Don't free ret->data if malloc fails.
Issue reported by Guido Vranken.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 64eaf6c928)
			
			
This commit is contained in:
		@@ -200,13 +200,13 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, const unsigned char **pp,
 | 
				
			|||||||
    } else {
 | 
					    } else {
 | 
				
			||||||
        if (len != 0) {
 | 
					        if (len != 0) {
 | 
				
			||||||
            if ((ret->length < len) || (ret->data == NULL)) {
 | 
					            if ((ret->length < len) || (ret->data == NULL)) {
 | 
				
			||||||
                if (ret->data != NULL)
 | 
					 | 
				
			||||||
                    OPENSSL_free(ret->data);
 | 
					 | 
				
			||||||
                s = (unsigned char *)OPENSSL_malloc((int)len + 1);
 | 
					                s = (unsigned char *)OPENSSL_malloc((int)len + 1);
 | 
				
			||||||
                if (s == NULL) {
 | 
					                if (s == NULL) {
 | 
				
			||||||
                    i = ERR_R_MALLOC_FAILURE;
 | 
					                    i = ERR_R_MALLOC_FAILURE;
 | 
				
			||||||
                    goto err;
 | 
					                    goto err;
 | 
				
			||||||
                }
 | 
					                }
 | 
				
			||||||
 | 
					                if (ret->data != NULL)
 | 
				
			||||||
 | 
					                    OPENSSL_free(ret->data);
 | 
				
			||||||
            } else
 | 
					            } else
 | 
				
			||||||
                s = ret->data;
 | 
					                s = ret->data;
 | 
				
			||||||
            memcpy(s, p, (int)len);
 | 
					            memcpy(s, p, (int)len);
 | 
				
			||||||
 
 | 
				
			|||||||
		Reference in New Issue
	
	Block a user