From d66c022a1f6835e73bccf9a8b11869cbe20814a7 Mon Sep 17 00:00:00 2001 From: Richard Levitte Date: Thu, 30 May 2002 16:49:00 +0000 Subject: [PATCH] Check the return values where memory allocation failures may happen. PR: 49 --- crypto/asn1/a_enum.c | 12 ++++++++++- crypto/asn1/a_int.c | 11 +++++++++- crypto/asn1/a_set.c | 4 ++-- crypto/asn1/x_pubkey.c | 2 +- crypto/bio/bf_nbio.c | 2 +- crypto/bn/bn_div.c | 8 +++---- crypto/bn/bn_gcd.c | 4 ++-- crypto/bn/bn_mont.c | 46 +++++++++++++++++++++++----------------- crypto/bn/bn_mul.c | 18 ++++++++-------- crypto/evp/bio_enc.c | 2 +- crypto/objects/o_names.c | 3 +++ crypto/objects/obj_dat.c | 2 +- crypto/pkcs7/pk7_doit.c | 4 ++-- crypto/rsa/rsa_eay.c | 2 +- crypto/txt_db/txt_db.c | 2 +- crypto/x509v3/v3_ia5.c | 2 +- 16 files changed, 77 insertions(+), 47 deletions(-) diff --git a/crypto/asn1/a_enum.c b/crypto/asn1/a_enum.c index 1428d1df7a..74b1414a91 100644 --- a/crypto/asn1/a_enum.c +++ b/crypto/asn1/a_enum.c @@ -205,7 +205,17 @@ ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai) else ret->type=V_ASN1_ENUMERATED; j=BN_num_bits(bn); len=((j == 0)?0:((j/8)+1)); - ret->data=(unsigned char *)OPENSSL_malloc(len+4); + if (ret->length < len+4) + { + char *new_data=(char *)OPENSSL_realloc(ret->data, len+4); + if (!new_data) + { + ASN1err(ASN1_F_BN_TO_ASN1_INTEGER,ERR_R_MALLOC_FAILURE); + goto err; + } + ret->data=new_data; + } + ret->length=BN_bn2bin(bn,ret->data); return(ret); err: diff --git a/crypto/asn1/a_int.c b/crypto/asn1/a_int.c index 6f0413f885..7b39519e5c 100644 --- a/crypto/asn1/a_int.c +++ b/crypto/asn1/a_int.c @@ -451,7 +451,16 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai) else ret->type=V_ASN1_INTEGER; j=BN_num_bits(bn); len=((j == 0)?0:((j/8)+1)); - ret->data=(unsigned char *)OPENSSL_malloc(len+4); + if (ret->length < len+4) + { + char *new_data=(char *)OPENSSL_realloc(ret->data, len+4); + if (!new_data) + { + ASN1err(ASN1_F_BN_TO_ASN1_INTEGER,ERR_R_MALLOC_FAILURE); + goto err; + } + ret->data=new_data; + } ret->length=BN_bn2bin(bn,ret->data); return(ret); err: diff --git a/crypto/asn1/a_set.c b/crypto/asn1/a_set.c index caf5a1419c..5b0938e97b 100644 --- a/crypto/asn1/a_set.c +++ b/crypto/asn1/a_set.c @@ -116,7 +116,7 @@ int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag, } pStart = p; /* Catch the beg of Setblobs*/ - rgSetBlob = (MYBLOB *)OPENSSL_malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array + if (!(rgSetBlob = (MYBLOB *)OPENSSL_malloc( sk_num(a) * sizeof(MYBLOB)))) return 0; /* In this array we will store the SET blobs */ for (i=0; iwrite_params=0; ASN1_TYPE_free(a->parameter); i=i2d_DSAparams(dsa,NULL); - p=(unsigned char *)OPENSSL_malloc(i); + if ((p=(unsigned char *)OPENSSL_malloc(i)) == NULL) goto err; pp=p; i2d_DSAparams(dsa,&pp); a->parameter=ASN1_TYPE_new(); diff --git a/crypto/bio/bf_nbio.c b/crypto/bio/bf_nbio.c index 413ef5c4c5..988cd5ae00 100644 --- a/crypto/bio/bf_nbio.c +++ b/crypto/bio/bf_nbio.c @@ -104,7 +104,7 @@ static int nbiof_new(BIO *bi) { NBIO_TEST *nt; - nt=(NBIO_TEST *)OPENSSL_malloc(sizeof(NBIO_TEST)); + if (!