From 3bb5a77205b1ea66fd7ad3d103ff15cb752fe0bd Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Thu, 28 Apr 2016 20:28:11 -0400 Subject: [PATCH] Fix memory leak on error in BN_mpi2bn. See also upstream's 91fb42ddbef7a88640d1a0f853c941c20df07de7, though that has a bug if |out| was non-NULL on entry. (I'll send them a patch.) Change-Id: I807f23007b89063c23e02dac11c4ffb41f847fdf Reviewed-on: https://boringssl-review.googlesource.com/7810 Reviewed-by: David Benjamin --- crypto/bn/convert.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/crypto/bn/convert.c b/crypto/bn/convert.c index 542f523f..9125bf84 100644 --- a/crypto/bn/convert.c +++ b/crypto/bn/convert.c @@ -577,12 +577,14 @@ BIGNUM *BN_mpi2bn(const uint8_t *in, size_t len, BIGNUM *out) { return NULL; } + int out_is_alloced = 0; if (out == NULL) { out = BN_new(); - } - if (out == NULL) { - OPENSSL_PUT_ERROR(BN, ERR_R_MALLOC_FAILURE); - return NULL; + if (out == NULL) { + OPENSSL_PUT_ERROR(BN, ERR_R_MALLOC_FAILURE); + return NULL; + } + out_is_alloced = 1; } if (in_len == 0) { @@ -592,6 +594,9 @@ BIGNUM *BN_mpi2bn(const uint8_t *in, size_t len, BIGNUM *out) { in += 4; if (BN_bin2bn(in, in_len, out) == NULL) { + if (out_is_alloced) { + BN_free(out); + } return NULL; } out->neg = ((*in) & 0x80) != 0;