generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

PR: 2251

Browse Source 
Submitted by: Ger Hobbelt <ger@hobbelt.com>
Approved by: steve@openssl.org

Memleak, BIO chain leak and realloc checks in v3_pci.c
This commit is contained in:
Dr. Stephen Henson 2010-05-22 00:31:02 +00:00
parent d497b5362b
commit 59d100d959
1 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
crypto/x509v3/v3_pci.c
View File

@ -128,7 +128,12 @@ static int process_pci_value(CONF_VALUE *val,
unsigned char *tmp_data2 = unsigned char *tmp_data2 =
string_to_hex(val->value + 4, &val_len); string_to_hex(val->value + 4, &val_len);
if (!tmp_data2) goto err; if (!tmp_data2)
{
X509V3err(X509V3_F_PROCESS_PCI_VALUE,X509V3_R_ILLEGAL_HEX_DIGIT);
X509V3_conf_err(val);
goto err;
}
tmp_data = OPENSSL_realloc((*policy)->data, tmp_data = OPENSSL_realloc((*policy)->data,
(*policy)->length + val_len + 1); (*policy)->length + val_len + 1);
@ -140,6 +145,17 @@ static int process_pci_value(CONF_VALUE *val,
(*policy)->length += val_len; (*policy)->length += val_len;
(*policy)->data[(*policy)->length] = '\0'; (*policy)->data[(*policy)->length] = '\0';
} }
else
{
OPENSSL_free(tmp_data2);
/* realloc failure implies the original data space is b0rked too! */
(*policy)->data = NULL;
(*policy)->length = 0;
X509V3err(X509V3_F_PROCESS_PCI_VALUE,ERR_R_MALLOC_FAILURE);
X509V3_conf_err(val);
goto err;
}
OPENSSL_free(tmp_data2);
} }
else if (strncmp(val->value, "file:", 5) == 0) else if (strncmp(val->value, "file:", 5) == 0)
{ {
@ -169,6 +185,7 @@ static int process_pci_value(CONF_VALUE *val,
(*policy)->length += n; (*policy)->length += n;
(*policy)->data[(*policy)->length] = '\0'; (*policy)->data[(*policy)->length] = '\0';
} }
BIO_free_all(b);
if (n < 0) if (n < 0)
{ {
@ -190,6 +207,15 @@ static int process_pci_value(CONF_VALUE *val,
(*policy)->length += val_len; (*policy)->length += val_len;
(*policy)->data[(*policy)->length] = '\0'; (*policy)->data[(*policy)->length] = '\0';
} }
else
{
/* realloc failure implies the original data space is b0rked too! */
(*policy)->data = NULL;
(*policy)->length = 0;
X509V3err(X509V3_F_PROCESS_PCI_VALUE,ERR_R_MALLOC_FAILURE);
X509V3_conf_err(val);
goto err;
}
} }
else else
{ {