From: Richard Levitte <levitte@openssl.org>
Date: Tue, 24 Oct 2017 16:32:22 +0000 (+0200)
Subject: asn1_item_embed_new(): if locking failed, don't call asn1_item_embed_free()
X-Git-Tag: OpenSSL_1_1_1-pre1~518
X-Git-Url: https://git.openssl.org/?p=openssl.git;a=commitdiff_plain;h=fe6fcd31546db1ab019e55edd15c953c5b358559

asn1_item_embed_new(): if locking failed, don't call asn1_item_embed_free()

asn1_item_embed_free() will try unlocking and fail in this case, and
since the new item was just allocated on the heap, free it directly
with OPENSSL_free() instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/4579)
---

diff --git a/crypto/asn1/tasn_new.c b/crypto/asn1/tasn_new.c
index 63a4b38ee9..11c804026a 100644
--- a/crypto/asn1/tasn_new.c
+++ b/crypto/asn1/tasn_new.c
@@ -124,8 +124,13 @@ int asn1_item_embed_new(ASN1_VALUE **pval, const ASN1_ITEM *it, int embed)
                 goto memerr;
         }
         /* 0 : init. lock */
-        if (asn1_do_lock(pval, 0, it) < 0)
-            goto memerr2;
+        if (asn1_do_lock(pval, 0, it) < 0) {
+            if (!embed) {
+                OPENSSL_free(*pval);
+                *pval = NULL;
+            }
+            goto memerr;
+        }
         asn1_enc_init(pval, it);
         for (i = 0, tt = it->templates; i < it->tcount; tt++, i++) {
             pseqval = asn1_get_field_ptr(pval, tt);