crypto/x509/by_dir.cc
@@ -192,16 +192,8 @@
 
 static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
                                X509_OBJECT *ret) {
-  union {
-    struct {
-      X509 st_x509;
-      X509_CINF st_x509_cinf;
-    } x509;
-    struct {
-      X509_CRL st_crl;
-      X509_CRL_INFO st_crl_info;
-    } crl;
-  } data;
+  bssl::UniquePtr<X509> lookup_cert;
+  bssl::UniquePtr<X509_CRL> lookup_crl;
   int ok = 0;
   size_t i;
   int k;
@@ -219,14 +211,20 @@
   stmp.type = type;
   BY_DIR *ctx = reinterpret_cast<BY_DIR *>(xl->method_data);
   if (type == X509_LU_X509) {
-    data.x509.st_x509.cert_info = &data.x509.st_x509_cinf;
-    data.x509.st_x509_cinf.subject = name;
-    stmp.data.x509 = &data.x509.st_x509;
+    lookup_cert.reset(X509_new());
+    if (lookup_cert == nullptr ||
+        !X509_set_subject_name(lookup_cert.get(), name)) {
+      return 0;
+    }
+    stmp.data.x509 = lookup_cert.get();
     postfix = "";
   } else if (type == X509_LU_CRL) {
-    data.crl.st_crl.crl = &data.crl.st_crl_info;
-    data.crl.st_crl_info.issuer = name;
-    stmp.data.crl = &data.crl.st_crl;
+    lookup_crl.reset(X509_CRL_new());
+    if (lookup_crl == nullptr ||
+        !X509_CRL_set_issuer_name(lookup_crl.get(), name)) {
+      return 0;
+    }
+    stmp.data.crl = lookup_crl.get();
     postfix = "r";
   } else {
     OPENSSL_PUT_ERROR(X509, X509_R_WRONG_LOOKUP_TYPE);