[openssl-commits] [openssl] master update

[Matt Caswell]

The branch master has been updated
       via  446ba8de9af9aa4fa3debc7c76a38f4efed47a62 (commit)
      from  baf1a3041501c1d4a484deb095bf82a4864c703a (commit)


- Log -----------------------------------------------------------------
commit 446ba8de9af9aa4fa3debc7c76a38f4efed47a62
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Apr 25 16:05:55 2016 +0100

    Ensure we check i2d_X509 return val
    
    The i2d_X509() function can return a negative value on error. Therefore
    we should make sure we check it.
    
    Issue reported by Yuan Jochen Kang.
    
    Reviewed-by: Emilia Käsper <emilia at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 crypto/x509/x_x509.c | 15 ++++++++++++---
 ssl/ssl_cert.c       |  9 +++++++--
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/crypto/x509/x_x509.c b/crypto/x509/x_x509.c
index 3463955..22a7e59 100644
--- a/crypto/x509/x_x509.c
+++ b/crypto/x509/x_x509.c
@@ -182,10 +182,19 @@ X509 *d2i_X509_AUX(X509 **a, const unsigned char **pp, long length)
 
 int i2d_X509_AUX(X509 *a, unsigned char **pp)
 {
-    int length;
+    int length, tmplen;
+    unsigned char *start = *pp;
     length = i2d_X509(a, pp);
-    if (a)
-        length += i2d_X509_CERT_AUX(a->aux, pp);
+    if (length < 0 || a == NULL)
+        return length;
+
+    tmplen = i2d_X509_CERT_AUX(a->aux, pp);
+    if (tmplen < 0) {
+        *pp = start;
+        return tmplen;
+    }
+    length += tmplen;
+
     return length;
 }
 
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 04a4a36..a4bf76e 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -836,13 +836,18 @@ static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
     unsigned char *p;
 
     n = i2d_X509(x, NULL);
-    if (!BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
+    if (n < 0 || !BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
         SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
         return 0;
     }
     p = (unsigned char *)&(buf->data[*l]);
     l2n3(n, p);
-    i2d_X509(x, &p);
+    n = i2d_X509(x, &p);
+    if (n < 0) {
+        /* Shouldn't happen */
+        SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
+        return 0;
+    }
     *l += n + 3;
 
     return 1;