Check the return value of the UI functions (including UI_new() which return

value is happily dereferenced without checking it for being non-NULL).

ok beck@

2 files changed, 22 insertions, 12 deletions

diff --git a/src/lib/libcrypto/evp/evp_key.c b/src/lib/libcrypto/evp/evp_key.c
index dffca300c6..2873a888bd 100644
--- a/src/lib/libcrypto/evp/evp_key.c
+++ b/src/lib/libcrypto/evp/evp_key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp_key.c,v 1.18 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: evp_key.c,v 1.19 2014/07/23 04:44:56 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -103,11 +103,16 @@ EVP_read_pw_string_min(char *buf, int min, int len, const char *prompt,
         if ((prompt == NULL) && (prompt_string[0] != '\0'))
                 prompt = prompt_string;
         ui = UI_new();
-        UI_add_input_string(ui, prompt, 0, buf, min,
-            (len >= BUFSIZ) ? BUFSIZ - 1 : len);
-        if (verify)
-                UI_add_verify_string(ui, prompt, 0, buff, min,
-                    (len >= BUFSIZ) ? BUFSIZ - 1 : len, buf);
+        if (ui == NULL)
+                return -1;
+        if (UI_add_input_string(ui, prompt, 0, buf, min,
+            (len >= BUFSIZ) ? BUFSIZ - 1 : len) != 0)
+                return -1;
+        if (verify) {
+                if (UI_add_verify_string(ui, prompt, 0, buff, min,
+                    (len >= BUFSIZ) ? BUFSIZ - 1 : len, buf) != 0)
+                        return -1;
+        }
         ret = UI_process(ui);
         UI_free(ui);
         OPENSSL_cleanse(buff, BUFSIZ);
diff --git a/src/lib/libssl/src/crypto/evp/evp_key.c b/src/lib/libssl/src/crypto/evp/evp_key.c
index dffca300c6..2873a888bd 100644
--- a/src/lib/libssl/src/crypto/evp/evp_key.c
+++ b/src/lib/libssl/src/crypto/evp/evp_key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp_key.c,v 1.18 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: evp_key.c,v 1.19 2014/07/23 04:44:56 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -103,11 +103,16 @@ EVP_read_pw_string_min(char *buf, int min, int len, const char *prompt,
         if ((prompt == NULL) && (prompt_string[0] != '\0'))
                 prompt = prompt_string;
         ui = UI_new();
-        UI_add_input_string(ui, prompt, 0, buf, min,
-            (len >= BUFSIZ) ? BUFSIZ - 1 : len);
-        if (verify)
-                UI_add_verify_string(ui, prompt, 0, buff, min,
-                    (len >= BUFSIZ) ? BUFSIZ - 1 : len, buf);
+        if (ui == NULL)
+                return -1;
+        if (UI_add_input_string(ui, prompt, 0, buf, min,
+            (len >= BUFSIZ) ? BUFSIZ - 1 : len) != 0)
+                return -1;
+        if (verify) {
+                if (UI_add_verify_string(ui, prompt, 0, buff, min,
+                    (len >= BUFSIZ) ? BUFSIZ - 1 : len, buf) != 0)
+                        return -1;
+        }
         ret = UI_process(ui);
         UI_free(ui);
         OPENSSL_cleanse(buff, BUFSIZ);