From: Matt Caswell <matt@openssl.org>
Date: Thu, 28 Apr 2016 16:05:21 +0000 (+0100)
Subject: The x509_name_canon function doesn't check for an error return
X-Git-Tag: OpenSSL_1_1_0-pre6~992
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=ed3eb5e0cca0ac88908e5d718ac0137d0150ddb3;p=oweals%2Fopenssl.git

The x509_name_canon function doesn't check for an error return

i2d_name_canon can return a negative number on error. We should check it
before continuing.

Reviewed-by: Rich Salz <rsalz@openssl.org>
---

diff --git a/crypto/x509/x_name.c b/crypto/x509/x_name.c
index 5e6abebbea..cd6c719044 100644
--- a/crypto/x509/x_name.c
+++ b/crypto/x509/x_name.c
@@ -335,7 +335,7 @@ static int x509_name_canon(X509_NAME *a)
     STACK_OF(STACK_OF_X509_NAME_ENTRY) *intname = NULL;
     STACK_OF(X509_NAME_ENTRY) *entries = NULL;
     X509_NAME_ENTRY *entry, *tmpentry = NULL;
-    int i, set = -1, ret = 0;
+    int i, set = -1, ret = 0, len;
 
     OPENSSL_free(a->canon_enc);
     a->canon_enc = NULL;
@@ -370,7 +370,10 @@ static int x509_name_canon(X509_NAME *a)
 
     /* Finally generate encoding */
 
-    a->canon_enclen = i2d_name_canon(intname, NULL);
+    len = i2d_name_canon(intname, NULL);
+    if (len < 0)
+        goto err;
+    a->canon_enclen = len;
 
     p = OPENSSL_malloc(a->canon_enclen);