RE: [openssl.org #1856] [PATCH] Fix null pointer deref under low memory

[David Schwartz]

> --- crypto\pkcs12\p12_crt.c � Wed Mar �4 13:37:26 2009
>+++ crypto\pkcs12\p12_crt.c � �Wed Mar �4 12:44:40 2009
>@@ -168,7 +168,8 @@ PKCS12 *PKCS12_create(char *pass, char *
>�� � � �sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
>�� � � �bags = NULL;
>
>- � � � p12 = PKCS12_add_safes(safes, 0);
>+ � � � if (!(p12 = PKCS12_add_safes(safes, 0)))
>+ � � � � � � � goto err;
>
>�� � � �sk_PKCS7_pop_free(safes, PKCS7_free);

        Won't this leak 'safes'? Don't you need to do it like this:

p12 = PKCS12_add_safes(safes, 0);
sk_PKSC7_pop_free(safes, PKCS7_free);
if(p12==NULL) goto err;

        DS


______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       openssl-dev@openssl.org
Automated List Manager                           majord...@openssl.org