Commit 5e5d53d3 authored by Matt Caswell's avatar Matt Caswell
Browse files

Fix a failure to NULL a pointer freed on error. 



Reported by the LibreSSL project as a follow on to CVE-2015-0209

Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
parent 367eab2f

crypto/asn1/x_x509.c

+11 −1
Original line number Original line Diff line number Diff line
@@ -168,8 +168,14 @@ X509 *d2i_X509_AUX(X509 **a, const unsigned char **pp, long length) 
{

{

    const unsigned char *q;

    const unsigned char *q;

    X509 *ret;

    X509 *ret;

    int freeret = 0;



    /* Save start position */

    /* Save start position */

    q = *pp;

    q = *pp;



    if(!a || *a == NULL) {

        freeret = 1;

    }

    ret = d2i_X509(a, pp, length);

    ret = d2i_X509(a, pp, length);

    /* If certificate unreadable then forget it */

    /* If certificate unreadable then forget it */

    if (!ret)

    if (!ret)
@@ -182,7 +188,11 @@ X509 *d2i_X509_AUX(X509 **a, const unsigned char **pp, long length) 
        goto err;

        goto err;

    return ret;

    return ret;

 err:

 err:

    if(freeret) {

        X509_free(ret);

        X509_free(ret);

        if (a)

            *a = NULL;

    }

    return NULL;

    return NULL;

}

}

crypto/ec/ec_asn1.c

+5 −2
Original line number Original line Diff line number Diff line
@@ -1226,16 +1226,19 @@ EC_KEY *d2i_ECParameters(EC_KEY **a, const unsigned char **in, long len) 
            ECerr(EC_F_D2I_ECPARAMETERS, ERR_R_MALLOC_FAILURE);

            ECerr(EC_F_D2I_ECPARAMETERS, ERR_R_MALLOC_FAILURE);

            return NULL;

            return NULL;

        }

        }

        if (a)

            *a = ret;

    } else

    } else

        ret = *a;

        ret = *a;





    if (!d2i_ECPKParameters(&ret->group, in, len)) {

    if (!d2i_ECPKParameters(&ret->group, in, len)) {

        ECerr(EC_F_D2I_ECPARAMETERS, ERR_R_EC_LIB);

        ECerr(EC_F_D2I_ECPARAMETERS, ERR_R_EC_LIB);

        if (a == NULL || *a != ret)

             EC_KEY_free(ret);

        return NULL;

        return NULL;

    }

    }





    if (a)

        *a = ret;



    return ret;

    return ret;

}

}