(nt=(NBIO_TEST *)OPENSSL_malloc(sizeof(NBIO_TEST)))) return(0); nt->lrn= -1; nt->lwn= -1; bi->ptr=(char *)nt; diff --git a/crypto/bn/bn_div.c b/crypto/bn/bn_div.c index 613a268823..903ab2ee2e 100644 --- a/crypto/bn/bn_div.c +++ b/crypto/bn/bn_div.c @@ -190,10 +190,10 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor, /* First we normalise the numbers */ norm_shift=BN_BITS2-((BN_num_bits(divisor))%BN_BITS2); - BN_lshift(sdiv,divisor,norm_shift); + if (!(BN_lshift(sdiv,divisor,norm_shift))) goto err; sdiv->neg=0; norm_shift+=BN_BITS2; - BN_lshift(snum,num,norm_shift); + if (!(BN_lshift(snum,num,norm_shift))) goto err; snum->neg=0; div_n=sdiv->top; num_n=snum->top; @@ -315,7 +315,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor, tmp->top=j; j=wnum.top; - BN_sub(&wnum,&wnum,tmp); + if (!BN_sub(&wnum,&wnum,tmp)) goto err; snum->top=snum->top+wnum.top-j; @@ -323,7 +323,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor, { q--; j=wnum.top; - BN_add(&wnum,&wnum,sdiv); + if (!BN_add(&wnum,&wnum,sdiv)) goto err; snum->top+=wnum.top-j; } *(resp--)=q; diff --git a/crypto/bn/bn_gcd.c b/crypto/bn/bn_gcd.c index 398207196b..e8cc6c5cb5 100644 --- a/crypto/bn/bn_gcd.c +++ b/crypto/bn/bn_gcd.c @@ -168,8 +168,8 @@ BIGNUM *BN_mod_inverse(BIGNUM *in, BIGNUM *a, const BIGNUM *n, BN_CTX *ctx) R=in; if (R == NULL) goto err; - BN_zero(X); - BN_one(Y); + if (!BN_zero(X)) goto err; + if (!BN_one(Y)) goto err; if (BN_copy(A,a) == NULL) goto err; if (BN_copy(B,n) == NULL) goto err; sign=1; diff --git a/crypto/bn/bn_mont.c b/crypto/bn/bn_mont.c index 8cf1febacc..1daf50783c 100644 --- a/crypto/bn/bn_mont.c +++ b/crypto/bn/bn_mont.c @@ -224,7 +224,7 @@ int BN_from_montgomery(BIGNUM *ret, BIGNUM *a, BN_MONT_CTX *mont, if (!BN_mul(t1,t2,&mont->N,ctx)) goto err; if (!BN_add(t2,a,t1)) goto err; - BN_rshift(ret,t2,mont->ri); + if (!BN_rshift(ret,t2,mont->ri)) goto err; #endif /* MONT_WORD */ if (BN_ucmp(ret, &(mont->N)) >= 0) @@ -284,8 +284,8 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) BN_ULONG buf[2]; mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2; - BN_zero(R); - BN_set_bit(R,BN_BITS2); /* R */ + if (!(BN_zero(R))) goto err; + if (!(BN_set_bit(R,BN_BITS2))) goto err; /* R */ buf[0]=mod->d[0]; /* tmod = N mod word size */ buf[1]=0; @@ -296,36 +296,44 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) /* Ri = R^-1 mod N*/ if ((BN_mod_inverse(&Ri,R,&tmod,ctx)) == NULL) goto err; - BN_lshift(&Ri,&Ri,BN_BITS2); /* R*Ri */ + /* R*Ri */ + if (!