Fix memory leak on bad inputs.

[oweals/openssl.git] / crypto / asn1 / x_name.c

diff --git a/crypto/asn1/x_name.c b/crypto/asn1/x_name.c
index cc8c979ad59b8c0de8cba3a3d951e2ddbf095b8a..9a1a9f415ff3a73f98f4b6aedefb5c296a50457a 100644 (file)
--- a/crypto/asn1/x_name.c
+++ b/crypto/asn1/x_name.c
@@ -123,7 +123,7 @@ static int x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it)
        return 1;
 
  memerr:
-       ASN1err(ASN1_F_X509_NAME_NEW, ERR_R_MALLOC_FAILURE);
+       ASN1err(ASN1_F_X509_NAME_EX_NEW, ERR_R_MALLOC_FAILURE);
        if (ret)
                {
                if (ret->entries)
@@ -160,43 +160,46 @@ static int x509_name_ex_d2i(ASN1_VALUE **val, const unsigned char **in, long len
                                        int tag, int aclass, char opt, ASN1_TLC *ctx)
 {
        const unsigned char *p = *in, *q;
-       STACK *intname = NULL;
+       union { STACK *s; ASN1_VALUE *a; } intname = {NULL};
+       union { X509_NAME *x; ASN1_VALUE *a; } nm = {NULL};
        int i, j, ret;
-       X509_NAME *nm = NULL;
        STACK_OF(X509_NAME_ENTRY) *entries;
        X509_NAME_ENTRY *entry;
        q = p;
 
        /* Get internal representation of Name */
-       ret = ASN1_item_ex_d2i((ASN1_VALUE **)&intname, &p, len, ASN1_ITEM_rptr(X509_NAME_INTERNAL),
-                                                               tag, aclass, opt, ctx);
+       ret = ASN1_item_ex_d2i(&intname.a,
+                              &p, len, ASN1_ITEM_rptr(X509_NAME_INTERNAL),
+                              tag, aclass, opt, ctx);
        
        if(ret <= 0) return ret;
 
        if(*val) x509_name_ex_free(val, NULL);
-       if(!x509_name_ex_new((ASN1_VALUE **)&nm, NULL)) goto err;
+       if(!x509_name_ex_new(&nm.a, NULL)) goto err;
        /* We've decoded it: now cache encoding */
-       if(!BUF_MEM_grow(nm->bytes, p - q)) goto err;
-       memcpy(nm->bytes->data, q, p - q);
+       if(!BUF_MEM_grow(nm.x->bytes, p - q)) goto err;
+       memcpy(nm.x->bytes->data, q, p - q);
 
        /* Convert internal representation to X509_NAME structure */
-       for(i = 0; i < sk_num(intname); i++) {
-               entries = (STACK_OF(X509_NAME_ENTRY) *)sk_value(intname, i);
+       for(i = 0; i < sk_num(intname.s); i++) {
+               entries = (STACK_OF(X509_NAME_ENTRY) *)sk_value(intname.s, i);
                for(j = 0; j < sk_X509_NAME_ENTRY_num(entries); j++) {
                        entry = sk_X509_NAME_ENTRY_value(entries, j);
                        entry->set = i;
-                       if(!sk_X509_NAME_ENTRY_push(nm->entries, entry))
+                       if(!sk_X509_NAME_ENTRY_push(nm.x->entries, entry))
                                goto err;
                }
                sk_X509_NAME_ENTRY_free(entries);
        }
-       sk_free(intname);
-       nm->modified = 0;
-       *val = (ASN1_VALUE *)nm;
+       sk_free(intname.s);
+       nm.x->modified = 0;
+       *val = nm.a;
        *in = p;
        return ret;
-       err:
-       ASN1err(ASN1_F_D2I_X509_NAME, ERR_R_NESTED_ASN1_ERROR);
+err:
+        if (nm.x != NULL)
+               X509_NAME_free(nm.x);
+       ASN1err(ASN1_F_X509_NAME_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
        return 0;
 }
 
@@ -218,34 +221,36 @@ static int x509_name_ex_i2d(ASN1_VALUE **val, unsigned char **out, const ASN1_IT
 
 static int x509_name_encode(X509_NAME *a)
 {
-       STACK *intname = NULL;
+       union { STACK *s; ASN1_VALUE *a; } intname = {NULL};
        int len;
        unsigned char *p;
        STACK_OF(X509_NAME_ENTRY) *entries = NULL;
        X509_NAME_ENTRY *entry;
        int i, set = -1;
-       intname = sk_new_null();
-       if(!intname) goto memerr;
+       intname.s = sk_new_null();
+       if(!intname.s) goto memerr;
        for(i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
                entry = sk_X509_NAME_ENTRY_value(a->entries, i);
                if(entry->set != set) {
                        entries = sk_X509_NAME_ENTRY_new_null();
                        if(!entries) goto memerr;
-                       if(!sk_push(intname, (char *)entries)) goto memerr;
+                       if(!sk_push(intname.s, (char *)entries)) goto memerr;
                        set = entry->set;
                }
                if(!sk_X509_NAME_ENTRY_push(entries, entry)) goto memerr;
        }
-       len = ASN1_item_ex_i2d((ASN1_VALUE **)&intname, NULL, ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);
+       len = ASN1_item_ex_i2d(&intname.a, NULL,
+                              ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);
        if (!BUF_MEM_grow(a->bytes,len)) goto memerr;
        p=(unsigned char *)a->bytes->data;
-       ASN1_item_ex_i2d((ASN1_VALUE **)&intname, &p, ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);
-       sk_pop_free(intname, sk_internal_free);
+       ASN1_item_ex_i2d(&intname.a,
+                        &p, ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);
+       sk_pop_free(intname.s, sk_internal_free);
        a->modified = 0;
        return len;
        memerr:
-       sk_pop_free(intname, sk_internal_free);
-       ASN1err(ASN1_F_D2I_X509_NAME, ERR_R_MALLOC_FAILURE);
+       sk_pop_free(intname.s, sk_internal_free);
+       ASN1err(ASN1_F_X509_NAME_ENCODE, ERR_R_MALLOC_FAILURE);
        return -1;
 }