Check the return values where memory allocation failures may happen.

PR: 49

diff --git a/crypto/asn1/a_enum.c b/crypto/asn1/a_enum.c
index 1428d1df7a499c18510ec8e5de8f70f8887f5605..74b1414a91b21ee11c4626914bc3c7f8f7b5088b 100644 (file)
--- a/crypto/asn1/a_enum.c
+++ b/crypto/asn1/a_enum.c
@@ -205,7 +205,17 @@ ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
        else ret->type=V_ASN1_ENUMERATED;
        j=BN_num_bits(bn);
        len=((j == 0)?0:((j/8)+1));
-       ret->data=(unsigned char *)OPENSSL_malloc(len+4);
+       if (ret->length < len+4)
+               {
+               char *new_data=(char *)OPENSSL_realloc(ret->data, len+4);
+               if (!new_data)
+                       {
+                       ASN1err(ASN1_F_BN_TO_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);
+                       goto err;
+                       }
+               ret->data=new_data;
+               }
+
        ret->length=BN_bn2bin(bn,ret->data);
        return(ret);
 err:

diff --git a/crypto/asn1/a_int.c b/crypto/asn1/a_int.c
index 6f0413f885c16e8297c3fd9a7a25e612bdff23ee..7b39519e5cb9ec8e5f167537145e48ca605a6d6b 100644 (file)
--- a/crypto/asn1/a_int.c
+++ b/crypto/asn1/a_int.c
@@ -451,7 +451,16 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
        else ret->type=V_ASN1_INTEGER;
        j=BN_num_bits(bn);
        len=((j == 0)?0:((j/8)+1));
-       ret->data=(unsigned char *)OPENSSL_malloc(len+4);
+       if (ret->length < len+4)
+               {
+               char *new_data=(char *)OPENSSL_realloc(ret->data, len+4);
+               if (!new_data)
+                       {
+                       ASN1err(ASN1_F_BN_TO_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);
+                       goto err;
+                       }
+               ret->data=new_data;
+               }
        ret->length=BN_bn2bin(bn,ret->data);
        return(ret);
 err:

diff --git a/crypto/asn1/a_set.c b/crypto/asn1/a_set.c
index caf5a1419c98cbe201acbacfc8e24b99ecd58eab..5b0938e97b1cce570671103b21c425a8d0cf7fc0 100644 (file)
--- a/crypto/asn1/a_set.c
+++ b/crypto/asn1/a_set.c
@@ -116,7 +116,7 @@ int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
                }
 
         pStart  = p; /* Catch the beg of Setblobs*/
-        rgSetBlob = (MYBLOB *)OPENSSL_malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array
+        if (!(rgSetBlob = (MYBLOB *)OPENSSL_malloc( sk_num(a) * sizeof(MYBLOB)))) return 0; /* In this array
 we will store the SET blobs */
 
         for (i=0; i<sk_num(a); i++)
@@ -133,7 +133,7 @@ SetBlob
  /* Now we have to sort the blobs. I am using a simple algo.
     *Sort ptrs *Copy to temp-mem *Copy from temp-mem to user-mem*/
         qsort( rgSetBlob, sk_num(a), sizeof(MYBLOB), SetBlobCmp);
-        pTempMem = OPENSSL_malloc(totSize);
+        if (!(pTempMem = OPENSSL_malloc(totSize))) return 0;
 
 /* Copy to temp mem */
         p = pTempMem;

diff --git a/crypto/asn1/x_pubkey.c b/crypto/asn1/x_pubkey.c
index 4397a404b56f812426971341ad5472d470d2b140..914bcda689454253c0ee49979f9d446a3afca6db 100644 (file)
--- a/crypto/asn1/x_pubkey.c
+++ b/crypto/asn1/x_pubkey.c
@@ -156,7 +156,7 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
                dsa->write_params=0;
                ASN1_TYPE_free(a->parameter);
                i=i2d_DSAparams(dsa,NULL);
-               p=(unsigned char *)OPENSSL_malloc(i);
+               if ((p=(unsigned char *)OPENSSL_malloc(i)) == NULL) goto err;
                pp=p;
                i2d_DSAparams(dsa,&pp);
                a->parameter=ASN1_TYPE_new();

diff --git a/crypto/bio/bf_nbio.c b/crypto/bio/bf_nbio.c
index 413ef5c4c5e943bb4a342e00872317639c2a7c16..988cd5ae006e64f944e994f91934ab10e232ece1 100644 (file)
--- a/crypto/bio/bf_nbio.c
+++ b/crypto/bio/bf_nbio.c
@@ -104,7 +104,7 @@ static int nbiof_new(BIO *bi)
        {
        NBIO_TEST *nt;
 
