Re: openvpn-2.3.8p1 segv in libcrypto BN_bn2dec on OpenBSD/i386 current Sep 16, 2015

[Miod Vallat]

> CC'ing tech@.
> 
> The last commit to bn_print.c is wrong, it dereferences t while it's still 
> NULL.
> 
> Backout diff below.

Argh, sorry about that. This is how it should have been done (diff
against 1.25)

Index: bn_print.c
===================================================================
RCS file: /OpenBSD/src/lib/libssl/src/crypto/bn/bn_print.c,v
retrieving revision 1.25
diff -u -p -r1.25 bn_print.c
--- bn_print.c  13 Sep 2015 16:02:11 -0000      1.25
+++ bn_print.c  18 Sep 2015 09:06:42 -0000
@@ -114,14 +114,14 @@ BN_bn2dec(const BIGNUM *a)
        BIGNUM *t = NULL;
        BN_ULONG *bn_data = NULL, *lp;
 
-       if (BN_is_zero(t)) {
-               buf = malloc(BN_is_negative(t) + 2);
+       if (BN_is_zero(a)) {
+               buf = malloc(BN_is_negative(a) + 2);
                if (buf == NULL) {
                        BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);
                        goto err;
                }               
                p = buf;
-               if (BN_is_negative(t))
+               if (BN_is_negative(a))
                        *(p++) = '-';
                *(p++) = '0';
                *(p++) = '\0';