[openssl-commits] [openssl] OpenSSL_1_0_2-stable update

[Kurt Roeckx]

The branch OpenSSL_1_0_2-stable has been updated
       via  98e6f0790111715877ffa1b08c93e44cc0b402e9 (commit)
       via  f95519538a0ed412dc56e091fb28dbfbc48babe8 (commit)
       via  79e2e927e6e904a4b15e35c64eeb1461630cfe49 (commit)
      from  7f3563b576c0cf6fe6621f1d2dd92ec67d7e58e2 (commit)


- Log -----------------------------------------------------------------
commit 98e6f0790111715877ffa1b08c93e44cc0b402e9
Author: Edgar Pek <edgar.pek at gmail.com>
Date:   Sat Feb 21 14:56:41 2015 +0100

    Fix null-pointer dereference
    
    Signed-off-by: Kurt Roeckx <kurt at roeckx.be>
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit bcfa19a8d19506c26b5f8d9d9934ca2aa5f96b43)

commit f95519538a0ed412dc56e091fb28dbfbc48babe8
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat Feb 21 14:51:50 2015 +0100

    Fix memory leak
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit edac5dc220d494dff7ee259dfd84335ffa50e938)

commit 79e2e927e6e904a4b15e35c64eeb1461630cfe49
Author: Doug Hogan <doug at acyclic.org>
Date:   Wed Jan 7 18:21:01 2015 -0800

    Avoid a double-free in an error path.
    
    Signed-off-by: Kurt Roeckx <kurt at roeckx.be>
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 1549a265209d449b6aefd2b49d7d39f7fbe0689b)

-----------------------------------------------------------------------

Summary of changes:
 crypto/dh/dh_ameth.c |    2 ++
 engines/e_ubsec.c    |    4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/crypto/dh/dh_ameth.c b/crypto/dh/dh_ameth.c
index a8349e7..f32d376 100644
--- a/crypto/dh/dh_ameth.c
+++ b/crypto/dh/dh_ameth.c
@@ -248,6 +248,7 @@ static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
     DHerr(DH_F_DH_PRIV_DECODE, EVP_R_DECODE_ERROR);
  dherr:
     DH_free(dh);
+    ASN1_INTEGER_free(privkey);
     return 0;
 }
 
@@ -283,6 +284,7 @@ static int dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
     dplen = i2d_ASN1_INTEGER(prkey, &dp);
 
     ASN1_INTEGER_free(prkey);
+    prkey = NULL;
 
     if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(pkey->ameth->pkey_id), 0,
                          V_ASN1_SEQUENCE, params, dp, dplen))
diff --git a/engines/e_ubsec.c b/engines/e_ubsec.c
index 2d6331d..6f09ffb 100644
--- a/engines/e_ubsec.c
+++ b/engines/e_ubsec.c
@@ -967,11 +967,11 @@ static int ubsec_dh_generate_key(DH *dh)
 
     if (dh->pub_key == NULL) {
         pub_key = BN_new();
+        if (pub_key == NULL)
+            goto err;
         pub_key_len = BN_num_bits(dh->p);
         if (bn_wexpand(pub_key, dh->p->top) == NULL)
             goto err;
-        if (pub_key == NULL)
-            goto err;
     } else {
         pub_key = dh->pub_key;
     }