Submitted by: Julia Lawall <julia@diku.dk>

The functions ENGINE_ctrl(), OPENSSL_isservice(), EVP_PKEY_sign(),
CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error fix
so the return code is checked correctly.

diff --git a/CHANGES b/CHANGES
index 17fd386345e9ae56b7fa9bab2bab8e30f76d61ae..fab83ce003980ee41047a301de5c97159ada6e63 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,10 @@
 
  Changes between 0.9.8k and 1.0  [xx XXX xxxx]
 
+  *) The function EVP_PKEY_sign() returns <=0 on error: check return code
+     correctly.
+     [Julia Lawall <julia@diku.dk>]
+
   *) Update verify callback code in apps/s_cb.c and apps/verify.c, it
      needlessly dereferenced structures, used obsolete functions and
      didn't handle all updated verify codes correctly.
@@ -819,6 +823,12 @@
 
  Changes between 0.9.8k and 0.9.8l  [xx XXX xxxx]
 
+  *) The functions ENGINE_ctrl(), OPENSSL_isservice(),
+     CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error
+     fixes for a few places where the return code is not checked
+     correctly.
+     [Julia Lawall <julia@diku.dk>]
+
   *) Add --strict-warnings option to Configure script to include devteam
      warnings in other configurations.
      [Steve Henson]

diff --git a/apps/ts.c b/apps/ts.c
index d73b4eb5addf81fce577b739b2f93058aaf7ce85..bedb602fd5d5648aec544ffc3b5d2e29cff9ba92 100644 (file)
--- a/apps/ts.c
+++ b/apps/ts.c
@@ -649,7 +649,7 @@ static ASN1_INTEGER *create_nonce(int bits)
 
        /* Generating random byte sequence. */
        if (len > (int)sizeof(buf)) goto err;
-       if (!RAND_bytes(buf, len)) goto err;
+       if (RAND_bytes(buf, len) <= 0) goto err;
 
        /* Find the first non-zero byte and creating ASN1_INTEGER object. */
        for (i = 0; i < len && !buf[i]; ++i);

diff --git a/crypto/cms/cms_ess.c b/crypto/cms/cms_ess.c
index deb67ddde51b04b5d4ad628cd32e3aa7a9e261d8..90c0b82fb56813a8e7b3b5a71dfae2d677545c77 100644 (file)
--- a/crypto/cms/cms_ess.c
+++ b/crypto/cms/cms_ess.c
@@ -344,7 +344,7 @@ int cms_Receipt_verify(CMS_ContentInfo *cms, CMS_ContentInfo *req_cms)
 
        /* Get original receipt request details */
 
-       if (!CMS_get1_ReceiptRequest(osi, &rr))
+       if (CMS_get1_ReceiptRequest(osi, &rr) <= 0)
                {
                CMSerr(CMS_F_CMS_RECEIPT_VERIFY, CMS_R_NO_RECEIPT_REQUEST);
                goto err;
@@ -385,7 +385,7 @@ ASN1_OCTET_STRING *cms_encode_Receipt(CMS_SignerInfo *si)
 
        /* Get original receipt request details */
 
-       if (!CMS_get1_ReceiptRequest(si, &rr))
+       if (CMS_get1_ReceiptRequest(si, &rr) <= 0)
                {
                CMSerr(CMS_F_CMS_ENCODE_RECEIPT, CMS_R_NO_RECEIPT_REQUEST);
                goto err;

diff --git a/crypto/cryptlib.c b/crypto/cryptlib.c
index 41be45d620253938421315378bffbe35d6091c06..9a39d7e171ca91ae4205b683eed40ab96460c19a 100644 (file)
--- a/crypto/cryptlib.c
+++ b/crypto/cryptlib.c
@@ -847,7 +847,7 @@ void OPENSSL_showfatal (const char *fmta,...)
 
