dsa_priv_decode(): only destroy the object we've created, and with the

  appropriate function. Checking for privkey != NULL is not enough since
  privkey points to a member of ndsa if ndsa != NULL.
dsa_priv_encode(): possible double free in error path.

diff --git a/lib/libcrypto/dsa/dsa_ameth.c b/lib/libcrypto/dsa/dsa_ameth.c
index 7da4ac5..20839b6 100644 (file)
--- a/lib/libcrypto/dsa/dsa_ameth.c
+++ b/lib/libcrypto/dsa/dsa_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dsa_ameth.c,v 1.13 2014/07/12 16:03:37 miod Exp $ */
+/* $OpenBSD: dsa_ameth.c,v 1.14 2014/07/13 12:45:01 miod Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -275,9 +275,10 @@ decerr:
        DSAerr(DSA_F_DSA_PRIV_DECODE, EVP_R_DECODE_ERROR);
 dsaerr:
        BN_CTX_free(ctx);
-       if (privkey)
+       if (ndsa)
+               sk_ASN1_TYPE_pop_free(ndsa, ASN1_TYPE_free);
+       else
                ASN1_INTEGER_free(privkey);
-       sk_ASN1_TYPE_pop_free(ndsa, ASN1_TYPE_free);
        DSA_free(dsa);
        return 0;
 }
@@ -313,6 +314,7 @@ dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
        dplen = i2d_ASN1_INTEGER(prkey, &dp);
 
        ASN1_INTEGER_free(prkey);
+       prkey = NULL;
 
        if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_dsa), 0, V_ASN1_SEQUENCE,
            params, dp, dplen))

diff --git a/lib/libssl/src/crypto/dsa/dsa_ameth.c b/lib/libssl/src/crypto/dsa/dsa_ameth.c
index 7da4ac5..20839b6 100644 (file)
--- a/lib/libssl/src/crypto/dsa/dsa_ameth.c
+++ b/lib/libssl/src/crypto/dsa/dsa_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dsa_ameth.c,v 1.13 2014/07/12 16:03:37 miod Exp $ */
+/* $OpenBSD: dsa_ameth.c,v 1.14 2014/07/13 12:45:01 miod Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -275,9 +275,10 @@ decerr:
        DSAerr(DSA_F_DSA_PRIV_DECODE, EVP_R_DECODE_ERROR);
 dsaerr:
        BN_CTX_free(ctx);
-       if (privkey)
+       if (ndsa)
+               sk_ASN1_TYPE_pop_free(ndsa, ASN1_TYPE_free);
+       else
                ASN1_INTEGER_free(privkey);
-       sk_ASN1_TYPE_pop_free(ndsa, ASN1_TYPE_free);
        DSA_free(dsa);
        return 0;
 }
@@ -313,6 +314,7 @@ dsa_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
        dplen = i2d_ASN1_INTEGER(prkey, &dp);
 
        ASN1_INTEGER_free(prkey);
+       prkey = NULL;
 
        if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_dsa), 0, V_ASN1_SEQUENCE,
            params, dp, dplen))