diff options
| author | David Benjamin <davidben@chromium.org> | 2016-01-09 03:34:51 +0300 |
|---|---|---|
| committer | Adam Langley <agl@google.com> | 2016-02-04 20:23:28 +0300 |
| commit | 11aac10987c2d2d41bf47c45ee3779515856ab08 (patch) | |
| tree | 5f2e278f05e21ea5bf8d5ee7c5b720ed61e5c512 /crypto/bytestring | |
| parent | 168297e8705eafc72a7ce3c2f64babddea005c1c (diff) | |
Fix theoretical memory leak on malloc error in CBS_asn1_ber_to_der.
On failure, CBB_finish doesn't call CBB_cleanup. Also chain more of the ||s
together now that CBB_cleanup after failed CBB_init is legal.
(I don't think this is actually reachable because the CBB is guaranteed to be
flushed by this point.)
Change-Id: Ib16a0a185f15e13675ac2550c5e8e0926ceb7957
Reviewed-on: https://boringssl-review.googlesource.com/7051
Reviewed-by: Adam Langley <agl@google.com>
Diffstat (limited to 'crypto/bytestring')
| -rw-r--r-- | crypto/bytestring/ber.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/crypto/bytestring/ber.c b/crypto/bytestring/ber.c index 9e8daaa5..6f7d1077 100644 --- a/crypto/bytestring/ber.c +++ b/crypto/bytestring/ber.c @@ -209,13 +209,12 @@ int CBS_asn1_ber_to_der(CBS *in, uint8_t **out, size_t *out_len) { return 1; } - if (!CBB_init(&cbb, CBS_len(in))) { - return 0; - } - if (!cbs_convert_ber(in, &cbb, 0, 0, 0)) { + if (!CBB_init(&cbb, CBS_len(in)) || + !cbs_convert_ber(in, &cbb, 0, 0, 0) || + !CBB_finish(&cbb, out, out_len)) { CBB_cleanup(&cbb); return 0; } - return CBB_finish(&cbb, out, out_len); + return 1; } |