From: Kurt Roeckx <kurt@roeckx.be>
Date: Mon, 23 May 2016 21:09:33 +0000 (+0200)
Subject: Avoid creating an illegal pointer
X-Git-Tag: OpenSSL_1_1_0-pre6~705
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=73b61c7e14115ae98c174bfdd7c7733d6cc7e909;p=oweals%2Fopenssl.git

Avoid creating an illegal pointer

Found by tis-interpreter

Reviewed-by: Richard Levitte <levitte@openssl.org>

GH: #1115
---

diff --git a/crypto/asn1/tasn_fre.c b/crypto/asn1/tasn_fre.c
index 147168090a..9b623d907c 100644
--- a/crypto/asn1/tasn_fre.c
+++ b/crypto/asn1/tasn_fre.c
@@ -102,9 +102,11 @@ static void asn1_item_embed_free(ASN1_VALUE **pval, const ASN1_ITEM *it,
          * field and we wont be able to determine the type of the field it
          * defines. So free up in reverse order.
          */
-        tt = it->templates + it->tcount - 1;
-        for (i = 0; i < it->tcount; tt--, i++) {
+        tt = it->templates + it->tcount;
+        for (i = 0; i < it->tcount; i++) {
             ASN1_VALUE **pseqval;
+
+            tt--;
             seqtt = asn1_do_adb(pval, tt, 0);
             if (!seqtt)
                 continue;