 #if defined(_WIN32_WINNT) && _WIN32_WINNT>=0x0333
     /* this -------------v--- guards NT-specific calls */
-    if (GetVersion() < 0x80000000 && OPENSSL_isservice())
+    if (GetVersion() < 0x80000000 && OPENSSL_isservice() > 0)
     {  HANDLE h = RegisterEventSource(0,_T("OPENSSL"));
        const TCHAR *pmsg=buf;
        ReportEvent(h,EVENTLOG_ERROR_TYPE,0,0,0,1,0,&pmsg,0);

diff --git a/crypto/engine/eng_ctrl.c b/crypto/engine/eng_ctrl.c
index 95b6b455aaf47fe7c581dcd8b20998e6ed1bcb96..5ce25d92ec9518508b9e7c3734bf1b59ae8fcc63 100644 (file)
--- a/crypto/engine/eng_ctrl.c
+++ b/crypto/engine/eng_ctrl.c
@@ -280,7 +280,7 @@ int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name,
                }
        /* Force the result of the control command to 0 or 1, for the reasons
         * mentioned before. */
-        if (ENGINE_ctrl(e, num, i, p, f))
+        if (ENGINE_ctrl(e, num, i, p, f) > 0)
                 return 1;
         return 0;
         }
@@ -345,7 +345,7 @@ int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char *arg,
                 * usage of these commands is consistent across applications and
                 * that certain applications don't understand it one way, and
                 * others another. */
-               if(ENGINE_ctrl(e, num, 0, (void *)arg, NULL))
+               if(ENGINE_ctrl(e, num, 0, (void *)arg, NULL) > 0)
                        return 1;
                return 0;
                }
@@ -360,7 +360,7 @@ int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char *arg,
        if(flags & ENGINE_CMD_FLAG_STRING)
                {
                /* Same explanation as above */
-               if(ENGINE_ctrl(e, num, 0, (void *)arg, NULL))
+               if(ENGINE_ctrl(e, num, 0, (void *)arg, NULL) > 0)
                        return 1;
                return 0;
                }
@@ -383,7 +383,7 @@ int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char *arg,
                }
        /* Force the result of the control command to 0 or 1, for the reasons
         * mentioned before. */
-       if(ENGINE_ctrl(e, num, l, NULL, NULL))
+       if(ENGINE_ctrl(e, num, l, NULL, NULL) > 0)
                return 1;
        return 0;
        }

diff --git a/crypto/rsa/rsa_pss.c b/crypto/rsa/rsa_pss.c
index 775c36114f5a4559b58f6b2925426753047b56eb..ac211e2ffe0121028a94f2d897347c9354c3c3d3 100644 (file)
--- a/crypto/rsa/rsa_pss.c
+++ b/crypto/rsa/rsa_pss.c
@@ -222,7 +222,7 @@ int RSA_padding_add_PKCS1_PSS(RSA *rsa, unsigned char *EM,
                                ERR_R_MALLOC_FAILURE);
                        goto err;
                        }
-               if (!RAND_bytes(salt, sLen))
+               if (RAND_bytes(salt, sLen) <= 0)
                        goto err;
                }
        maskedDBLen = emLen - hLen - 1;

diff --git a/ssl/d1_enc.c b/ssl/d1_enc.c
index 7f3e57fc1e2f9227bc631698e053c04ef422e015..8fa57347a99e646d5f30b49a87673e2934270585 100644 (file)
--- a/ssl/d1_enc.c
+++ b/ssl/d1_enc.c
@@ -155,7 +155,7 @@ int dtls1_enc(SSL *s, int send)
                                        __FILE__, __LINE__);
                        else if ( EVP_CIPHER_block_size(ds->cipher) > 1)
                                {
-                               if (!RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher)))
+                               if (RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher)) <= 0)
                                        return -1;
                                }
                        }

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 861ce301387de3198a24747d5b1ad0b6e015dbd5..a62ffd5eb3dd2c677330de3fb9fb60b8a2f9492d 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2707,7 +2707,7 @@ int ssl3_send_client_verify(SSL *s)
                s->method->ssl3_enc->cert_verify_mac(s,
                        NID_id_GostR3411_94,
                        data);
-               if (!EVP_PKEY_sign(pctx,signbuf,&sigsize,data,32)) {
+               if (EVP_PKEY_sign(pctx, signbuf, &sigsize, data, 32) <= 0) {
                        SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,
                        ERR_R_INTERNAL_ERROR);
                        goto err;