[openssl-commits] [openssl] OpenSSL_1_0_1-stable update

[Kurt Roeckx]

The branch OpenSSL_1_0_1-stable has been updated
       via  e347d80287f18fce0db4571d5ee7285f1b14b82b (commit)
       via  9e7a5464d74917d9eb22305d3505895678b5b3c5 (commit)
       via  e224c45317b8a78ff52a121aac30ffc1499410c8 (commit)
      from  e961fa4479cf90a58bc3d3f0db9f1d0385da866f (commit)


- Log -----------------------------------------------------------------
commit e347d80287f18fce0db4571d5ee7285f1b14b82b
Author: Edgar Pek <edgar.pek at gmail.com>
Date:   Sat Feb 21 14:56:41 2015 +0100

    Fix null-pointer dereference
    
    Signed-off-by: Kurt Roeckx <kurt at roeckx.be>
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit bcfa19a8d19506c26b5f8d9d9934ca2aa5f96b43)

commit 9e7a5464d74917d9eb22305d3505895678b5b3c5
Author: Kurt Roeckx <kurt at roeckx.be>
Date:   Sat Feb 21 14:51:50 2015 +0100

    Fix memory leak
    
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit edac5dc220d494dff7ee259dfd84335ffa50e938)

commit e224c45317b8a78ff52a121aac30ffc1499410c8
Author: Doug Hogan <doug at acyclic.org>
Date:   Wed Jan 7 18:21:01 2015 -0800

    Avoid a double-free in an error path.
    
    Signed-off-by: Kurt Roeckx <kurt at roeckx.be>
    Reviewed-by: Matt Caswell <matt at openssl.org>
    (cherry picked from commit 1549a265209d449b6aefd2b49d7d39f7fbe0689b)

-----------------------------------------------------------------------

Summary of changes:
 crypto/dh/dh_ameth.c |    2 ++
 engines/e_ubsec.c    |    4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/crypto/dh/dh_ameth.c b/crypto/dh/dh_ameth.c
index 0ba4d44..786f021 100644
--- a/crypto/dh/dh_ameth.c
+++ b/crypto/dh/dh_ameth.c
@@ -223,6 +223,7 @@ static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
     DHerr(DH_F_DH_PRIV_DECODE, EVP_R_DECODE_ERROR);
  dherr:
     DH_free(dh);
+    ASN1_INTEGER_free(privkey);
     return 0;
 }
 
@@ -258,6 +259,7 @@ static int dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
     dplen = i2d_ASN1_INTEGER(prkey, &dp);
 
     ASN1_INTEGER_free(prkey);
+    prkey = NULL;
 
     if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_dhKeyAgreement), 0,
                          V_ASN1_SEQUENCE, params, dp, dplen))
diff --git a/engines/e_ubsec.c b/engines/e_ubsec.c
index 2d6331d..6f09ffb 100644
--- a/engines/e_ubsec.c
+++ b/engines/e_ubsec.c
@@ -967,11 +967,11 @@ static int ubsec_dh_generate_key(DH *dh)
 
     if (dh->pub_key == NULL) {
         pub_key = BN_new();
+        if (pub_key == NULL)
+            goto err;
         pub_key_len = BN_num_bits(dh->p);
         if (bn_wexpand(pub_key, dh->p->top) == NULL)
             goto err;
-        if (pub_key == NULL)
-            goto err;
     } else {
         pub_key = dh->pub_key;
     }