Commit dac693c9 authored by Matt Caswell's avatar Matt Caswell
Browse files

Fix a failure to NULL a pointer freed on error. 



Inspired by BoringSSL commit 517073cd4b by Eric Roman <eroman@chromium.org>

CVE-2015-0209

Reviewed-by: default avatarEmilia Käsper <emilia@openssl.org>
parent 6e161ee3

crypto/ec/ec_asn1.c

+3 −3
Original line number Diff line number Diff line
@@ -1014,8 +1014,6 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, const unsigned char **in, long len) 
            ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_MALLOC_FAILURE);

            goto err;

        }

        if (a)

            *a = ret;

    } else

        ret = *a;
@@ -1083,10 +1081,12 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, const unsigned char **in, long len) 
        ret->enc_flag |= EC_PKEY_NO_PUBKEY;

    }



    if (a)

        *a = ret;

    ok = 1;

 err:

    if (!ok) {

        if (ret)

        if (ret && (a == NULL || *a != ret))

            EC_KEY_free(ret);

        ret = NULL;

    }