PEM_READ_BIO_EX(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅 PEM_READ_BIO_EX 💅

okay bestie, welcome to the PEM_READ_BIO_EX(3ossl) page — yes that's the manual name, it's giving "I live in section 3ossl of the OpenSSL docs" and honestly? iconic. this is the deep-lore version of PEM reading, the one where you get to pick the flags and do custom processing. buckle up 🎀

✨ NAME ✨

PEM_read_bio_ex, PEM_FLAG_SECURE, PEM_FLAG_EAY_COMPATIBLE, PEM_FLAG_ONLY_B64 — these read PEM format files with custom processing, iykyk 💖

🌸 SYNOPSIS 🌸

#include <openssl/pem.h>

#define PEM_FLAG_SECURE             0x1
#define PEM_FLAG_EAY_COMPATIBLE     0x2
#define PEM_FLAG_ONLY_B64           0x4
int PEM_read_bio_ex(BIO *in, char **name, char **header,
                    unsigned char **data, long *len, unsigned int flags);

look at those three little flag macros, 0x1, 0x2, 0x4 — bite-sized, adorable, extremely load-bearing 🫶

🦋 DESCRIPTION 🦋

so PEM_read_bio_ex() reads in PEM formatted data from an input BIO, and it outputs three things for you:

  • the name of the type of contained data
  • the header information regarding the possibly encrypted data
  • the binary data payload (after base64 decoding)

and like — heads up — it should generally only be used to implement PEM_read_bio_-family functions for specific data types or other usage. but it's exposed to allow greater flexibility over how processing is performed, if needed. so it's the "for when you really need it" function. main character energy but make it niche 💅

now the flags, the flags, the flags — this is the part you came for:

  • if PEM_FLAG_SECURE is set, the intermediate buffers used to read in lines of input are allocated from the secure heap 🔐
  • if PEM_FLAG_EAY_COMPATIBLE is set, a simple algorithm is used to remove whitespace and control characters from the end of each line, so as to be compatible with the historical behavior of PEM_read_bio(). nostalgia-core fr fr.
  • if PEM_FLAG_ONLY_B64 is set, all characters are required to be valid base64 characters (or newlines); non-base64 characters are treated as end of input. strict queen 👑
  • if neither PEM_FLAG_EAY_COMPATIBLE or PEM_FLAG_ONLY_B64 is set, control characters are ignored. chill mode, no cap.
  • if both PEM_FLAG_EAY_COMPATIBLE and PEM_FLAG_ONLY_B64 are set, an error is returned; these options are not compatible with each other. 🫠 they simply cannot coexist, bestie, it's not that kind of party.
like, pick a lane with those last two flags. literally either one or neither. both at once = instant error, no vibe check passed 😭

🧚 NOTES 🧚

this is the part where you don't forget your responsibilities, okay?

  • the caller must release the storage allocated for *name, *header, and *data.
  • if PEM_FLAG_SECURE was set, use OPENSSL_secure_free(); otherwise, OPENSSL_free() is used.

so matching your allocator to your flag is not optional, it's the whole plot 🌈

⭐ RETURN VALUES ⭐

PEM_read_bio_ex() returns 1 for success or 0 for failure. that's it, that's the whole range. binary slay 💀

🍓 SEE ALSO 🍓

PEM_bytes_read_bio(3)

go read that one too, bestie, it's the cousin 🫶

🎀 HISTORY 🎀

the PEM_read_bio_ex() function was added in OpenSSL 1.1.1. vintage-ish but still serving ✨

Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the page!! 💖 this was PEM_READ_BIO_EX(3ossl) from OpenSSL version 3.5.0, dated 2026-09-25 — mwah, go forth and free your buffers with the correct free function, bestie 🌸🦋💜

📦 where this page comes from