-       nt=(NBIO_TEST *)OPENSSL_malloc(sizeof(NBIO_TEST));
+       if (!(nt=(NBIO_TEST *)OPENSSL_malloc(sizeof(NBIO_TEST)))) return(0);
        nt->lrn= -1;
        nt->lwn= -1;
        bi->ptr=(char *)nt;

diff --git a/crypto/bn/bn_div.c b/crypto/bn/bn_div.c
index 613a2688237a1bf41ad30f0f0019379291f78987..903ab2ee2e61e081574b4ebe33e0d161618a1a9b 100644 (file)
--- a/crypto/bn/bn_div.c
+++ b/crypto/bn/bn_div.c
@@ -190,10 +190,10 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
 
        /* First we normalise the numbers */
        norm_shift=BN_BITS2-((BN_num_bits(divisor))%BN_BITS2);
-       BN_lshift(sdiv,divisor,norm_shift);
+       if (!(BN_lshift(sdiv,divisor,norm_shift))) goto err;
        sdiv->neg=0;
        norm_shift+=BN_BITS2;
-       BN_lshift(snum,num,norm_shift);
+       if (!(BN_lshift(snum,num,norm_shift))) goto err;
        snum->neg=0;
        div_n=sdiv->top;
        num_n=snum->top;
@@ -315,7 +315,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                tmp->top=j;
 
                j=wnum.top;
-               BN_sub(&wnum,&wnum,tmp);
+               if (!BN_sub(&wnum,&wnum,tmp)) goto err;
 
                snum->top=snum->top+wnum.top-j;
 
@@ -323,7 +323,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                        {
                        q--;
                        j=wnum.top;
-                       BN_add(&wnum,&wnum,sdiv);
+                       if (!BN_add(&wnum,&wnum,sdiv)) goto err;
                        snum->top+=wnum.top-j;
                        }
                *(resp--)=q;

diff --git a/crypto/bn/bn_gcd.c b/crypto/bn/bn_gcd.c
index 398207196be841403cc5c2b3caf36e9c7cb8e9a4..e8cc6c5cb5df3951863904772aa936dc4e3a1484 100644 (file)
--- a/crypto/bn/bn_gcd.c
+++ b/crypto/bn/bn_gcd.c
@@ -168,8 +168,8 @@ BIGNUM *BN_mod_inverse(BIGNUM *in, BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
                R=in;
        if (R == NULL) goto err;
 
-       BN_zero(X);
-       BN_one(Y);
+       if (!BN_zero(X)) goto err;
+       if (!BN_one(Y)) goto err;
        if (BN_copy(A,a) == NULL) goto err;
        if (BN_copy(B,n) == NULL) goto err;
        sign=1;

diff --git a/crypto/bn/bn_mont.c b/crypto/bn/bn_mont.c
index 8cf1febaccad8579bcc13d91caf55d520d1c25e1..1daf50783c87a5255293777286c65b3093624e81 100644 (file)
--- a/crypto/bn/bn_mont.c
+++ b/crypto/bn/bn_mont.c
@@ -224,7 +224,7 @@ int BN_from_montgomery(BIGNUM *ret, BIGNUM *a, BN_MONT_CTX *mont,
 
        if (!BN_mul(t1,t2,&mont->N,ctx)) goto err;
        if (!BN_add(t2,a,t1)) goto err;
-       BN_rshift(ret,t2,mont->ri);
+       if (!BN_rshift(ret,t2,mont->ri)) goto err;
 #endif /* MONT_WORD */
 
        if (BN_ucmp(ret, &(mont->N)) >= 0)
@@ -284,8 +284,8 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
                BN_ULONG buf[2];
 
                mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
-               BN_zero(R);
-               BN_set_bit(R,BN_BITS2);                 /* R */
+               if (!(BN_zero(R))) goto err;
+               if (!(BN_set_bit(R,BN_BITS2))) goto err;        /* R */
 
