From 8bc6b51ce2eba016d35e1524250c17f1c5de9911 Mon Sep 17 00:00:00 2001 From: FdaSilvaYY Date: Fri, 11 Aug 2017 15:41:55 +0200 Subject: [PATCH] Fix possible leaks on sk_X509_EXTENSION_push() failure ... Reviewed-by: Rich Salz Reviewed-by: Andy Polyakov (Merged from https://github.com/openssl/openssl/pull/4677) (cherry picked from commit 1687aa760cdd164b12c5b70e65cadcbce1e7ccfa) --- crypto/x509v3/v3_lib.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/crypto/x509v3/v3_lib.c b/crypto/x509v3/v3_lib.c index a3ca720fe1..d7143086bc 100644 --- a/crypto/x509v3/v3_lib.c +++ b/crypto/x509v3/v3_lib.c @@ -120,6 +120,7 @@ const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid) X509V3_EXT_METHOD tmp; const X509V3_EXT_METHOD *t = &tmp, *const *ret; int idx; + if (nid < 0) return NULL; tmp.ext_nid = nid; @@ -231,6 +232,7 @@ void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *x, int nid, int *crit, { int lastpos, i; X509_EXTENSION *ex, *found_ex = NULL; + if (!x) { if (idx) *idx = -1; @@ -284,9 +286,9 @@ void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *x, int nid, int *crit, int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value, int crit, unsigned long flags) { - int extidx = -1; - int errcode; - X509_EXTENSION *ext, *extmp; + int errcode, extidx = -1; + X509_EXTENSION *ext = NULL, *extmp; + STACK_OF(X509_EXTENSION) *ret = NULL; unsigned long ext_op = flags & X509V3_ADD_OP_MASK; /* @@ -345,14 +347,23 @@ int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value, return 1; } + ret = *x; if (*x == NULL - && (*x = sk_X509_EXTENSION_new_null()) == NULL) - return -1; - if (!sk_X509_EXTENSION_push(*x, ext)) - return -1; + && (ret = sk_X509_EXTENSION_new_null()) == NULL) + goto m_fail; + if (!sk_X509_EXTENSION_push(ret, ext)) + goto m_fail; + *x = ret; return 1; + m_fail: + /* X509V3err(X509V3_F_X509V3_ADD1_I2D, ERR_R_MALLOC_FAILURE); */ + if (ret != *x) + sk_X509_EXTENSION_free(ret); + X509_EXTENSION_free(ext); + return -1; + err: if (!(flags & X509V3_ADD_SILENT)) X509V3err(X509V3_F_X509V3_ADD1_I2D, errcode); -- 2.25.1