[openssl-commits] [openssl] OpenSSL_1_0_1-stable update

[Matt Caswell]

The branch OpenSSL_1_0_1-stable has been updated
       via  4161523ecd06b1e469b6e59e705ac8bec18611b6 (commit)
      from  66299660976540fa59450a5edc700e61ce4685d0 (commit)


- Log -----------------------------------------------------------------
commit 4161523ecd06b1e469b6e59e705ac8bec18611b6
Author: Matt Caswell <matt at openssl.org>
Date:   Mon Mar 14 17:06:19 2016 +0000

    Fix a potential double free in EVP_DigestInit_ex
    
    There is a potential double free in EVP_DigestInit_ex. This is believed
    to be reached only as a result of programmer error - but we should fix it
    anyway.
    
    Issue reported by Guido Vranken.
    
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (cherry picked from commit ffe9150b1508a0ffc9e724f975691f24eb045c05)

-----------------------------------------------------------------------

Summary of changes:
 crypto/evp/digest.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c
index 2e202c8..32167b2 100644
--- a/crypto/evp/digest.c
+++ b/crypto/evp/digest.c
@@ -200,8 +200,10 @@ int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)
     }
 #endif
     if (ctx->digest != type) {
-        if (ctx->digest && ctx->digest->ctx_size)
+        if (ctx->digest && ctx->digest->ctx_size) {
             OPENSSL_free(ctx->md_data);
+            ctx->md_data = NULL;
+        }
         ctx->digest = type;
         if (!(ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) && type->ctx_size) {
             ctx->update = type->update;