From f5517d95217fb5ec152a70be7fc4f399925efeb2 Mon Sep 17 00:00:00 2001 From: Paul Yang Date: Mon, 30 Sep 2019 14:05:31 +0800 Subject: [PATCH] Fix a bundle of mischecks of return values Several EVP_PKEY_xxxx functions return 0 and a negative value for indicating errors. Some places call these functions with a zero return value check only, which misses the check for the negative scenarios. Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/10055) (cherry picked from commit 7e3ae24832e0705583b1471febf3dc0eb1cc021f) --- apps/speed.c | 12 ++++++------ crypto/cms/cms_kari.c | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/apps/speed.c b/apps/speed.c index 7f8ba7c096..d396b3acca 100644 --- a/apps/speed.c +++ b/apps/speed.c @@ -3006,7 +3006,7 @@ int speed_main(int argc, char **argv) pctx = NULL; } if (kctx == NULL || /* keygen ctx is not null */ - !EVP_PKEY_keygen_init(kctx) /* init keygen ctx */ ) { + EVP_PKEY_keygen_init(kctx) <= 0/* init keygen ctx */ ) { ecdh_checks = 0; BIO_printf(bio_err, "ECDH keygen failure.\n"); ERR_print_errors(bio_err); @@ -3014,12 +3014,12 @@ int speed_main(int argc, char **argv) break; } - if (!EVP_PKEY_keygen(kctx, &key_A) || /* generate secret key A */ - !EVP_PKEY_keygen(kctx, &key_B) || /* generate secret key B */ + if (EVP_PKEY_keygen(kctx, &key_A) <= 0 || /* generate secret key A */ + EVP_PKEY_keygen(kctx, &key_B) <= 0 || /* generate secret key B */ !(ctx = EVP_PKEY_CTX_new(key_A, NULL)) || /* derivation ctx from skeyA */ - !EVP_PKEY_derive_init(ctx) || /* init derivation ctx */ - !EVP_PKEY_derive_set_peer(ctx, key_B) || /* set peer pubkey in ctx */ - !EVP_PKEY_derive(ctx, NULL, &outlen) || /* determine max length */ + EVP_PKEY_derive_init(ctx) <= 0 || /* init derivation ctx */ + EVP_PKEY_derive_set_peer(ctx, key_B) <= 0 || /* set peer pubkey in ctx */ + EVP_PKEY_derive(ctx, NULL, &outlen) <= 0 || /* determine max length */ outlen == 0 || /* ensure outlen is a valid size */ outlen > MAX_ECDH_SIZE /* avoid buffer overflow */ ) { ecdh_checks = 0; diff --git a/crypto/cms/cms_kari.c b/crypto/cms/cms_kari.c index 3980bf8f3f..cafc3040ac 100644 --- a/crypto/cms/cms_kari.c +++ b/crypto/cms/cms_kari.c @@ -162,7 +162,7 @@ int CMS_RecipientInfo_kari_set0_pkey(CMS_RecipientInfo *ri, EVP_PKEY *pk) if (!pk) return 1; pctx = EVP_PKEY_CTX_new(pk, NULL); - if (!pctx || !EVP_PKEY_derive_init(pctx)) + if (!pctx || EVP_PKEY_derive_init(pctx) <= 0) goto err; kari->pctx = pctx; return 1; -- 2.25.1