(BN_lshift(&Ri,&Ri,BN_BITS2))) goto err; if (!BN_is_zero(&Ri)) - BN_sub_word(&Ri,1); + { + if (!BN_sub_word(&Ri,1)) goto err; + } else /* if N mod word size == 1 */ - BN_set_word(&Ri,BN_MASK2); /* Ri-- (mod word size) */ - BN_div(&Ri,NULL,&Ri,&tmod,ctx); /* Ni = (R*Ri-1)/N, - * keep only least significant word: */ + /* Ri-- (mod word size) */ + { + if (!BN_set_word(&Ri,BN_MASK2)) goto err; + } + /* Ni = (R*Ri-1)/N, keep only least significant word: */ + if (!(BN_div(&Ri,NULL,&Ri,&tmod,ctx))) goto err; mont->n0=Ri.d[0]; BN_free(&Ri); } #else /* !MONT_WORD */ { /* bignum version */ mont->ri=BN_num_bits(mod); - BN_zero(R); - BN_set_bit(R,mont->ri); /* R = 2^ri */ + if (!(BN_zero(R))) goto err; + /* R = 2^ri */ + if (!(BN_set_bit(R,mont->ri))) goto err; /* Ri = R^-1 mod N*/ if ((BN_mod_inverse(&Ri,R,mod,ctx)) == NULL) goto err; - BN_lshift(&Ri,&Ri,mont->ri); /* R*Ri */ - BN_sub_word(&Ri,1); + /* R*Ri */ + if (!(BN_lshift(&Ri,&Ri,mont->ri))) goto err; + if (!(BN_sub_word(&Ri,1))) goto err; /* Ni = (R*Ri-1) / N */ - BN_div(&(mont->Ni),NULL,&Ri,mod,ctx); + if (!(BN_div(&(mont->Ni),NULL,&Ri,mod,ctx))) goto err; BN_free(&Ri); } #endif /* setup RR for conversions */ - BN_zero(&(mont->RR)); - BN_set_bit(&(mont->RR),mont->ri*2); - BN_mod(&(mont->RR),&(mont->RR),&(mont->N),ctx); + if (!(BN_zero(&(mont->RR)))) goto err; + if (!(BN_set_bit(&(mont->RR),mont->ri*2))) goto err; + if (!(BN_mod(&(mont->RR),&(mont->RR),&(mont->N),ctx))) goto err; return(1); err: @@ -336,9 +344,9 @@ BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from) { if (to == from) return(to); - BN_copy(&(to->RR),&(from->RR)); - BN_copy(&(to->N),&(from->N)); - BN_copy(&(to->Ni),&(from->Ni)); + if (!(BN_copy(&(to->RR),&(from->RR)))) return NULL; + if (!(BN_copy(&(to->N),&(from->N)))) return NULL; + if (!(BN_copy(&(to->Ni),&(from->Ni)))) return NULL; to->ri=from->ri; to->n0=from->n0; return(to); diff --git a/crypto/bn/bn_mul.c b/crypto/bn/bn_mul.c index 3e8d8b9567..90592718d6 100644 --- a/crypto/bn/bn_mul.c +++ b/crypto/bn/bn_mul.c @@ -634,7 +634,7 @@ int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx) if ((al == 0) || (bl == 0)) { - BN_zero(r); + if (!BN_zero(r)) goto err; return(1); } top=al+bl; @@ -677,14 +677,14 @@ int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx) { if (i == 1 && !BN_get_flags(b,BN_FLG_STATIC_DATA)) { - bn_wexpand(b,al); + if (bn_wexpand(b,al) == NULL) goto err; b->d[bl]=0; bl++; i--; } else if (i == -1 && !BN_get_flags(a,BN_FLG_STATIC_DATA)) { - bn_wexpand(a,bl); + if (bn_wexpand(a,bl) == NULL) goto err; a->d[al]=0; al++; i++; @@ -699,16 +699,16 @@ int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx) t = BN_CTX_get(ctx); if (al == j) /* exact multiple */ { - bn_wexpand(t,k*2); - bn_wexpand(rr,k*2); + if (bn_wexpand(t,k*2) == NULL) goto err; + if (bn_wexpand(rr,k*2) == NULL) goto err; bn_mul_recursive(rr->d,a->d,b->d,al,t->d); } else { - bn_wexpand(a,k); - bn_wexpand(b,k); - bn_wexpand(t,k*4); - bn_wexpand(rr,k*4); + if (bn_wexpand(a,k) == NULL ) goto err; + if (bn_wexpand(b,k) == NULL ) goto err; + if (bn_wexpand(t,k*4) == NULL ) goto err; + if (bn_wexpand(rr,k*4) == NULL ) goto