Commit ed3eb5e0 authored by Matt Caswell's avatar Matt Caswell
Browse files

The x509_name_canon function doesn't check for an error return 



i2d_name_canon can return a negative number on error. We should check it
before continuing.

Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
parent 3b7a71b2

crypto/x509/x_name.c

+5 −2
Original line number Diff line number Diff line
@@ -335,7 +335,7 @@ static int x509_name_canon(X509_NAME *a) 
    STACK_OF(STACK_OF_X509_NAME_ENTRY) *intname = NULL;

    STACK_OF(X509_NAME_ENTRY) *entries = NULL;

    X509_NAME_ENTRY *entry, *tmpentry = NULL;

    int i, set = -1, ret = 0;

    int i, set = -1, ret = 0, len;



    OPENSSL_free(a->canon_enc);

    a->canon_enc = NULL;
@@ -370,7 +370,10 @@ static int x509_name_canon(X509_NAME *a) 


    /* Finally generate encoding */



    a->canon_enclen = i2d_name_canon(intname, NULL);

    len = i2d_name_canon(intname, NULL);

    if (len < 0)

        goto err;

    a->canon_enclen = len;



    p = OPENSSL_malloc(a->canon_enclen);