Check NULL pointers or not...
tmraz at redhat.com
Fri Nov 29 09:07:54 UTC 2019
The "always check for NULL pointers" approach does not avoid
catastrophical errors in applications. For example let's say an
application code encrypts some plaintext in-place and sends it out as
encrypted. Let's say we check for the NULL EVP_CIPHER_CTX in
EVP_CipherUpdate() but the app does not bother checking for the error
return as it did not bother for the same on EVP_CIPHER_CTX_new(). The
application will then happily (and silently) send out a plaintext
instead of ciphertext.
No matter how far down the wrong road you've gone, turn back.
[You'll know whether the road is wrong if you carefully listen to your
More information about the openssl-project