Fix the error handling in X509V3_parse_list(3); it ignored failures

of the internal subroutine X509V3_add_value(), which could result
in silently losing part of the input data on memory exhaustion.

I independently rediscovered this bug while writing the documentation,
then noticed after fixing it that Zhou Qingyang <zhou1615 at umn dot edu>
fixed it in essentially the same way in OpenSSL 3 (commit bcd5645b
on Apr 11 02:05:19 2022 +0800), but it wasn't backported to the
OpenSSL 1.1.1 branch.

OK tb@

1 files changed, 9 insertions, 6 deletions

diff --git a/src/lib/libcrypto/x509/x509_utl.c b/src/lib/libcrypto/x509/x509_utl.c
index f327e9fca7..64dc1068b7 100644
--- a/src/lib/libcrypto/x509/x509_utl.c
+++ b/src/lib/libcrypto/x509/x509_utl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_utl.c,v 1.22 2024/08/31 18:38:46 tb Exp $ */
+/* $OpenBSD: x509_utl.c,v 1.23 2024/12/23 09:05:27 schwarze Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -391,7 +391,8 @@ X509V3_parse_list(const char *line)
                                         X509V3error(X509V3_R_INVALID_NULL_NAME);
                                         goto err;
                                 }
-                                X509V3_add_value(ntmp, NULL, &values);
+                                if (!X509V3_add_value(ntmp, NULL, &values))
+                                        goto err;
                         }
                         break;
 
@@ -404,7 +405,8 @@ X509V3_parse_list(const char *line)
                                         X509V3error(X509V3_R_INVALID_NULL_VALUE);
                                         goto err;
                                 }
-                                X509V3_add_value(ntmp, vtmp, &values);
+                                if (!X509V3_add_value(ntmp, vtmp, &values))
+                                        goto err;
                                 ntmp = NULL;
                                 q = p + 1;
                         }
@@ -418,14 +420,16 @@ X509V3_parse_list(const char *line)
                         X509V3error(X509V3_R_INVALID_NULL_VALUE);
                         goto err;
                 }
-                X509V3_add_value(ntmp, vtmp, &values);
+                if (!X509V3_add_value(ntmp, vtmp, &values))
+                        goto err;
         } else {
                 ntmp = strip_spaces(q);
                 if (!ntmp) {
                         X509V3error(X509V3_R_INVALID_NULL_NAME);
                         goto err;
                 }
-                X509V3_add_value(ntmp, NULL, &values);
+                if (!X509V3_add_value(ntmp, NULL, &values))
+                        goto err;
         }
         free(linebuf);
         return values;
@@ -434,7 +438,6 @@ X509V3_parse_list(const char *line)
         free(linebuf);
         sk_CONF_VALUE_pop_free(values, X509V3_conf_free);
         return NULL;
-
 }
 LCRYPTO_ALIAS(X509V3_parse_list);