RT3861: Mem/bio leak in req command

[openssl.git] / apps / req.c

diff --git a/apps/req.c b/apps/req.c
index 1237c33ec19d10e8b807ccdf6f016dafe4556eb8..5514ee351da7a6101b2117663897bb373e9a5c0e 100644 (file)
--- a/apps/req.c
+++ b/apps/req.c
@@ -136,7 +136,6 @@ OPTIONS req_options[] = {
     {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
     {"in", OPT_IN, '<', "Input file"},
     {"out", OPT_OUT, '>', "Output file"},
-    {"keygen_engine", OPT_KEYGEN_ENGINE, 's'},
     {"key", OPT_KEY, '<', "Use the private key contained in file"},
     {"keyform", OPT_KEYFORM, 'F', "Key file format"},
     {"pubkey", OPT_PUBKEY, '-', "Output public key"},
@@ -179,6 +178,7 @@ OPTIONS req_options[] = {
      "Request extension section (override value in config file)"},
 #ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+    {"keygen_engine", OPT_KEYGEN_ENGINE, 's'},
 #endif
     {"", OPT_MD, '-', "Any supported digest"},
     {NULL}
@@ -196,7 +196,7 @@ int req_main(int argc, char **argv)
     X509_REQ *req = NULL;
     const EVP_CIPHER *cipher = NULL;
     const EVP_MD *md_alg = NULL, *digest = NULL;
-    char *engine = NULL, *extensions = NULL, *infile = NULL;
+    char *extensions = NULL, *infile = NULL;
     char *outfile = NULL, *keyfile = NULL, *inrand = NULL;
     char *keyalgstr = NULL, *p, *prog, *passargin = NULL, *passargout = NULL;
     char *passin = NULL, *passout = NULL, *req_exts = NULL, *subj = NULL;
@@ -235,18 +235,18 @@ int req_main(int argc, char **argv)
             if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
                 goto opthelp;
             break;
-#ifndef OPENSSL_NO_ENGINE
         case OPT_ENGINE:
-            engine = optarg;
+            (void)setup_engine(opt_arg(), 0);
             break;
         case OPT_KEYGEN_ENGINE:
+#ifndef OPENSSL_NO_ENGINE
             gen_eng = ENGINE_by_id(opt_arg());
             if (gen_eng == NULL) {
                 BIO_printf(bio_err, "Can't find keygen engine %s\n", *argv);
-                goto end;
+                goto opthelp;
             }
-            break;
 #endif
+            break;
         case OPT_KEY:
             keyfile = opt_arg();
             break;
@@ -477,7 +477,7 @@ int req_main(int argc, char **argv)
         p = NCONF_get_string(req_conf, SECTION, UTF8_IN);
         if (!p)
             ERR_clear_error();
-        else if (!strcmp(p, "yes"))
+        else if (strcmp(p, "yes") == 0)
             chtype = MBSTRING_UTF8;
     }
 
@@ -498,9 +498,6 @@ int req_main(int argc, char **argv)
             goto end;
         }
     }
-#ifndef OPENSSL_NO_ENGINE
-    e = setup_engine(engine, 0);
-#endif
 
     if (keyfile != NULL) {
         pkey = load_key(keyfile, keyform, 0, passin, e, "Private Key");
@@ -615,6 +612,7 @@ int req_main(int argc, char **argv)
             }
             goto end;
         }
+        BIO_free(out);
         BIO_printf(bio_err, "-----\n");
     }
 
@@ -875,29 +873,23 @@ int req_main(int argc, char **argv)
     if (ret) {
         ERR_print_errors(bio_err);
     }
-    if ((req_conf != NULL) && (req_conf != config))
+    if (req_conf != config)
         NCONF_free(req_conf);
     BIO_free(in);
     BIO_free_all(out);
     EVP_PKEY_free(pkey);
     EVP_PKEY_CTX_free(genctx);
-    if (pkeyopts)
-        sk_OPENSSL_STRING_free(pkeyopts);
-    if (sigopts)
-        sk_OPENSSL_STRING_free(sigopts);
+    sk_OPENSSL_STRING_free(pkeyopts);
+    sk_OPENSSL_STRING_free(sigopts);
 #ifndef OPENSSL_NO_ENGINE
-    if (gen_eng)
-        ENGINE_free(gen_eng);
+    ENGINE_free(gen_eng);
 #endif
-    if (keyalgstr)
-        OPENSSL_free(keyalgstr);
+    OPENSSL_free(keyalgstr);
     X509_REQ_free(req);
     X509_free(x509ss);
     ASN1_INTEGER_free(serial);
-    if (passargin && passin)
-        OPENSSL_free(passin);
-    if (passargout && passout)
-        OPENSSL_free(passout);
+    OPENSSL_free(passin);
+    OPENSSL_free(passout);
     OBJ_cleanup();
     return (ret);
 }
@@ -913,7 +905,7 @@ static int make_REQ(X509_REQ *req, EVP_PKEY *pkey, char *subj, int multirdn,
     tmp = NCONF_get_string(req_conf, SECTION, PROMPT);
     if (tmp == NULL)
         ERR_clear_error();
-    if ((tmp != NULL) && !strcmp(tmp, "no"))
+    if ((tmp != NULL) && strcmp(tmp, "no") == 0)
         no_prompt = 1;
 
     dn_sect = NCONF_get_string(req_conf, SECTION, DISTINGUISHED_NAME);
@@ -971,7 +963,7 @@ static int build_subject(X509_REQ *req, char *subject, unsigned long chtype,
 {
     X509_NAME *n;
 
-    if (!(n = parse_name(subject, chtype, multirdn)))
+    if ((n = parse_name(subject, chtype, multirdn)) == NULL)
         return 0;
 
     if (!X509_REQ_set_subject_name(req, n)) {
@@ -1382,7 +1374,7 @@ static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
         *pkey_type = EVP_PKEY_RSA;
         keylen = atol(gstr);
         *pkeylen = keylen;
-    } else if (!strncmp(gstr, "param:", 6))
+    } else if (strncmp(gstr, "param:", 6) == 0)
         paramfile = gstr + 6;
     else {
         const char *p = strchr(gstr, ':');