From: Matt Caswell <matt@openssl.org>
Date: Wed, 21 Sep 2016 14:49:28 +0000 (+0100)
Subject: Don't leak on an OPENSSL_realloc() failure
X-Git-Tag: OpenSSL_1_1_1-pre1~3478
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=41bff723c6784cc846054a4fd4add6dbec8c2c64;p=oweals%2Fopenssl.git

Don't leak on an OPENSSL_realloc() failure

If OPENSSL_sk_insert() calls OPENSSL_realloc() and it fails, it was leaking
the originally allocated memory.

Reviewed-by: Rich Salz <rsalz@openssl.org>
---

diff --git a/crypto/stack/stack.c b/crypto/stack/stack.c
index 1d01936e00..43ddf30ac1 100644
--- a/crypto/stack/stack.c
+++ b/crypto/stack/stack.c
@@ -126,6 +126,7 @@ int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)
 
     if (st->num_alloc <= (size_t)(st->num + 1)) {
         size_t doub_num_alloc = st->num_alloc * 2;
+        const char **tmpdata;
 
         /* Overflow checks */
         if (doub_num_alloc < st->num_alloc)
@@ -135,17 +136,12 @@ int OPENSSL_sk_insert(OPENSSL_STACK *st, const void *data, int loc)
         if (doub_num_alloc > SIZE_MAX / sizeof(char *))
             return 0;
 
-        st->data = OPENSSL_realloc((char *)st->data,
-                                   sizeof(char *) * doub_num_alloc);
-        if (st->data == NULL) {
-            /*
-             * Reset these counters to prevent subsequent operations on
-             * (now non-existing) heap memory
-             */
-            st->num_alloc = 0;
-            st->num = 0;
+        tmpdata = OPENSSL_realloc((char *)st->data,
+                                  sizeof(char *) * doub_num_alloc);
+        if (tmpdata == NULL)
             return 0;
-        }
+
+        st->data = tmpdata;
         st->num_alloc = doub_num_alloc;
     }
     if ((loc >= st->num) || (loc < 0)) {