Actually there were two error cases that could return without releasing the

lock - stupidly, my last change addressed only one of them.

diff --git a/crypto/engine/engine_lib.c b/crypto/engine/engine_lib.c
index 781494d1a96bbde8bb3bb124455afb1c57b1584e..99b031fe9686a1379b8f85a0003b799d1991f531 100644 (file)
--- a/crypto/engine/engine_lib.c
+++ b/crypto/engine/engine_lib.c
@@ -288,20 +288,21 @@ EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id,
 
 int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
        {
-       int ctrl_exists;
+       int ctrl_exists, ref_exists;
        if(e == NULL)
                {
                ENGINEerr(ENGINE_F_ENGINE_CTRL,ERR_R_PASSED_NULL_PARAMETER);
                return 0;
                }
        CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
-       if(e->struct_ref == 0)
+       ref_exists = ((e->struct_ref > 0) ? 1 : 0);
+       ctrl_exists = (e->ctrl ? 1 : 0);
+       CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+       if(!ref_exists)
                {
                ENGINEerr(ENGINE_F_ENGINE_CTRL,ENGINE_R_NO_REFERENCE);
                return 0;
                }
-       ctrl_exists = (e->ctrl ? 1 : 0);
-       CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
        if (!ctrl_exists)
                {
                ENGINEerr(ENGINE_F_ENGINE_CTRL,ENGINE_R_NO_CONTROL_FUNCTION);