Commit b197257d authored by Matt Caswell's avatar Matt Caswell
Browse files

Check for error return from ASN1_object_size 



Otherwise we try to malloc a -1 size.

Reviewed-by: default avatarTim Hudson <tjh@openssl.org>
parent 4d94bd36

crypto/ocsp/ocsp_ext.c

+3 −0
Original line number Diff line number Diff line
@@ -256,6 +256,9 @@ static int ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts, 
     * relies on library internals.

     */

    os.length = ASN1_object_size(0, len, V_ASN1_OCTET_STRING);

    if (os.length < 0)

        goto err;



    os.data = OPENSSL_malloc(os.length);

    if (os.data == NULL)

        goto err;