[openssl-commits] [openssl] OpenSSL_1_1_0-stable update

[Andy Polyakov]

The branch OpenSSL_1_1_0-stable has been updated
       via  8bc6b51ce2eba016d35e1524250c17f1c5de9911 (commit)
      from  f0e3fca9ee7052a9e4d034f988376b403a839140 (commit)


- Log -----------------------------------------------------------------
commit 8bc6b51ce2eba016d35e1524250c17f1c5de9911
Author: FdaSilvaYY <fdasilvayy at gmail.com>
Date:   Fri Aug 11 15:41:55 2017 +0200

    Fix possible leaks on sk_X509_EXTENSION_push() failure ...
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>
    Reviewed-by: Andy Polyakov <appro at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/4677)
    
    (cherry picked from commit 1687aa760cdd164b12c5b70e65cadcbce1e7ccfa)

-----------------------------------------------------------------------

Summary of changes:
 crypto/x509v3/v3_lib.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/crypto/x509v3/v3_lib.c b/crypto/x509v3/v3_lib.c
index a3ca720..d714308 100644
--- a/crypto/x509v3/v3_lib.c
+++ b/crypto/x509v3/v3_lib.c
@@ -120,6 +120,7 @@ const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid)
     X509V3_EXT_METHOD tmp;
     const X509V3_EXT_METHOD *t = &tmp, *const *ret;
     int idx;
+
     if (nid < 0)
         return NULL;
     tmp.ext_nid = nid;
@@ -231,6 +232,7 @@ void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *x, int nid, int *crit,
 {
     int lastpos, i;
     X509_EXTENSION *ex, *found_ex = NULL;
+
     if (!x) {
         if (idx)
             *idx = -1;
@@ -284,9 +286,9 @@ void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *x, int nid, int *crit,
 int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,
                     int crit, unsigned long flags)
 {
-    int extidx = -1;
-    int errcode;
-    X509_EXTENSION *ext, *extmp;
+    int errcode, extidx = -1;
+    X509_EXTENSION *ext = NULL, *extmp;
+    STACK_OF(X509_EXTENSION) *ret = NULL;
     unsigned long ext_op = flags & X509V3_ADD_OP_MASK;
 
     /*
@@ -345,14 +347,23 @@ int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,
         return 1;
     }
 
+    ret = *x;
     if (*x == NULL
-        && (*x = sk_X509_EXTENSION_new_null()) == NULL)
-        return -1;
-    if (!sk_X509_EXTENSION_push(*x, ext))
-        return -1;
+        && (ret = sk_X509_EXTENSION_new_null()) == NULL)
+        goto m_fail;
+    if (!sk_X509_EXTENSION_push(ret, ext))
+        goto m_fail;
 
+    *x = ret;
     return 1;
 
+ m_fail:
+    /* X509V3err(X509V3_F_X509V3_ADD1_I2D, ERR_R_MALLOC_FAILURE); */
+    if (ret != *x)
+        sk_X509_EXTENSION_free(ret);
+    X509_EXTENSION_free(ext);
+    return -1;
+
  err:
     if (!(flags & X509V3_ADD_SILENT))
         X509V3err(X509V3_F_X509V3_ADD1_I2D, errcode);