krb5 commit [krb5-1.11]: Ignore missing Q in dh_params

[Tom Yu]

https://github.com/krb5/krb5/commit/5d2c49df555fbf56d3b15a9096cad729525c5f74
commit 5d2c49df555fbf56d3b15a9096cad729525c5f74
Author: Tom Yu <tlyu at mit.edu>
Date:   Thu Mar 28 19:09:04 2013 -0400

    Ignore missing Q in dh_params
    
    Some implementations don't send the required Q value in dh_params, so
    allow it to be absent.
    
    (cherry picked from commit ed77a25c53ed6afd41372838f205a98a561a89fb)
    
    ticket: 7596
    version_fixed: 1.11.3
    status: resolved

 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index 390797a..2cd3440 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -2955,9 +2955,9 @@ pkinit_decode_dh_params(DH ** a, unsigned char **pp, unsigned int len)
         }
 
     }
-    M_ASN1_D2I_get_x(ASN1_INTEGER, aip, d2i_ASN1_INTEGER);
-    if (aip == NULL)
-        return NULL;
+    M_ASN1_D2I_get_opt(aip, d2i_ASN1_INTEGER, V_ASN1_INTEGER);
+    if (aip == NULL || ai.data == NULL)
+        (*a)->q = NULL;
     else {
         (*a)->q = ASN1_INTEGER_to_BN(aip, NULL);
         if ((*a)->q == NULL)
@@ -3282,7 +3282,7 @@ pkinit_check_dh_params(BIGNUM * p1, BIGNUM * p2, BIGNUM * g1, BIGNUM * q1)
         if (!BN_cmp(g1, g2)) {
             q2 = BN_new();
             BN_rshift1(q2, p1);
-            if (!BN_cmp(q1, q2)) {
+            if (q1 == NULL || !BN_cmp(q1, q2)) {
                 pkiDebug("good %d dhparams\n", BN_num_bits(p1));
                 retval = 0;
             } else