Fix a failure to NULL a pointer freed on error.
authorMatt Caswell <matt@openssl.org>
Mon, 9 Feb 2015 11:38:41 +0000 (11:38 +0000)
committerMatt Caswell <matt@openssl.org>
Wed, 25 Feb 2015 17:13:07 +0000 (17:13 +0000)
Inspired by BoringSSL commit 517073cd4b by Eric Roman <eroman@chromium.org>

CVE-2015-0209

Reviewed-by: Emilia Käsper <emilia@openssl.org>
crypto/ec/ec_asn1.c

index 292437409fd8cbf57afafb904392f4a8711c5c78..1088e8916eff6aadca3fd3d773a057b9e4c20356 100644 (file)
@@ -1033,8 +1033,6 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, const unsigned char **in, long len)
             ECerr(EC_F_D2I_ECPRIVATEKEY, ERR_R_MALLOC_FAILURE);
             goto err;
         }
-        if (a)
-            *a = ret;
     } else
         ret = *a;
 
@@ -1102,10 +1100,12 @@ EC_KEY *d2i_ECPrivateKey(EC_KEY **a, const unsigned char **in, long len)
         ret->enc_flag |= EC_PKEY_NO_PUBKEY;
     }
 
+    if (a)
+        *a = ret;
     ok = 1;
  err:
     if (!ok) {
-        if (ret)
+        if (ret && (a == NULL || *a != ret))
             EC_KEY_free(ret);
         ret = NULL;
     }