                buf[0]=mod->d[0]; /* tmod = N mod word size */
                buf[1]=0;
@@ -296,36 +296,44 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
                                                        /* Ri = R^-1 mod N*/
                if ((BN_mod_inverse(&Ri,R,&tmod,ctx)) == NULL)
                        goto err;
-               BN_lshift(&Ri,&Ri,BN_BITS2);            /* R*Ri */
+               /* R*Ri */
+               if (!(BN_lshift(&Ri,&Ri,BN_BITS2))) goto err;
                if (!BN_is_zero(&Ri))
-                       BN_sub_word(&Ri,1);
+                       {
+                       if (!BN_sub_word(&Ri,1)) goto err;
+                       }
                else /* if N mod word size == 1 */
-                       BN_set_word(&Ri,BN_MASK2);  /* Ri-- (mod word size) */
-               BN_div(&Ri,NULL,&Ri,&tmod,ctx); /* Ni = (R*Ri-1)/N,
-                                                * keep only least significant word: */
+                       /* Ri-- (mod word size) */
+                       {
+                       if (!BN_set_word(&Ri,BN_MASK2)) goto err;
+                       }
+               /* Ni = (R*Ri-1)/N, keep only least significant word: */
+                if (!(BN_div(&Ri,NULL,&Ri,&tmod,ctx))) goto err;
                mont->n0=Ri.d[0];
                BN_free(&Ri);
                }
 #else /* !MONT_WORD */
                { /* bignum version */
                mont->ri=BN_num_bits(mod);
-               BN_zero(R);
-               BN_set_bit(R,mont->ri);                 /* R = 2^ri */
+               if (!(BN_zero(R))) goto err;
+               /* R = 2^ri */
+               if (!(BN_set_bit(R,mont->ri))) goto err;
                                                        /* Ri = R^-1 mod N*/
                if ((BN_mod_inverse(&Ri,R,mod,ctx)) == NULL)
                        goto err;
-               BN_lshift(&Ri,&Ri,mont->ri);            /* R*Ri */
-               BN_sub_word(&Ri,1);
+               /* R*Ri */
+               if (!(BN_lshift(&Ri,&Ri,mont->ri))) goto err;
+               if (!(BN_sub_word(&Ri,1))) goto err;
                                                        /* Ni = (R*Ri-1) / N */
-               BN_div(&(mont->Ni),NULL,&Ri,mod,ctx);
+               if (!(BN_div(&(mont->Ni),NULL,&Ri,mod,ctx))) goto err;
                BN_free(&Ri);
                }
 #endif
 
        /* setup RR for conversions */
-       BN_zero(&(mont->RR));
-       BN_set_bit(&(mont->RR),mont->ri*2);
-       BN_mod(&(mont->RR),&(mont->RR),&(mont->N),ctx);
+       if (!(BN_zero(&(mont->RR)))) goto err;
+       if (!(BN_set_bit(&(mont->RR),mont->ri*2))) goto err;
+       if (!(BN_mod(&(mont->RR),&(mont->RR),&(mont->N),ctx))) goto err;
 
        return(1);
 err:
@@ -336,9 +344,9 @@ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from)
        {
        if (to == from) return(to);
 
-       BN_copy(&(to->RR),&(from->RR));
-       BN_copy(&(to->N),&(from->N));
-       BN_copy(&(to->Ni),&(from->Ni));
+       if (!(BN_copy(&(to->RR),&(from->RR)))) return NULL;
+       if (!(BN_copy(&(to->N),&(from->N)))) return NULL;
+       if (!(BN_copy(&(to->Ni),&(from->Ni)))) return NULL;
        to->ri=from->ri;
        to->n0=from->n0;
        return(to);

diff --git a/crypto/bn/bn_mul.c b/crypto/bn/bn_mul.c
index 3e8d8b9567a89af94383b8e6120a78cb060a55a5..90592718d67d250914e42ed07e511d061834261d 100644 (file)
--- a/crypto/bn/bn_mul.c
+++ b/crypto/bn/bn_mul.c
@@ -634,7 +634,7 @@ int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
 
