From 884a790e17a22eed42f1fe41ccaebd8c1fe18902 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 23 Nov 2016 22:12:56 +0000 Subject: [PATCH] Fix missing NULL checks in key_share processing Reviewed-by: Rich Salz --- ssl/t1_lib.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 3e592beb6c..ce728b0a34 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -1538,6 +1538,10 @@ static int add_client_key_share_ext(SSL *s, WPACKET *pkt, int *al) } skey = ssl_generate_pkey(ckey); + if (skey == NULL) { + SSLerr(SSL_F_ADD_CLIENT_KEY_SHARE_EXT, ERR_R_MALLOC_FAILURE); + return 0; + } /* Generate encoding of server key */ encoded_pt_len = EVP_PKEY_get1_tls_encodedpoint(skey, &encodedPoint); @@ -2778,6 +2782,11 @@ static int ssl_scan_serverhello_tlsext(SSL *s, PACKET *pkt, int *al) } skey = ssl_generate_pkey(ckey); + if (skey == NULL) { + *al = SSL_AD_INTERNAL_ERROR; + SSLerr(SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT, ERR_R_MALLOC_FAILURE); + return 0; + } if (!EVP_PKEY_set1_tls_encodedpoint(skey, PACKET_data(&encoded_pt), PACKET_remaining(&encoded_pt))) { *al = SSL_AD_DECODE_ERROR; -- 2.34.1