Check the return value of the UI functions (including UI_new() which return

value is happily dereferenced without checking it for being non-NULL).

ok beck@

diff --git a/lib/libcrypto/evp/evp_key.c b/lib/libcrypto/evp/evp_key.c
index dffca30..2873a88 100644 (file)
--- a/lib/libcrypto/evp/evp_key.c
+++ b/lib/libcrypto/evp/evp_key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp_key.c,v 1.18 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: evp_key.c,v 1.19 2014/07/23 04:44:56 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -103,11 +103,16 @@ EVP_read_pw_string_min(char *buf, int min, int len, const char *prompt,
        if ((prompt == NULL) && (prompt_string[0] != '\0'))
                prompt = prompt_string;
        ui = UI_new();
-       UI_add_input_string(ui, prompt, 0, buf, min,
-           (len >= BUFSIZ) ? BUFSIZ - 1 : len);
-       if (verify)
-               UI_add_verify_string(ui, prompt, 0, buff, min,
-                   (len >= BUFSIZ) ? BUFSIZ - 1 : len, buf);
+       if (ui == NULL)
+               return -1;
+       if (UI_add_input_string(ui, prompt, 0, buf, min,
+           (len >= BUFSIZ) ? BUFSIZ - 1 : len) != 0)
+               return -1;
+       if (verify) {
+               if (UI_add_verify_string(ui, prompt, 0, buff, min,
+                   (len >= BUFSIZ) ? BUFSIZ - 1 : len, buf) != 0)
+                       return -1;
+       }
        ret = UI_process(ui);
        UI_free(ui);
        OPENSSL_cleanse(buff, BUFSIZ);

diff --git a/lib/libssl/src/crypto/evp/evp_key.c b/lib/libssl/src/crypto/evp/evp_key.c
index dffca30..2873a88 100644 (file)
--- a/lib/libssl/src/crypto/evp/evp_key.c
+++ b/lib/libssl/src/crypto/evp/evp_key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp_key.c,v 1.18 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: evp_key.c,v 1.19 2014/07/23 04:44:56 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -103,11 +103,16 @@ EVP_read_pw_string_min(char *buf, int min, int len, const char *prompt,
        if ((prompt == NULL) && (prompt_string[0] != '\0'))
                prompt = prompt_string;
        ui = UI_new();
-       UI_add_input_string(ui, prompt, 0, buf, min,
-           (len >= BUFSIZ) ? BUFSIZ - 1 : len);
-       if (verify)
-               UI_add_verify_string(ui, prompt, 0, buff, min,
-                   (len >= BUFSIZ) ? BUFSIZ - 1 : len, buf);
+       if (ui == NULL)
+               return -1;
+       if (UI_add_input_string(ui, prompt, 0, buf, min,
+           (len >= BUFSIZ) ? BUFSIZ - 1 : len) != 0)
+               return -1;
+       if (verify) {
+               if (UI_add_verify_string(ui, prompt, 0, buff, min,
+                   (len >= BUFSIZ) ? BUFSIZ - 1 : len, buf) != 0)
+                       return -1;
+       }
        ret = UI_process(ui);
        UI_free(ui);
        OPENSSL_cleanse(buff, BUFSIZ);