From 75090e0365d6d441d5ea8495c2afc6c83d5eb886 Mon Sep 17 00:00:00 2001
From: "Dr. Stephen Henson" <steve@openssl.org>
Date: Sat, 24 Feb 2001 01:46:46 +0000
Subject: [PATCH] Stop PKCS7_verify() core dumping with unknown public key
 algorithms and leaking if the signature verify fails.

---
 CHANGES                  |  5 +++++
 crypto/pkcs7/pk7_doit.c  |  5 +++++
 crypto/pkcs7/pk7_smime.c | 13 +++++--------
 3 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/CHANGES b/CHANGES
index 25987622a9..3e6569abd8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,11 @@
 
  Changes between 0.9.6 and 0.9.6a  [xx XXX 2001]
 
+  *) Avoid coredump with unsupported or invalid public keys by checking if
+     X509_get_pubkey() fails in PKCS7_verify(). Fix memory leak when
+     PKCS7_verify() fails with non detached data.
+     [Steve Henson]
+
   *) Don't use getenv in library functions when run as setuid/setgid.
      New function OPENSSL_issetugid().
      [Ulf Moeller]
diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c
index 099e9651c1..93ad9a45b8 100644
--- a/crypto/pkcs7/pk7_doit.c
+++ b/crypto/pkcs7/pk7_doit.c
@@ -783,6 +783,11 @@ for (ii=0; ii<md_len; ii++) printf("%02X",md_dat[ii]); printf(" calc\n");
 
 	os=si->enc_digest;
 	pkey = X509_get_pubkey(x509);
+	if (!pkey)
+		{
+		ret = -1;
+		goto err;
+		}
 	if(pkey->type == EVP_PKEY_DSA) mdc_tmp.digest=EVP_dss1();
 
 	i=EVP_VerifyFinal(&mdc_tmp,os->data,os->length, pkey);
diff --git a/crypto/pkcs7/pk7_smime.c b/crypto/pkcs7/pk7_smime.c
index d716f9faeb..3d3214f5ee 100644
--- a/crypto/pkcs7/pk7_smime.c
+++ b/crypto/pkcs7/pk7_smime.c
@@ -153,7 +153,7 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
 	PKCS7_SIGNER_INFO *si;
 	X509_STORE_CTX cert_ctx;
 	char buf[4096];
-	int i, j=0, k;
+	int i, j=0, k, ret = 0;
 	BIO *p7bio;
 	BIO *tmpout;
 
@@ -258,18 +258,15 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
 		}
 	}
 
-	sk_X509_free(signers);
-	if(indata) BIO_pop(p7bio);
-	BIO_free_all(p7bio);
-
-	return 1;
+	ret = 1;
 
 	err:
 
+	if(indata) BIO_pop(p7bio);
+	BIO_free_all(p7bio);
 	sk_X509_free(signers);
-	BIO_free(p7bio);
 
-	return 0;
+	return ret;
 }
 
 STACK_OF(X509) *PKCS7_get0_signers(PKCS7 *p7, STACK_OF(X509) *certs, int flags)
-- 
2.25.1