|
 |
546bf97 |
diff -up openssl-1.0.1e/crypto/asn1/x_x509.c.use-after-free openssl-1.0.1e/crypto/asn1/x_x509.c
|
|
|
546bf97 |
--- openssl-1.0.1e/crypto/asn1/x_x509.c.use-after-free 2013-02-11 16:26:04.000000000 +0100
|
|
|
546bf97 |
+++ openssl-1.0.1e/crypto/asn1/x_x509.c 2015-06-11 11:14:52.581856349 +0200
|
|
|
546bf97 |
@@ -170,8 +170,14 @@ X509 *d2i_X509_AUX(X509 **a, const unsig
|
|
|
546bf97 |
{
|
|
|
546bf97 |
const unsigned char *q;
|
|
|
546bf97 |
X509 *ret;
|
|
|
546bf97 |
+ int freeret = 0;
|
|
|
546bf97 |
+
|
|
|
546bf97 |
/* Save start position */
|
|
|
546bf97 |
q = *pp;
|
|
|
546bf97 |
+
|
|
|
546bf97 |
+ if(!a || *a == NULL) {
|
|
|
546bf97 |
+ freeret = 1;
|
|
|
546bf97 |
+ }
|
|
|
546bf97 |
ret = d2i_X509(a, pp, length);
|
|
|
546bf97 |
/* If certificate unreadable then forget it */
|
|
|
546bf97 |
if(!ret) return NULL;
|
|
|
546bf97 |
@@ -181,7 +187,11 @@ X509 *d2i_X509_AUX(X509 **a, const unsig
|
|
|
546bf97 |
if(!d2i_X509_CERT_AUX(&ret->aux, pp, length)) goto err;
|
|
|
546bf97 |
return ret;
|
|
|
546bf97 |
err:
|
|
|
546bf97 |
- X509_free(ret);
|
|
|
546bf97 |
+ if(freeret) {
|
|
|
546bf97 |
+ X509_free(ret);
|
|
|
546bf97 |
+ if (a)
|
|
|
546bf97 |
+ *a = NULL;
|
|
|
546bf97 |
+ }
|
|
|
546bf97 |
return NULL;
|
|
|
546bf97 |
}
|
|
|
546bf97 |
|
|
|
729d2d0 |
diff -up openssl-1.0.1k/crypto/ec/ec_asn1.c.use-after-free openssl-1.0.1k/crypto/ec/ec_asn1.c
|
|
|
729d2d0 |
--- openssl-1.0.1k/crypto/ec/ec_asn1.c.use-after-free 2014-10-15 15:49:54.000000000 +0200
|
|
|
729d2d0 |
+++ openssl-1.0.1k/crypto/ec/ec_asn1.c 2015-03-19 17:28:03.349627040 +0100
|
|
|
729d2d0 |
@@ -1142,8 +1142,6 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, con
|
|
|
729d2d0 |
ERR_R_MALLOC_FAILURE);
|
|
|
729d2d0 |
goto err;
|
|
|
729d2d0 |
}
|
|
|
729d2d0 |
- if (a)
|
|
|
729d2d0 |
- *a = ret;
|
|
|
729d2d0 |
}
|
|
|
729d2d0 |
else
|
|
|
729d2d0 |
ret = *a;
|
|
|
729d2d0 |
@@ -1225,11 +1223,13 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, con
|
|
|
729d2d0 |
ret->enc_flag |= EC_PKEY_NO_PUBKEY;
|
|
|
729d2d0 |
}
|
|
|
729d2d0 |
|
|
|
729d2d0 |
+ if (a)
|
|
|
729d2d0 |
+ *a = ret;
|
|
|
729d2d0 |
ok = 1;
|
|
|
729d2d0 |
err:
|
|
|
729d2d0 |
if (!ok)
|
|
|
729d2d0 |
{
|
|
|
729d2d0 |
- if (ret)
|
|
|
729d2d0 |
+ if (ret && (a == NULL || *a != ret))
|
|
|
729d2d0 |
EC_KEY_free(ret);
|
|
|
729d2d0 |
ret = NULL;
|
|
|
729d2d0 |
}
|
|
|
546bf97 |
@@ -1377,8 +1377,6 @@ EC_KEY *d2i_ECParameters(EC_KEY **a, con
|
|
|
546bf97 |
ECerr(EC_F_D2I_ECPARAMETERS, ERR_R_MALLOC_FAILURE);
|
|
|
546bf97 |
return NULL;
|
|
|
546bf97 |
}
|
|
|
546bf97 |
- if (a)
|
|
|
546bf97 |
- *a = ret;
|
|
|
546bf97 |
}
|
|
|
546bf97 |
else
|
|
|
546bf97 |
ret = *a;
|
|
|
546bf97 |
@@ -1386,9 +1384,14 @@ EC_KEY *d2i_ECParameters(EC_KEY **a, con
|
|
|
546bf97 |
if (!d2i_ECPKParameters(&ret->group, in, len))
|
|
|
546bf97 |
{
|
|
|
546bf97 |
ECerr(EC_F_D2I_ECPARAMETERS, ERR_R_EC_LIB);
|
|
|
546bf97 |
+ if (a == NULL || *a != ret)
|
|
|
546bf97 |
+ EC_KEY_free(ret);
|
|
|
546bf97 |
return NULL;
|
|
|
546bf97 |
}
|
|
|
546bf97 |
|
|
|
546bf97 |
+ if (a)
|
|
|
546bf97 |
+ *a = ret;
|
|
|
546bf97 |
+
|
|
|
546bf97 |
return ret;
|
|
|
546bf97 |
}
|
|
|
546bf97 |
|