[openssl] master update

[Matt Caswell]

The branch master has been updated
       via  7eeceeaab24aea16027cdc1f9df92366094893b7 (commit)
      from  6b3d0423528b049d04b299a8588a32d5c1224717 (commit)


- Log -----------------------------------------------------------------
commit 7eeceeaab24aea16027cdc1f9df92366094893b7
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Sep 11 15:03:39 2019 +0100

    Avoid passing NULL to memcpy
    
    It is undefined behaviour to send NULL as either the src, or dest params
    in memcpy.
    
    In pkey_kdf.c we had a check to ensure that the src address is non-NULL.
    However in some situations it is possible that the dest address could also
    be NULL. Specifically in the case where the datalen is 0 and we are using
    a newly allocated BUF_MEM.
    
    We add a check of datalen to avoid the undefined behaviour.
    
    Reviewed-by: Tomas Mraz <tmraz at fedoraproject.org>
    Reviewed-by: Richard Levitte <levitte at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/9868)

-----------------------------------------------------------------------

Summary of changes:
 crypto/evp/pkey_kdf.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/crypto/evp/pkey_kdf.c b/crypto/evp/pkey_kdf.c
index c13bb203b3..f32d2131a7 100644
--- a/crypto/evp/pkey_kdf.c
+++ b/crypto/evp/pkey_kdf.c
@@ -82,17 +82,13 @@ static int collect(BUF_MEM **collector, void *data, size_t datalen)
         return 0;
     }
 
-    i = (*collector)->length; /* BUF_MEM_grow() changes it! */
-    /*
-     * The i + datalen check is to distinguish between BUF_MEM_grow()
-     * signaling an error and BUF_MEM_grow() simply returning the (zero)
-     * length.
-     */
-    if (!BUF_MEM_grow(*collector, i + datalen)
-        && i + datalen != 0)
-        return 0;
-    if (data != NULL)
+    if (data != NULL && datalen > 0) {
+        i = (*collector)->length; /* BUF_MEM_grow() changes it! */
+
+        if (!BUF_MEM_grow(*collector, i + datalen))
+            return 0;
         memcpy((*collector)->data + i, data, datalen);
+    }
     return 1;
 }