diff -up openssl-fips-0.9.8e/engines/e_chil.c.chil openssl-fips-0.9.8e/engines/e_chil.c

--- openssl-fips-0.9.8e/engines/e_chil.c.chil	2005-07-16 13:13:08.000000000 +0200

+++ openssl-fips-0.9.8e/engines/e_chil.c	2011-04-04 16:35:45.000000000 +0200

@@ -116,6 +116,7 @@ static int hwcrhk_rsa_mod_exp(BIGNUM *r,

 /* This function is aliased to mod_exp (with the mont stuff dropped). */

 static int hwcrhk_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,

 		const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);

+static int hwcrhk_rsa_finish(RSA *rsa);

 #endif

 #ifndef OPENSSL_NO_DH

@@ -135,10 +136,6 @@ static EVP_PKEY *hwcrhk_load_privkey(ENG

 	UI_METHOD *ui_method, void *callback_data);

 static EVP_PKEY *hwcrhk_load_pubkey(ENGINE *eng, const char *key_id,

 	UI_METHOD *ui_method, void *callback_data);

-#ifndef OPENSSL_NO_RSA

-static void hwcrhk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,

-	int ind,long argl, void *argp);

-#endif

 /* Interaction stuff */

 static int hwcrhk_insert_card(const char *prompt_info,

@@ -193,7 +190,7 @@ static RSA_METHOD hwcrhk_rsa =

 	hwcrhk_rsa_mod_exp,

 	hwcrhk_mod_exp_mont,

 	NULL,

-	NULL,

+	hwcrhk_rsa_finish,

 	0,

 	NULL,

 	NULL,

@@ -589,12 +586,6 @@ static int hwcrhk_init(ENGINE *e)

 			hwcrhk_globals.mutex_release = hwcrhk_mutex_unlock;

 			hwcrhk_globals.mutex_destroy = hwcrhk_mutex_destroy;

 			}

-		else if (CRYPTO_get_locking_callback() != NULL)

-			{

-			HWCRHKerr(HWCRHK_F_HWCRHK_INIT,HWCRHK_R_LOCKING_MISSING);

-			ERR_add_error_data(1,"You HAVE to add dynamic locking callbacks via CRYPTO_set_dynlock_{create,lock,destroy}_callback()");

-			goto err;

-			}

 		}

 	/* Try and get a context - if not, we may have a DSO but no

@@ -609,7 +600,7 @@ static int hwcrhk_init(ENGINE *e)

 	if (hndidx_rsa == -1)

 		hndidx_rsa = RSA_get_ex_new_index(0,

 			"nFast HWCryptoHook RSA key handle",

-			NULL, NULL, hwcrhk_ex_free);

+			NULL, NULL, NULL);

 #endif

 	return 1;

 err:

@@ -853,8 +844,6 @@ static EVP_PKEY *hwcrhk_load_privkey(ENG

 	return res;

  err:

-	if (res)

-		EVP_PKEY_free(res);

 #ifndef OPENSSL_NO_RSA

 	if (rtmp)

 		RSA_free(rtmp);

@@ -1087,6 +1076,21 @@ static int hwcrhk_mod_exp_mont(BIGNUM *r

 	{

 	return hwcrhk_mod_exp(r, a, p, m, ctx);

 	}

+

+static int hwcrhk_rsa_finish(RSA *rsa)

+	{

+	HWCryptoHook_RSAKeyHandle *hptr;

+

+	hptr = RSA_get_ex_data(rsa, hndidx_rsa);

+	if (hptr)

+                {

+                p_hwcrhk_RSAUnloadKey(*hptr, NULL);

+                OPENSSL_free(hptr);

+		RSA_set_ex_data(rsa, hndidx_rsa, NULL);

+                }

+	return 1;

+	}

+

 #endif

 #ifndef OPENSSL_NO_DH

@@ -1145,34 +1149,6 @@ static int hwcrhk_rand_status(void)

 	return 1;

 	}

-/* This cleans up an RSA KM key, called when ex_data is freed */

-#ifndef OPENSSL_NO_RSA

-static void hwcrhk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,

-	int ind,long argl, void *argp)

-{

-	char tempbuf[1024];

-	HWCryptoHook_ErrMsgBuf rmsg;

-#ifndef OPENSSL_NO_RSA

-	HWCryptoHook_RSAKeyHandle *hptr;

-#endif

-#if !defined(OPENSSL_NO_RSA)

-	int ret;

-#endif

-

-	rmsg.buf = tempbuf;

-	rmsg.size = sizeof(tempbuf);

-

-#ifndef OPENSSL_NO_RSA

-	hptr = (HWCryptoHook_RSAKeyHandle *) item;

-	if(hptr)

-                {

-                ret = p_hwcrhk_RSAUnloadKey(*hptr, NULL);

-                OPENSSL_free(hptr);

-                }

-#endif

-}

-#endif

-

 /* Mutex calls: since the HWCryptoHook model closely follows the POSIX model

  * these just wrap the POSIX functions and add some logging.

  */

@@ -1210,6 +1186,11 @@ static int hwcrhk_get_pass(const char *p

 	pem_password_cb *callback = NULL;

 	void *callback_data = NULL;

         UI_METHOD *ui_method = NULL;

+	/* Despite what the documentation says prompt_info can be

+	 * an empty string.

+	 */

+	if (prompt_info && !*prompt_info)

+		prompt_info = NULL;

         if (cactx)

                 {

@@ -1311,10 +1292,14 @@ static int hwcrhk_insert_card(const char

 		{

 		char answer;

 		char buf[BUFSIZ];

-

-		if (wrong_info)

+		/* Despite what the documentation says wrong_info can be

+	 	 * an empty string.

+		 */

+		if (wrong_info && *wrong_info)

 			BIO_snprintf(buf, sizeof(buf)-1,

 				"Current card: \"%s\"\n", wrong_info);

+		else

+			buf[0] = 0;

 		ok = UI_dup_info_string(ui, buf);

 		if (ok >= 0 && prompt_info)

 			{