6 files changed, 36 insertions, 10 deletions

diff --git a/src/lib/libcrypto/asn1/a_bitstr.c b/src/lib/libcrypto/asn1/a_bitstr.c
index c36817c1ee..ed0bdfbde1 100644
--- a/src/lib/libcrypto/asn1/a_bitstr.c
+++ b/src/lib/libcrypto/asn1/a_bitstr.c
@@ -71,8 +71,6 @@ int i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
         if (a == NULL) return(0);
 
         len=a->length;
-        ret=1+len;
-        if (pp == NULL) return(ret);
 
         if (len > 0)
                 {
@@ -100,6 +98,10 @@ int i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
                 }
         else
                 bits=0;
+
+        ret=1+len;
+        if (pp == NULL) return(ret);
+
         p= *pp;
 
         *(p++)=(unsigned char)bits;
diff --git a/src/lib/libcrypto/asn1/a_enum.c b/src/lib/libcrypto/asn1/a_enum.c
index 8a315fa371..ad8f0ffd1a 100644
--- a/src/lib/libcrypto/asn1/a_enum.c
+++ b/src/lib/libcrypto/asn1/a_enum.c
@@ -151,7 +151,17 @@ ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
         else ret->type=V_ASN1_ENUMERATED;
         j=BN_num_bits(bn);
         len=((j == 0)?0:((j/8)+1));
-        ret->data=(unsigned char *)OPENSSL_malloc(len+4);
+        if (ret->length < len+4)
+                {
+                unsigned char *new_data=OPENSSL_realloc(ret->data, len+4);
+                if (!new_data)
+                        {
+                        ASN1err(ASN1_F_BN_TO_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                ret->data=new_data;
+                }
+
         ret->length=BN_bn2bin(bn,ret->data);
         return(ret);
 err:
diff --git a/src/lib/libcrypto/asn1/a_int.c b/src/lib/libcrypto/asn1/a_int.c
index 496704b9a5..edb243c021 100644
--- a/src/lib/libcrypto/asn1/a_int.c
+++ b/src/lib/libcrypto/asn1/a_int.c
@@ -397,7 +397,16 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
         else ret->type=V_ASN1_INTEGER;
         j=BN_num_bits(bn);
         len=((j == 0)?0:((j/8)+1));
-        ret->data=(unsigned char *)OPENSSL_malloc(len+4);
+        if (ret->length < len+4)
+                {
+                unsigned char *new_data=OPENSSL_realloc(ret->data, len+4);
+                if (!new_data)
+                        {
+                        ASN1err(ASN1_F_BN_TO_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                ret->data=new_data;
+                }
         ret->length=BN_bn2bin(bn,ret->data);
         /* Correct zero case */
         if(!ret->length)
diff --git a/src/lib/libcrypto/asn1/a_set.c b/src/lib/libcrypto/asn1/a_set.c
index 19bb60fca8..0f839822ff 100644
--- a/src/lib/libcrypto/asn1/a_set.c
+++ b/src/lib/libcrypto/asn1/a_set.c
@@ -118,7 +118,7 @@ int i2d_ASN1_SET(STACK *a, unsigned char **pp, int (*func)(), int ex_tag,
                 }
 
         pStart  = p; /* Catch the beg of Setblobs*/
-        rgSetBlob = (MYBLOB *)OPENSSL_malloc( sk_num(a) * sizeof(MYBLOB)); /* In this array
+        if (!(rgSetBlob = (MYBLOB *)OPENSSL_malloc( sk_num(a) * sizeof(MYBLOB)))) return 0; /* In this array
 we will store the SET blobs */
 
         for (i=0; i<sk_num(a); i++)
@@ -135,7 +135,7 @@ SetBlob
  /* Now we have to sort the blobs. I am using a simple algo.
     *Sort ptrs *Copy to temp-mem *Copy from temp-mem to user-mem*/
         qsort( rgSetBlob, sk_num(a), sizeof(MYBLOB), SetBlobCmp);
-        pTempMem = OPENSSL_malloc(totSize);
+        if (!(pTempMem = OPENSSL_malloc(totSize))) return 0;
 
 /* Copy to temp mem */
         p = pTempMem;
diff --git a/src/lib/libcrypto/asn1/a_utctm.c b/src/lib/libcrypto/asn1/a_utctm.c
index ed2d827db2..dbb4a42c9d 100644
--- a/src/lib/libcrypto/asn1/a_utctm.c
+++ b/src/lib/libcrypto/asn1/a_utctm.c
@@ -222,6 +222,7 @@ ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
 int ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t)
         {
         struct tm *tm;
+        struct tm data;
         int offset;
         int year;
 
@@ -238,7 +239,7 @@ int ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t)
 
         t -= offset*60; /* FIXME: may overflow in extreme cases */
 
-        { struct tm data; tm = OPENSSL_gmtime(&t, &data); }
+        tm = OPENSSL_gmtime(&t, &data);
         
 #define return_cmp(a,b) if ((a)<(b)) return -1; else if ((a)>(b)) return 1
         year = g2(s->data);
diff --git a/src/lib/libcrypto/asn1/x_pubkey.c b/src/lib/libcrypto/asn1/x_pubkey.c
index 55630294b6..d958540120 100644
--- a/src/lib/libcrypto/asn1/x_pubkey.c
+++ b/src/lib/libcrypto/asn1/x_pubkey.c
@@ -84,7 +84,7 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
         X509_PUBKEY *pk;
         X509_ALGOR *a;
         ASN1_OBJECT *o;
-        unsigned char *s,*p;
+        unsigned char *s,*p = NULL;
         int i;
 
         if (x == NULL) return(0);
@@ -119,7 +119,7 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
                 dsa->write_params=0;
                 ASN1_TYPE_free(a->parameter);
                 i=i2d_DSAparams(dsa,NULL);
-                p=(unsigned char *)OPENSSL_malloc(i);
+                if ((p=(unsigned char *)OPENSSL_malloc(i)) == NULL) goto err;
                 pp=p;
                 i2d_DSAparams(dsa,&pp);
                 a->parameter=ASN1_TYPE_new();
@@ -136,7 +136,11 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
                 }
 
         if ((i=i2d_PublicKey(pkey,NULL)) <= 0) goto err;
-        if ((s=(unsigned char *)OPENSSL_malloc(i+1)) == NULL) goto err;
+        if ((s=(unsigned char *)OPENSSL_malloc(i+1)) == NULL)
+                {
+                X509err(X509_F_X509_PUBKEY_SET,ERR_R_MALLOC_FAILURE);
+                goto err;
+                }
         p=s;
         i2d_PublicKey(pkey,&p);
         if (!M_ASN1_BIT_STRING_set(pk->public_key,s,i)) goto err;