From ed3eb5e0cca0ac88908e5d718ac0137d0150ddb3 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Thu, 28 Apr 2016 17:05:21 +0100 Subject: [PATCH] The x509_name_canon function doesn't check for an error return i2d_name_canon can return a negative number on error. We should check it before continuing. Reviewed-by: Rich Salz --- crypto/x509/x_name.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/crypto/x509/x_name.c b/crypto/x509/x_name.c index 5e6abebbea..cd6c719044 100644 --- a/crypto/x509/x_name.c +++ b/crypto/x509/x_name.c @@ -335,7 +335,7 @@ static int x509_name_canon(X509_NAME *a) STACK_OF(STACK_OF_X509_NAME_ENTRY) *intname = NULL; STACK_OF(X509_NAME_ENTRY) *entries = NULL; X509_NAME_ENTRY *entry, *tmpentry = NULL; - int i, set = -1, ret = 0; + int i, set = -1, ret = 0, len; OPENSSL_free(a->canon_enc); a->canon_enc = NULL; @@ -370,7 +370,10 @@ static int x509_name_canon(X509_NAME *a) /* Finally generate encoding */ - a->canon_enclen = i2d_name_canon(intname, NULL); + len = i2d_name_canon(intname, NULL); + if (len < 0) + goto err; + a->canon_enclen = len; p = OPENSSL_malloc(a->canon_enclen); -- 2.25.1