Commit 4483e234 authored by Todd Short's avatar Todd Short Committed by Rich Salz
Browse files

Fix potential memory leak in ASN1_TIME_to_generalizedtime() 



If ret is allocated, it may be leaked on error.

Reviewed-by: default avatarTim Hudson <tjh@openssl.org>
Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2666)
parent 7e999d51

crypto/asn1/a_time.c

+16 −9
Original line number Original line Diff line number Diff line
@@ -62,7 +62,7 @@ int ASN1_TIME_check(const ASN1_TIME *t) 
ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t,

ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t,

                                                   ASN1_GENERALIZEDTIME **out)

                                                   ASN1_GENERALIZEDTIME **out)

{

{

    ASN1_GENERALIZEDTIME *ret;

    ASN1_GENERALIZEDTIME *ret = NULL;

    char *str;

    char *str;

    int newlen;

    int newlen;
@@ -71,22 +71,20 @@ ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t, 




    if (out == NULL || *out == NULL) {

    if (out == NULL || *out == NULL) {

        if ((ret = ASN1_GENERALIZEDTIME_new()) == NULL)

        if ((ret = ASN1_GENERALIZEDTIME_new()) == NULL)

            return NULL;

            goto err;

        if (out)

            *out = ret;

    } else

    } else

        ret = *out;

        ret = *out;





    /* If already GeneralizedTime just copy across */

    /* If already GeneralizedTime just copy across */

    if (t->type == V_ASN1_GENERALIZEDTIME) {

    if (t->type == V_ASN1_GENERALIZEDTIME) {

        if (!ASN1_STRING_set(ret, t->data, t->length))

        if (!ASN1_STRING_set(ret, t->data, t->length))

            return NULL;

            goto err;

        return ret;

        goto done;

    }

    }





    /* grow the string */

    /* grow the string */

    if (!ASN1_STRING_set(ret, NULL, t->length + 2))

    if (!ASN1_STRING_set(ret, NULL, t->length + 2))

        return NULL;

        goto err;

    /* ASN1_STRING_set() allocated 'len + 1' bytes. */

    /* ASN1_STRING_set() allocated 'len + 1' bytes. */

    newlen = t->length + 2 + 1;

    newlen = t->length + 2 + 1;

    str = (char *)ret->data;

    str = (char *)ret->data;
@@ -96,11 +94,20 @@ ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t, 
    else

    else

        OPENSSL_strlcpy(str, "20", newlen);

        OPENSSL_strlcpy(str, "20", newlen);





    OPENSSL_strlcat(str, (char *)t->data, newlen);

    OPENSSL_strlcat(str, (const char *)t->data, newlen);





 done:

   if (out != NULL && *out == NULL)

       *out = ret;

   return ret;

   return ret;



 err:

    if (out == NULL || *out != ret)

        ASN1_GENERALIZEDTIME_free(ret);

    return NULL;

}

}







int ASN1_TIME_set_string(ASN1_TIME *s, const char *str)

int ASN1_TIME_set_string(ASN1_TIME *s, const char *str)

{

{

    ASN1_TIME t;

    ASN1_TIME t;