1 files changed, 17 insertions, 7 deletions

diff --git a/src/lib/libcrypto/x509/x509_addr.c b/src/lib/libcrypto/x509/x509_addr.c
index fdb2f64fd2..f6dbb3a9c1 100644
--- a/src/lib/libcrypto/x509/x509_addr.c
+++ b/src/lib/libcrypto/x509/x509_addr.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: x509_addr.c,v 1.52 2022/01/04 20:17:07 tb Exp $ */
+/*      $OpenBSD: x509_addr.c,v 1.53 2022/01/04 20:21:04 tb Exp $ */
 /*
  * Contributed to the OpenSSL Project by the American Registry for
  * Internet Numbers ("ARIN").
@@ -1088,12 +1088,22 @@ int
 X509v3_addr_get_range(IPAddressOrRange *aor, const unsigned afi,
     unsigned char *min, unsigned char *max, const int length)
 {
-        int afi_length = length_from_afi(afi);
-        if (aor == NULL || min == NULL || max == NULL ||
-            afi_length == 0 || length < afi_length ||
-            (aor->type != IPAddressOrRange_addressPrefix &&
-             aor->type != IPAddressOrRange_addressRange) ||
-            !extract_min_max(aor, min, max, afi_length))
+        int afi_length;
+
+        if (aor == NULL || min == NULL || max == NULL)
+                return 0;
+
+        if ((afi_length = length_from_afi(afi)) == 0)
+                return 0;
+
+        if (length < afi_length)
+                return 0;
+
+        if (aor->type != IPAddressOrRange_addressPrefix &&
+            aor->type != IPAddressOrRange_addressRange)
+                return 0;
+
+        if (!extract_min_max(aor, min, max, afi_length))
                 return 0;
 
         return afi_length;