err; for (i=a->top; id[i]=0; for (i=b->top; icipher); if (ctx == NULL) return(0); + EVP_CIPHER_CTX_init(&ctx->cipher); ctx->buf_len=0; ctx->buf_off=0; diff --git a/crypto/objects/o_names.c b/crypto/objects/o_names.c index dca988230e..5eaf95b12f 100644 --- a/crypto/objects/o_names.c +++ b/crypto/objects/o_names.c @@ -61,6 +61,8 @@ int OBJ_NAME_new_index(unsigned long (*hash_func)(const char *), { MemCheck_off(); name_funcs = OPENSSL_malloc(sizeof(NAME_FUNCS)); + MemCheck_on(); + if (!name_funcs) return(0); name_funcs->hash_func = lh_strhash; name_funcs->cmp_func = (int (*)())strcmp; name_funcs->free_func = 0; /* NULL is often declared to @@ -68,6 +70,7 @@ int OBJ_NAME_new_index(unsigned long (*hash_func)(const char *), * to Compaq C is not really * compatible with a function * pointer. -- Richard Levitte*/ + MemCheck_off(); sk_NAME_FUNCS_push(name_funcs_stack,name_funcs); MemCheck_on(); } diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c index d802c4d09c..95ea4bfed3 100644 --- a/crypto/objects/obj_dat.c +++ b/crypto/objects/obj_dat.c @@ -228,7 +228,7 @@ int OBJ_add_object(ASN1_OBJECT *obj) if (added == NULL) if (!init_added()) return(0); if ((o=OBJ_dup(obj)) == NULL) goto err; - ao[ADDED_NID]=(ADDED_OBJ *)OPENSSL_malloc(sizeof(ADDED_OBJ)); + if (!(ao[ADDED_NID]=(ADDED_OBJ *)OPENSSL_malloc(sizeof(ADDED_OBJ)))) goto err; if ((o->length != 0) && (obj->data != NULL)) ao[ADDED_DATA]=(ADDED_OBJ *)OPENSSL_malloc(sizeof(ADDED_OBJ)); if (o->sn != NULL) diff --git a/crypto/pkcs7/pk7_doit.c b/crypto/pkcs7/pk7_doit.c index b209a86ea0..a45cf76c68 100644 --- a/crypto/pkcs7/pk7_doit.c +++ b/crypto/pkcs7/pk7_doit.c @@ -621,7 +621,7 @@ int PKCS7_dataFinal(PKCS7 *p7, BIO *bio) x=i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,NULL, i2d_X509_ATTRIBUTE, V_ASN1_SET,V_ASN1_UNIVERSAL,IS_SET); - pp=(unsigned char *)OPENSSL_malloc(x); + if (!(pp=(unsigned char *)OPENSSL_malloc(x))) goto err; p=pp; i2d_ASN1_SET_OF_X509_ATTRIBUTE(sk,&p, i2d_X509_ATTRIBUTE, @@ -817,7 +817,7 @@ for (ii=0; iiflags & RSA_FLAG_CACHE_PRIVATE) { diff --git a/crypto/txt_db/txt_db.c b/crypto/txt_db/txt_db.c index 3b04fe280c..92fcbde47f 100644 --- a/crypto/txt_db/txt_db.c +++ b/crypto/txt_db/txt_db.c @@ -122,7 +122,7 @@ TXT_DB *TXT_DB_read(BIO *in, int num) else { buf->data[offset-1]='\0'; /* blat the '\n' */ - p=(char *)OPENSSL_malloc(add+offset); + if (!(p=(char *)OPENSSL_malloc(add+offset))) goto err; offset=0; } pp=(char **)p; diff --git a/crypto/x509v3/v3_ia5.c b/crypto/x509v3/v3_ia5.c index f3bba38269..f9414456de 100644 --- a/crypto/x509v3/v3_ia5.c +++ b/crypto/x509v3/v3_ia5.c @@ -82,7 +82,7 @@ static char *i2s_ASN1_IA5STRING(X509V3_EXT_METHOD *method, { char *tmp; if(!ia5 || !ia5->length) return NULL; - tmp = OPENSSL_malloc(ia5->length + 1); + if (!(tmp = OPENSSL_malloc(ia5->length + 1))) return NULL; memcpy(tmp, ia5->data, ia5->length); tmp[ia5->length] = 0; return tmp; -- 2.25.1