From 06057e00f86133acd22ec2d6b53d90bce0fc217e Mon Sep 17 00:00:00 2001 From: bcook Date: Sun, 5 Aug 2018 13:30:04 +0000 Subject: [PATCH] In RSA_padding_add_PKCS1_OAEP, dbmask needs to be freed on failure. ok tb@ --- lib/libcrypto/rsa/rsa_oaep.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/lib/libcrypto/rsa/rsa_oaep.c b/lib/libcrypto/rsa/rsa_oaep.c index cd7af203b76..a62927506ed 100644 --- a/lib/libcrypto/rsa/rsa_oaep.c +++ b/lib/libcrypto/rsa/rsa_oaep.c @@ -1,4 +1,4 @@ -/* $OpenBSD: rsa_oaep.c,v 1.26 2017/01/29 17:49:23 beck Exp $ */ +/* $OpenBSD: rsa_oaep.c,v 1.27 2018/08/05 13:30:04 bcook Exp $ */ /* Written by Ulf Moeller. This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. */ @@ -72,14 +72,18 @@ RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen, } if (MGF1(dbmask, emlen - SHA_DIGEST_LENGTH, seed, - SHA_DIGEST_LENGTH) < 0) + SHA_DIGEST_LENGTH) < 0) { + free(dbmask); return 0; + } for (i = 0; i < emlen - SHA_DIGEST_LENGTH; i++) db[i] ^= dbmask[i]; if (MGF1(seedmask, SHA_DIGEST_LENGTH, db, - emlen - SHA_DIGEST_LENGTH) < 0) + emlen - SHA_DIGEST_LENGTH) < 0) { + free(dbmask); return 0; + } for (i = 0; i < SHA_DIGEST_LENGTH; i++) seed[i] ^= seedmask[i]; -- 2.20.1