        if ((al == 0) || (bl == 0))
                {
-               BN_zero(r);
+               if (!BN_zero(r)) goto err;
                return(1);
                }
        top=al+bl;
@@ -677,14 +677,14 @@ int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
                {
                if (i == 1 && !BN_get_flags(b,BN_FLG_STATIC_DATA))
                        {
-                       bn_wexpand(b,al);
+                       if (bn_wexpand(b,al) == NULL) goto err;
                        b->d[bl]=0;
                        bl++;
                        i--;
                        }
                else if (i == -1 && !BN_get_flags(a,BN_FLG_STATIC_DATA))
                        {
-                       bn_wexpand(a,bl);
+                       if (bn_wexpand(a,bl) == NULL) goto err;
                        a->d[al]=0;
                        al++;
                        i++;
@@ -699,16 +699,16 @@ int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
                        t = BN_CTX_get(ctx);
                        if (al == j) /* exact multiple */
                                {
-                               bn_wexpand(t,k*2);
-                               bn_wexpand(rr,k*2);
+                               if (bn_wexpand(t,k*2) == NULL) goto err;
+                               if (bn_wexpand(rr,k*2) == NULL) goto err;
                                bn_mul_recursive(rr->d,a->d,b->d,al,t->d);
                                }
                        else
                                {
-                               bn_wexpand(a,k);
-                               bn_wexpand(b,k);
-                               bn_wexpand(t,k*4);
-                               bn_wexpand(rr,k*4);
+                               if (bn_wexpand(a,k) == NULL ) goto err;
+                               if (bn_wexpand(b,k) == NULL ) goto err;
+                               if (bn_wexpand(t,k*4) == NULL ) goto err;
+                               if (bn_wexpand(rr,k*4) == NULL ) goto err;
                                for (i=a->top; i<k; i++)
                                        a->d[i]=0;
                                for (i=b->top; i<k; i++)

diff --git a/crypto/evp/bio_enc.c b/crypto/evp/bio_enc.c
index 831c71a2b5988f598aad4efdd8ae20729404a07f..c425a971afb2a4637573880d1c8409bdae0fbc8b 100644 (file)
--- a/crypto/evp/bio_enc.c
+++ b/crypto/evp/bio_enc.c
@@ -106,8 +106,8 @@ static int enc_new(BIO *bi)
        BIO_ENC_CTX *ctx;
 
        ctx=(BIO_ENC_CTX *)OPENSSL_malloc(sizeof(BIO_ENC_CTX));
-       EVP_CIPHER_CTX_init(&ctx->cipher);
        if (ctx == NULL) return(0);
+       EVP_CIPHER_CTX_init(&ctx->cipher);
 
        ctx->buf_len=0;
        ctx->buf_off=0;

diff --git a/crypto/objects/o_names.c b/crypto/objects/o_names.c
index dca988230e8c69ac4a382d8c2331ee23895bc5f2..5eaf95b12f978c1b5eadf90410b2a6fd70361e80 100644 (file)
--- a/crypto/objects/o_names.c
+++ b/crypto/objects/o_names.c
@@ -61,6 +61,8 @@ int OBJ_NAME_new_index(unsigned long (*hash_func)(const char *),
                {
                MemCheck_off();
                name_funcs = OPENSSL_malloc(sizeof(NAME_FUNCS));
+               MemCheck_on();
+               if (!name_funcs) return(0);
                name_funcs->hash_func = lh_strhash;
                name_funcs->cmp_func = (int (*)())strcmp;
                name_funcs->free_func = 0; /* NULL is often declared to
@@ -68,6 +70,7 @@ int OBJ_NAME_new_index(unsigned long (*hash_func)(const char *),
                                            * to Compaq C is not really
                                            * compatible with a function
                                            * pointer.  -- Richard Levitte*/
+               MemCheck_off();
                sk_NAME_FUNCS_push(name_funcs_stack,name_funcs);
                MemCheck_on();
                }

diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c
index d802c4d09cdfc294f3b9c43ee4f284a04e9c6e0b..95ea4bfed304fe854ccac80b90d735b6db67be13 100644 (file)
--- a/crypto/objects/obj_dat.c
+++ b/crypto/objects/obj_dat.c
@@ -228,7 +228,7 @@ int OBJ_add_object(ASN1_OBJECT *obj)
        if (added == NULL)
                if (!init_added()) return(0);
        if ((o=OBJ_dup(obj)) == NULL) goto err;
-       ao[ADDED_NID]=(ADDED_OBJ *)OPENSSL_malloc(sizeof(ADDED_OBJ));
+       if (!(ao[ADDED_NID]=(ADDED_OBJ *)OPENSSL_malloc(sizeof(ADDED_OBJ)))) goto err;
        if ((o->length != 0) && (obj->data != NULL))
                ao[ADDED_DATA]=(ADDED_OBJ *)OPENSSL_malloc(sizeof(ADDED_OBJ));
        if (o->sn != NULL)

diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index b209a86ea0cdbe4fe54c9f6f2d51c3c8ade6828a..a45cf76c68730a9b76ce242e73e6628383f49b76 100644 (file)
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -621,7 +621,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio)
                                x=i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,NULL,
                                           i2d_X509_ATTRIBUTE,
                                           V_ASN1_SET,V_ASN1_UNIVERSAL,IS_SET);
-                               pp=(unsigned char *)OPENSSL_malloc(x);
+                               if (!(pp=(unsigned char *)OPENSSL_malloc(x))) goto err;
                                p=pp;
                                i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,&p,
                                           i2d_X509_ATTRIBUTE,
@@ -817,7 +817,7 @@ for (ii=0; ii<md_len; ii++) printf("%02X",md_dat[ii]); printf(" calc\n");
                 */
                i=i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,NULL,i2d_X509_ATTRIBUTE,
                        V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);
-               pp=OPENSSL_malloc(i);
+               if (!(pp=OPENSSL_malloc(i))) goto err;
                p=pp;
                i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,&p,i2d_X509_ATTRIBUTE,
                        V_ASN1_SET,V_ASN1_UNIVERSAL, IS_SEQUENCE);

diff --git a/crypto/rsa/rsa_eay.c b/crypto/rsa/rsa_eay.c
index cafdc419e26556bff814c2f48e6dacab0e74ea72..0112b5c6326eef2c46d0fb0ba30d3acb2b93f406 100644 (file)
--- a/crypto/rsa/rsa_eay.c
+++ b/crypto/rsa/rsa_eay.c
@@ -476,10 +476,10 @@ static int RSA_eay_mod_exp(BIGNUM *r0, BIGNUM *I, RSA *rsa)
        int ret=0;
        BN_CTX *ctx;
 
-       if ((ctx=BN_CTX_new()) == NULL) goto err;
        BN_init(&m1);
        BN_init(&r1);
        BN_init(&vrfy);
+       if ((ctx=BN_CTX_new()) == NULL) goto err;
 
        if (rsa->flags & RSA_FLAG_CACHE_PRIVATE)
                {

diff --git a/crypto/txt_db/txt_db.c b/crypto/txt_db/txt_db.c
index 3b04fe280c37888c32e57895ebedfa6ec4b4d10f..92fcbde47fafee8b77ba4c8118d349232a789361 100644 (file)
--- a/crypto/txt_db/txt_db.c
+++ b/crypto/txt_db/txt_db.c
@@ -122,7 +122,7 @@ TXT_DB *TXT_DB_read(BIO *in, int num)
                else
                        {
                        buf->data[offset-1]='\0'; /* blat the '\n' */
-                       p=(char *)OPENSSL_malloc(add+offset);
+                       if (!(p=(char *)OPENSSL_malloc(add+offset))) goto err;
                        offset=0;
                        }
                pp=(char **)p;

diff --git a/crypto/x509v3/v3_ia5.c b/crypto/x509v3/v3_ia5.c
index f3bba382693176d066656a7f95ad28f371f164ef..f9414456de27016159bf6da9ba580759b48e4ee8 100644 (file)
--- a/crypto/x509v3/v3_ia5.c
+++ b/crypto/x509v3/v3_ia5.c
@@ -82,7 +82,7 @@ static char *i2s_ASN1_IA5STRING(X509V3_EXT_METHOD *method,
 {
        char *tmp;
        if(!ia5 || !ia5->length) return NULL;
-       tmp = OPENSSL_malloc(ia5->length + 1);
+       if (!(tmp = OPENSSL_malloc(ia5->length + 1))) return NULL;
        memcpy(tmp, ia5->data, ia5->length);
        tmp[ia5->length] = 0;
        return tmp;