Security fixes brought forward from 0.9.7.

[openssl.git] / crypto / asn1 / a_bitstr.c

diff --git a/crypto/asn1/a_bitstr.c b/crypto/asn1/a_bitstr.c
index ed0bdfbde1a75ba478863bde12d351b4877ce6c7..f4ea96cd54e8fd4524f7adc13c7cb78555b578ef 100644 (file)
--- a/crypto/asn1/a_bitstr.c
+++ b/crypto/asn1/a_bitstr.c
@@ -120,6 +120,12 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
        unsigned char *p,*s;
        int i;
 
+       if (len < 1)
+               {
+               i=ASN1_R_STRING_TOO_SHORT;
+               goto err;
+               }
+
        if ((a == NULL) || ((*a) == NULL))
                {
                if ((ret=M_ASN1_BIT_STRING_new()) == NULL) return(NULL);
@@ -185,7 +191,9 @@ int ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value)
                if (a->data == NULL)
                        c=(unsigned char *)OPENSSL_malloc(w+1);
                else
-                       c=(unsigned char *)OPENSSL_realloc(a->data,w+1);
+                       c=(unsigned char *)OPENSSL_realloc_clean(a->data,
+                                                                a->length,
+                                                                w+1);
                if (c == NULL) return(0);
                if (w+1-a->length > 0) memset(c+a->length, 0, w+1-a->length);
                a->data=c;