Commit 0e9eb1a5 authored by Matt Caswell's avatar Matt Caswell
Browse files

Free tempory data on error in ec_wNAF_mul() 



The ec_wNAF_mul() function allocates some temporary storage that it
doesn't always free on an error condition.

Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
parent ff3bb913

crypto/ec/ec_mult.c

+2 −0
Original line number Diff line number Diff line
@@ -312,6 +312,7 @@ int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, 
                    numblocks = (tmp_len + blocksize - 1) / blocksize;

                    if (numblocks > pre_comp->numblocks) {

                        ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);

                        OPENSSL_free(tmp_wNAF);

                        goto err;

                    }

                    totalnum = num + numblocks;
@@ -326,6 +327,7 @@ int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, 
                        wNAF_len[i] = blocksize;

                        if (tmp_len < blocksize) {

                            ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);

                            OPENSSL_free(tmp_wNAF);

                            goto err;

                        }

                        tmp_len -= blocksize;