Commit 3bbd1d63 authored by Matt Caswell's avatar Matt Caswell
Browse files

Fix a NULL deref in an error path 



The SRP_create_verifier_BN function goes to the |err| label if the |salt|
value passed to it is NULL. It is then deref'd.

Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
parent e113c9c5

crypto/srp/srp_vfy.c

+1 −1
Original line number Diff line number Diff line
@@ -644,7 +644,7 @@ int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt, 
    *salt = salttmp;



 err:

    if (*salt != salttmp)

    if (salt != NULL && *salt != salttmp)

        BN_clear_free(salttmp);

    BN_clear_free(x);

    BN_CTX_free(bn_ctx);