From: tb <tb@openbsd.org>
Date: Thu, 28 Dec 2023 22:06:41 +0000 (+0000)
Subject: Rework pkey_dh_keygen()
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=3b26100e012949c92e0c84e97cfc7448dc0f7a54;p=openbsd

Rework pkey_dh_keygen()

Single exit, fix error checking and hold on to the DH by keeping a
reference. In other words, switch from EVP_PKEY_assign() to using
EVP_PKEY_set1_DH() and free unconditionally in the error path.

ok jsing
---

diff --git a/lib/libcrypto/dh/dh_pmeth.c b/lib/libcrypto/dh/dh_pmeth.c
index 7a598da27b6..5a43acceffd 100644
--- a/lib/libcrypto/dh/dh_pmeth.c
+++ b/lib/libcrypto/dh/dh_pmeth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_pmeth.c,v 1.13 2022/11/26 16:08:51 tb Exp $ */
+/* $OpenBSD: dh_pmeth.c,v 1.14 2023/12/28 22:06:41 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2006.
  */
@@ -215,19 +215,29 @@ static int
 pkey_dh_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
 {
 	DH *dh = NULL;
+	int ret = 0;
 
 	if (ctx->pkey == NULL) {
 		DHerror(DH_R_NO_PARAMETERS_SET);
-		return 0;
+		goto err;
 	}
-	dh = DH_new();
-	if (!dh)
-		return 0;
-	EVP_PKEY_assign_DH(pkey, dh);
-	/* Note: if error return, pkey is freed by parent routine */
+
+	if ((dh = DH_new()) == NULL)
+		goto err;
+	if (!EVP_PKEY_set1_DH(pkey, dh))
+		goto err;
+
 	if (!EVP_PKEY_copy_parameters(pkey, ctx->pkey))
-		return 0;
-	return DH_generate_key(pkey->pkey.dh);
+		goto err;
+	if (!DH_generate_key(dh))
+		goto err;
+
+	ret = 1;
+
+ err:
+	DH_free(dh);
+
+	return ret;
 }
 
 static int