improved error checking and some fixes

PR: 1170
Submitted by: Yair Elharrar
Reviewed and edited by: Nils Larsch

diff --git a/crypto/asn1/a_bitstr.c b/crypto/asn1/a_bitstr.c
index f621426d6f572a9d7d967d051bb245b143446cd3..0fb9ce0c2aea189ce384b988361b868d758f9efa 100644 (file)
--- a/crypto/asn1/a_bitstr.c
+++ b/crypto/asn1/a_bitstr.c
@@ -183,9 +183,11 @@ int ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value)
        iv= ~v;
        if (!value) v=0;
 
+       if (a == NULL)
+               return 0;
+
        a->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07); /* clear, set on write */
 
-       if (a == NULL) return(0);
        if ((a->length < (w+1)) || (a->data == NULL))
                {
                if (!value) return(1); /* Don't need to set */

diff --git a/crypto/asn1/t_pkey.c b/crypto/asn1/t_pkey.c
index 939979f77d297d07a0d00ee2fca0f9b1f5542188..296033d55322328031d331d56695e773409866f9 100644 (file)
--- a/crypto/asn1/t_pkey.c
+++ b/crypto/asn1/t_pkey.c
@@ -198,6 +198,11 @@ int DSA_print(BIO *bp, const DSA *x, int off)
 
        if (x->p)
                buf_len = (size_t)BN_num_bytes(x->p);
+       else
+               {
+               DSAerr(DSA_F_DSA_PRINT,DSA_R_MISSING_PARAMETERS);
+               goto err;
+               }
        if (x->q)
                if (buf_len < (i = (size_t)BN_num_bytes(x->q)))
                        buf_len = i;
@@ -670,6 +675,11 @@ int DHparams_print(BIO *bp, const DH *x)
 
        if (x->p)
                buf_len = (size_t)BN_num_bytes(x->p);
+       else
+               {
+               reason = ERR_R_PASSED_NULL_PARAMETER;
+               goto err;
+               }
        if (x->g)
                if (buf_len < (i = (size_t)BN_num_bytes(x->g)))
                        buf_len = i;
@@ -728,6 +738,11 @@ int DSAparams_print(BIO *bp, const DSA *x)
 
        if (x->p)
                buf_len = (size_t)BN_num_bytes(x->p);
+       else
+               {
+               DSAerr(DSA_F_DSA_PRINT,DSA_R_MISSING_PARAMETERS);
+               goto err;
+               }
        if (x->q)
                if (buf_len < (i = (size_t)BN_num_bytes(x->q)))
                        buf_len = i;
@@ -737,7 +752,7 @@ int DSAparams_print(BIO *bp, const DSA *x)
        m=(unsigned char *)OPENSSL_malloc(buf_len+10);
        if (m == NULL)
                {
-               reason=ERR_R_MALLOC_FAILURE;
+               DSAerr(DSA_F_DSA_PRINT,ERR_R_MALLOC_FAILURE);
                goto err;
                }
 
@@ -750,7 +765,6 @@ int DSAparams_print(BIO *bp, const DSA *x)
        ret=1;
 err:
        if (m != NULL) OPENSSL_free(m);
-       DSAerr(DSA_F_DSAPARAMS_PRINT,reason);
        return(ret);
        }
 

diff --git a/crypto/evp/p5_crpt.c b/crypto/evp/p5_crpt.c
index c0dfb7de373037148fb233020fee72bc2978e598..48d50014a04147843fc93ef5dc9390f4e76e4322 100644 (file)
--- a/crypto/evp/p5_crpt.c
+++ b/crypto/evp/p5_crpt.c
@@ -114,9 +114,14 @@ int PKCS5_PBE_keyivgen(EVP_CIPHER_CTX *cctx, const char *pass, int passlen,
        const unsigned char *pbuf;
 
        /* Extract useful info from parameter */
+       if (param == NULL || param->type != V_ASN1_SEQUENCE ||
+           param->value.sequence == NULL) {
+               EVPerr(EVP_F_PKCS5_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
+               return 0;
+       }
+
        pbuf = param->value.sequence->data;
-       if (!param || (param->type != V_ASN1_SEQUENCE) ||
-          !(pbe = d2i_PBEPARAM (NULL, &pbuf, param->value.sequence->length))) {
+       if (!(pbe = d2i_PBEPARAM(NULL, &pbuf, param->value.sequence->length))) {
                EVPerr(EVP_F_PKCS5_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
                return 0;
        }

diff --git a/crypto/evp/p5_crpt2.c b/crypto/evp/p5_crpt2.c
index f2e143d2a68c2e6472d9c3cd97d45ca28cfbe6f9..f11cb701a40d6144583cfc51de50b5dd461b6d6f 100644 (file)
--- a/crypto/evp/p5_crpt2.c
+++ b/crypto/evp/p5_crpt2.c
@@ -156,10 +156,15 @@ int PKCS5_v2_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
        const EVP_CIPHER *cipher;
        PBKDF2PARAM *kdf = NULL;
 
