Add missing NULL check after calling EVP_PKEY_new_mac_key().

Based on Adam Langley's chromium patches.

2 files changed, 4 insertions, 0 deletions

diff --git a/src/lib/libssl/src/ssl/t1_enc.c b/src/lib/libssl/src/ssl/t1_enc.c
index fba582d4ad..59c0c487ef 100644
--- a/src/lib/libssl/src/ssl/t1_enc.c
+++ b/src/lib/libssl/src/ssl/t1_enc.c
@@ -487,6 +487,8 @@ tls1_change_cipher_state(SSL *s, int which)
         if (!(EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER)) {
                 mac_key = EVP_PKEY_new_mac_key(mac_type, NULL,
                     mac_secret, mac_secret_size);
+                if (mac_key == NULL)
+                        goto err;
                 EVP_DigestSignInit(mac_ctx, NULL, mac, NULL, mac_key);
                 EVP_PKEY_free(mac_key);
         }
diff --git a/src/lib/libssl/t1_enc.c b/src/lib/libssl/t1_enc.c
index fba582d4ad..59c0c487ef 100644
--- a/src/lib/libssl/t1_enc.c
+++ b/src/lib/libssl/t1_enc.c
@@ -487,6 +487,8 @@ tls1_change_cipher_state(SSL *s, int which)
         if (!(EVP_CIPHER_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER)) {
                 mac_key = EVP_PKEY_new_mac_key(mac_type, NULL,
                     mac_secret, mac_secret_size);
+                if (mac_key == NULL)
+                        goto err;
                 EVP_DigestSignInit(mac_ctx, NULL, mac, NULL, mac_key);
                 EVP_PKEY_free(mac_key);
         }