Commit 036e61b1 authored by Matt Caswell's avatar Matt Caswell
Browse files

Free memory on an error path 



The function a2i_ASN1_STRING can encounter an error after already
allocating a buffer. It wasn't always freeing that buffer on error.

Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
parent d285b541

crypto/asn1/f_string.c

+3 −0
Original line number Diff line number Diff line
@@ -104,6 +104,7 @@ int a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size) 
        i -= again;

        if (i % 2 != 0) {

            ASN1err(ASN1_F_A2I_ASN1_STRING, ASN1_R_ODD_NUMBER_OF_CHARS);

            OPENSSL_free(s);

            return 0;

        }

        i /= 2;
@@ -123,6 +124,7 @@ int a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size) 
                if (m < 0) {

                    ASN1err(ASN1_F_A2I_ASN1_STRING,

                            ASN1_R_NON_HEX_CHARACTERS);

                    OPENSSL_free(s);

                    return 0;

                }

                s[num + j] <<= 4;
@@ -141,5 +143,6 @@ int a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size) 


 err:

    ASN1err(ASN1_F_A2I_ASN1_STRING, ASN1_R_SHORT_LINE);

    OPENSSL_free(s);

    return 0;

}