[openssl-commits] [openssl] master update

[Kurt Roeckx]

The branch master has been updated
       via  98637bd30e06529e52b5f83bde32c8bd2d620e06 (commit)
       via  3eb70c5ebae6f2b5fd6034ed5af14910c8479688 (commit)
      from  642a613809ef68432eefbbd957ec542c70a8d7b4 (commit)


- Log -----------------------------------------------------------------
commit 98637bd30e06529e52b5f83bde32c8bd2d620e06
Author: FdaSilvaYY <fdasilvayy at gmail.com>
Date:   Thu Jan 21 23:10:29 2016 +0100

    Fix two possible leaks.
    
    Signed-off-by: Kurt Roeckx <kurt at roeckx.be>
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    
    GH: #580

commit 3eb70c5ebae6f2b5fd6034ed5af14910c8479688
Author: FdaSilvaYY <fdasilvayy at gmail.com>
Date:   Thu Jan 21 23:09:57 2016 +0100

    Fix possible memory leak on BUF_MEM_grow_clean failure
    
    Simplify BUF_MEM init. code
    
    Signed-off-by: Kurt Roeckx <kurt at roeckx.be>
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    
    GH: #580

-----------------------------------------------------------------------

Summary of changes:
 crypto/asn1/tasn_dec.c  | 14 ++++++--------
 crypto/dso/dso_lib.c    |  1 +
 crypto/engine/eng_dyn.c |  2 ++
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/crypto/asn1/tasn_dec.c b/crypto/asn1/tasn_dec.c
index 0e0759f..802f929 100644
--- a/crypto/asn1/tasn_dec.c
+++ b/crypto/asn1/tasn_dec.c
@@ -668,7 +668,7 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
     long plen;
     char cst, inf, free_cont = 0;
     const unsigned char *p;
-    BUF_MEM buf = { 0 };
+    BUF_MEM buf = { 0, NULL, 0, 0 };
     const unsigned char *cont = NULL;
     long len;
     if (!pval) {
@@ -744,7 +744,6 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
         } else {
             len = p - cont + plen;
             p += plen;
-            buf.data = NULL;
         }
     } else if (cst) {
         if (utype == V_ASN1_NULL || utype == V_ASN1_BOOLEAN
@@ -753,9 +752,9 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
             ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_TYPE_NOT_PRIMITIVE);
             return 0;
         }
-        buf.length = 0;
-        buf.max = 0;
-        buf.data = NULL;
+
+        /* Free any returned 'buf' content */
+        free_cont = 1;
         /*
          * Should really check the internal tags are correct but some things
          * may get this wrong. The relevant specs say that constructed string
@@ -763,18 +762,16 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
          * So instead just check for UNIVERSAL class and ignore the tag.
          */
         if (!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL, 0)) {
-            free_cont = 1;
             goto err;
         }
         len = buf.length;
         /* Append a final null to string */
         if (!BUF_MEM_grow_clean(&buf, len + 1)) {
             ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_MALLOC_FAILURE);
-            return 0;
+            goto err;
         }
         buf.data[len] = 0;
         cont = (const unsigned char *)buf.data;
-        free_cont = 1;
     } else {
         cont = p;
         len = plen;
@@ -782,6 +779,7 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
     }
 
     /* We now have content length and type: translate into a structure */
+    /* asn1_ex_c2i may reuse allocated buffer, and so sets free_cont to 0 */
     if (!asn1_ex_c2i(pval, cont, len, utype, &free_cont, it))
         goto err;
 
diff --git a/crypto/dso/dso_lib.c b/crypto/dso/dso_lib.c
index cc29ca4..dfa738a 100644
--- a/crypto/dso/dso_lib.c
+++ b/crypto/dso/dso_lib.c
@@ -122,6 +122,7 @@ DSO *DSO_new_method(DSO_METHOD *meth)
         ret->meth = meth;
     ret->references = 1;
     if ((ret->meth->init != NULL) && !ret->meth->init(ret)) {
+        sk_void_free(ret->meth_data);
         OPENSSL_free(ret);
         ret = NULL;
     }
diff --git a/crypto/engine/eng_dyn.c b/crypto/engine/eng_dyn.c
index d19cab2..bdd0a1a 100644
--- a/crypto/engine/eng_dyn.c
+++ b/crypto/engine/eng_dyn.c
@@ -231,6 +231,8 @@ static int dynamic_set_data_ctx(ENGINE *e, dynamic_data_ctx **ctx)
      * If we lost the race to set the context, c is non-NULL and *ctx is the
      * context of the thread that won.
      */
+    if (c)
+        sk_OPENSSL_STRING_free(c->dirs);
     OPENSSL_free(c);
     return 1;
 }