generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix dsa_pub_encode

Browse Source 
The return value from ASN1_STRING_new() was not being checked which could
lead to a NULL deref in the event of a malloc failure. Also fixed a mem
leak in the error path.

Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Matt Caswell 2015-03-11 20:19:08 +00:00
parent 6aa8dab2bb
commit 0c7ca4033d
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
crypto/dsa/dsa_ameth.c
View File

@ -129,21 +129,23 @@ static int dsa_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
static int dsa_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey) static int dsa_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
{ {
DSA *dsa; DSA *dsa;
void *pval = NULL;
int ptype; int ptype;
unsigned char *penc = NULL; unsigned char *penc = NULL;
int penclen; int penclen;
ASN1_STRING *str = NULL;
dsa = pkey->pkey.dsa; dsa = pkey->pkey.dsa;
if (pkey->save_parameters && dsa->p && dsa->q && dsa->g) { if (pkey->save_parameters && dsa->p && dsa->q && dsa->g) {
ASN1_STRING *str;
str = ASN1_STRING_new(); str = ASN1_STRING_new();
if (!str) {
DSAerr(DSA_F_DSA_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
goto err;
}
str->length = i2d_DSAparams(dsa, &str->data); str->length = i2d_DSAparams(dsa, &str->data);
if (str->length <= 0) { if (str->length <= 0) {
DSAerr(DSA_F_DSA_PUB_ENCODE, ERR_R_MALLOC_FAILURE); DSAerr(DSA_F_DSA_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
goto err; goto err;
} }
pval = str;
ptype = V_ASN1_SEQUENCE; ptype = V_ASN1_SEQUENCE;
} else } else
ptype = V_ASN1_UNDEF; ptype = V_ASN1_UNDEF;
@ -158,14 +160,14 @@ static int dsa_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
} }
if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_DSA), if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_DSA),
ptype, pval, penc, penclen)) ptype, str, penc, penclen))
return 1; return 1;
err: err:
if (penc) if (penc)
OPENSSL_free(penc); OPENSSL_free(penc);
if (pval) if (str)
ASN1_STRING_free(pval); ASN1_STRING_free(str);
return 0; return 0;
} }