Fix free of garbage pointer. PR#3595

Reviewed-by: Emilia Käsper <emilia@openssl.org>

diff --git a/crypto/ec/ec_mult.c b/crypto/ec/ec_mult.c
index fb693c328d4d0eb09e0d695047ea9431cfc21c4c..334b39d86e931e10c5eebb22e5904f640f16b7e1 100644 (file)
--- a/crypto/ec/ec_mult.c
+++ b/crypto/ec/ec_mult.c
@@ -447,15 +447,16 @@ int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
        wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
        wNAF     = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]); /* includes space for pivot */
        val_sub  = OPENSSL_malloc(totalnum * sizeof val_sub[0]);
-                
+
+       /* Ensure wNAF is initialised in case we end up going to err */
+       if (wNAF) wNAF[0] = NULL;       /* preliminary pivot */
+
        if (!wsize || !wNAF_len || !wNAF || !val_sub)
                {
                ECerr(EC_F_EC_WNAF_MUL, ERR_R_MALLOC_FAILURE);
                goto err;
                }
 
-       wNAF[0] = NULL; /* preliminary pivot */
-
        /* num_val will be the total number of temporarily precomputed points */
        num_val = 0;