+       if (param == NULL || param->type != V_ASN1_SEQUENCE ||
+           param->value.sequence == NULL) {
+               EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
+               return 0;
+       }
+
        pbuf = param->value.sequence->data;
        plen = param->value.sequence->length;
-       if(!param || (param->type != V_ASN1_SEQUENCE) ||
-                                  !(pbe2 = d2i_PBE2PARAM(NULL, &pbuf, plen))) {
+       if(!(pbe2 = d2i_PBE2PARAM(NULL, &pbuf, plen))) {
                EVPerr(EVP_F_PKCS5_V2_PBE_KEYIVGEN,EVP_R_DECODE_ERROR);
                return 0;
        }

diff --git a/crypto/ocsp/ocsp_cl.c b/crypto/ocsp/ocsp_cl.c
index 9b3e6dd8ca2251189ccb70f52ac0f1f77aa0bf5d..17bab5fc59c7e3777e7a86398de4a95536e2e2b6 100644 (file)
--- a/crypto/ocsp/ocsp_cl.c
+++ b/crypto/ocsp/ocsp_cl.c
@@ -101,6 +101,8 @@ int OCSP_request_set1_name(OCSP_REQUEST *req, X509_NAME *nm)
        {
        GENERAL_NAME *gen;
        gen = GENERAL_NAME_new();
+       if (gen == NULL)
+               return 0;
        if (!X509_NAME_set(&gen->d.directoryName, nm))
                {
                GENERAL_NAME_free(gen);

diff --git a/crypto/pkcs12/p12_crpt.c b/crypto/pkcs12/p12_crpt.c
index bbc13e50dd9f068cf008ee6c72932e1851159faa..3ad33c49d82d7adb44f3892027932275cf8b5639 100644 (file)
--- a/crypto/pkcs12/p12_crpt.c
+++ b/crypto/pkcs12/p12_crpt.c
@@ -94,9 +94,14 @@ int PKCS12_PBE_keyivgen(EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
        unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH];
 
        /* Extract useful info from parameter */
+       if (param == NULL || param->type != V_ASN1_SEQUENCE ||
+           param->value.sequence == NULL) {
+               PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_DECODE_ERROR);
+               return 0;
+       }
+
        pbuf = param->value.sequence->data;
-       if (!param || (param->type != V_ASN1_SEQUENCE) ||
-          !(pbe = d2i_PBEPARAM (NULL, &pbuf, param->value.sequence->length))) {
+       if (!(pbe = d2i_PBEPARAM(NULL, &pbuf, param->value.sequence->length))) {
                PKCS12err(PKCS12_F_PKCS12_PBE_KEYIVGEN,PKCS12_R_DECODE_ERROR);
                return 0;
        }

diff --git a/crypto/txt_db/txt_db.c b/crypto/txt_db/txt_db.c
index b3a7a42ca09c36f97b5b10197bd937314448b7c2..e9e503eb073cbb89272adcc6001a531dcbb56aca 100644 (file)
--- a/crypto/txt_db/txt_db.c
+++ b/crypto/txt_db/txt_db.c
@@ -179,10 +179,13 @@ err:
 #if !defined(OPENSSL_NO_STDIO) && !defined(OPENSSL_SYS_WIN16)
                if (er == 1) fprintf(stderr,"OPENSSL_malloc failure\n");
 #endif
-               if (ret->data != NULL) sk_free(ret->data);
-               if (ret->index != NULL) OPENSSL_free(ret->index);
-               if (ret->qual != NULL) OPENSSL_free(ret->qual);
-               if (ret != NULL) OPENSSL_free(ret);
+               if (ret != NULL)
+                       {
+                       if (ret->data != NULL) sk_free(ret->data);
+                       if (ret->index != NULL) OPENSSL_free(ret->index);
+                       if (ret->qual != NULL) OPENSSL_free(ret->qual);
+                       if (ret != NULL) OPENSSL_free(ret);
+                       }
                return(NULL);
                }
        else

diff --git a/crypto/ui/ui_lib.c b/crypto/ui/ui_lib.c
index 1a8f3ce113ea6de25248cde5339709309a47cec8..7ab249c3be320acd30f5e778c26cb7f98a212a11 100644 (file)
--- a/crypto/ui/ui_lib.c
+++ b/crypto/ui/ui_lib.c
@@ -620,8 +620,10 @@ UI_METHOD *UI_create_method(char *name)
        UI_METHOD *ui_method = (UI_METHOD *)OPENSSL_malloc(sizeof(UI_METHOD));
 
