RT3774: double-free in DSA
authorMartin Vejnar <Martin.Vejnar@avg.com>
Wed, 29 Jul 2015 21:28:19 +0000 (17:28 -0400)
committerRich Salz <rsalz@openssl.org>
Thu, 30 Jul 2015 01:21:35 +0000 (21:21 -0400)
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit fa4629b6a2518d202fd051f228c3d8770682b3be)

crypto/dsa/dsa_ameth.c

index 2a5cd71371a761fca7b40e357dc8f03bc2097040..c40e1777ade1bf65892082717ff6e00f320b5ec8 100644 (file)
@@ -318,6 +318,7 @@ static int dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
     dplen = i2d_ASN1_INTEGER(prkey, &dp);
 
     ASN1_STRING_clear_free(prkey);
+    prkey = NULL;
 
     if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_dsa), 0,
                          V_ASN1_SEQUENCE, params, dp, dplen))