Check the return value of sk_SSL_CIPHER_new_null(), since it allocates

memory and can return NULL.

ok miod@

2 files changed, 14 insertions, 10 deletions

diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index b3f4210266..55ab469df5 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_lib.c,v 1.80 2014/08/11 01:10:42 jsing Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.81 2014/08/11 10:46:19 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1417,10 +1417,12 @@ ssl_bytes_to_cipher_list(SSL *s, unsigned char *p, int num,
                     SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
                 return (NULL);
         }
-        if ((skp == NULL) || (*skp == NULL))
-                sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
-        else {
-                sk= *skp;
+        if (skp == NULL || *skp == NULL) {
+                sk = sk_SSL_CIPHER_new_null(); /* change perhaps later */
+                if (sk == NULL)
+                        goto err;
+        } else {
+                sk = *skp;
                 sk_SSL_CIPHER_zero(sk);
         }
 
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index b3f4210266..55ab469df5 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_lib.c,v 1.80 2014/08/11 01:10:42 jsing Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.81 2014/08/11 10:46:19 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1417,10 +1417,12 @@ ssl_bytes_to_cipher_list(SSL *s, unsigned char *p, int num,
                     SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
                 return (NULL);
         }
-        if ((skp == NULL) || (*skp == NULL))
-                sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
-        else {
-                sk= *skp;
+        if (skp == NULL || *skp == NULL) {
+                sk = sk_SSL_CIPHER_new_null(); /* change perhaps later */
+                if (sk == NULL)
+                        goto err;
+        } else {
+                sk = *skp;
                 sk_SSL_CIPHER_zero(sk);
         }