        if (ui_method)
+               {
                memset(ui_method, 0, sizeof(*ui_method));
-       ui_method->name = BUF_strdup(name);
+               ui_method->name = BUF_strdup(name);
+               }
        return ui_method;
        }
 

diff --git a/crypto/x509/x509_att.c b/crypto/x509/x509_att.c
index bd1fdec2075c4c34cd06a5229a0a3229b91cfe58..65968c4944aab7f2986eec2ee41fc5efbcb4041e 100644 (file)
--- a/crypto/x509/x509_att.c
+++ b/crypto/x509/x509_att.c
@@ -125,7 +125,13 @@ STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x,
        X509_ATTRIBUTE *new_attr=NULL;
        STACK_OF(X509_ATTRIBUTE) *sk=NULL;
 
-       if ((x != NULL) && (*x == NULL))
+       if (x == NULL)
+               {
+               X509err(X509_F_X509AT_ADD1_ATTR, ERR_R_PASSED_NULL_PARAMETER);
+               goto err2;
+               } 
+
+       if (*x == NULL)
                {
                if ((sk=sk_X509_ATTRIBUTE_new_null()) == NULL)
                        goto err;
@@ -137,7 +143,7 @@ STACK_OF(X509_ATTRIBUTE) *X509at_add1_attr(STACK_OF(X509_ATTRIBUTE) **x,
                goto err2;
        if (!sk_X509_ATTRIBUTE_push(sk,new_attr))
                goto err;
-       if ((x != NULL) && (*x == NULL))
+       if (*x == NULL)
                *x=sk;
        return(sk);
 err:

diff --git a/crypto/x509/x509_v3.c b/crypto/x509/x509_v3.c
index 67b1796a92134d4eb0427d2be9085045cb2ef271..42e6f0ab0560735eaca39bb222796c1c69156862 100644 (file)
--- a/crypto/x509/x509_v3.c
+++ b/crypto/x509/x509_v3.c
@@ -147,7 +147,13 @@ STACK_OF(X509_EXTENSION) *X509v3_add_ext(STACK_OF(X509_EXTENSION) **x,
        int n;
        STACK_OF(X509_EXTENSION) *sk=NULL;
 
-       if ((x != NULL) && (*x == NULL))
+       if (x == NULL)
+               {
+               X509err(X509_F_X509V3_ADD_EXT,ERR_R_PASSED_NULL_PARAMETER);
+               goto err2;
+               }
+
+       if (*x == NULL)
                {
                if ((sk=sk_X509_EXTENSION_new_null()) == NULL)
                        goto err;
@@ -163,7 +169,7 @@ STACK_OF(X509_EXTENSION) *X509v3_add_ext(STACK_OF(X509_EXTENSION) **x,
                goto err2;
        if (!sk_X509_EXTENSION_insert(sk,new_ex,loc))
                goto err;
-       if ((x != NULL) && (*x == NULL))
+       if (*x == NULL)
                *x=sk;
        return(sk);
 err:

diff --git a/crypto/x509v3/v3_alt.c b/crypto/x509v3/v3_alt.c
index e3a19bf8a497c2ec9c47cffd4ffc94ed51ea068a..b38b3dbfe62baffd7a4c8e956e4e16442f886f59 100644 (file)
--- a/crypto/x509v3/v3_alt.c
+++ b/crypto/x509v3/v3_alt.c
@@ -341,7 +341,8 @@ static int copy_email(X509V3_CTX *ctx, GENERAL_NAMES *gens, int move_p)
        X509_NAME_ENTRY *ne;
        GENERAL_NAME *gen = NULL;
        int i;
-       if(ctx->flags == CTX_TEST) return 1;
+       if(ctx != NULL && ctx->flags == CTX_TEST)
+               return 1;
        if(!ctx || (!ctx->subject_cert && !ctx->subject_req)) {
                X509V3err(X509V3_F_COPY_EMAIL,X509V3_R_NO_SUBJECT_DETAILS);
                goto err;

diff --git a/ssl/ssl_txt.c b/ssl/ssl_txt.c
index fd0c55c1270c23d7fe1384c7e8b906056ed1e954..39cf55cbfdff9f11786e9d0b4b3163fabd366edf 100644 (file)
--- a/ssl/ssl_txt.c
+++ b/ssl/ssl_txt.c
@@ -153,7 +153,7 @@ int SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
 #endif /* OPENSSL_NO_KRB5 */
        if (x->compress_meth != 0)
                {
-               SSL_COMP *comp;
+               SSL_COMP *comp = NULL;
 
                ssl_cipher_get_evp(x,NULL,NULL,&comp);
                if (comp == NULL)