1 files changed, 13 insertions, 8 deletions

diff --git a/src/lib/libcrypto/pem/pem_lib.c b/src/lib/libcrypto/pem/pem_lib.c
index 70b5446797..7785039b99 100644
--- a/src/lib/libcrypto/pem/pem_lib.c
+++ b/src/lib/libcrypto/pem/pem_lib.c
@@ -131,9 +131,9 @@ void PEM_proc_type(char *buf, int type)
         else
                 str="BAD-TYPE";
                 
-        strcat(buf,"Proc-Type: 4,");
-        strcat(buf,str);
-        strcat(buf,"\n");
+        BUF_strlcat(buf,"Proc-Type: 4,",PEM_BUFSIZE);
+        BUF_strlcat(buf,str,PEM_BUFSIZE);
+        BUF_strlcat(buf,"\n",PEM_BUFSIZE);
         }
 
 void PEM_dek_info(char *buf, const char *type, int len, char *str)
@@ -142,10 +142,12 @@ void PEM_dek_info(char *buf, const char *type, int len, char *str)
         long i;
         int j;
 
-        strcat(buf,"DEK-Info: ");
-        strcat(buf,type);
-        strcat(buf,",");
+        BUF_strlcat(buf,"DEK-Info: ",PEM_BUFSIZE);
+        BUF_strlcat(buf,type,PEM_BUFSIZE);
+        BUF_strlcat(buf,",",PEM_BUFSIZE);
         j=strlen(buf);
+        if (j + (len * 2) + 1 > PEM_BUFSIZE)
+                return;
         for (i=0; i<len; i++)
                 {
                 buf[j+i*2]  =map[(str[i]>>4)&0x0f];
@@ -533,7 +535,7 @@ int PEM_write_bio(BIO *bp, const char *name, char *header, unsigned char *data,
              long len)
         {
         int nlen,n,i,j,outl;
-        unsigned char *buf;
+        unsigned char *buf = NULL;
         EVP_ENCODE_CTX ctx;
         int reason=ERR_R_BUF_LIB;
         
@@ -553,7 +555,7 @@ int PEM_write_bio(BIO *bp, const char *name, char *header, unsigned char *data,
                         goto err;
                 }
 
-        buf=(unsigned char *)OPENSSL_malloc(PEM_BUFSIZE*8);
+        buf = OPENSSL_malloc(PEM_BUFSIZE*8);
         if (buf == NULL)
                 {
                 reason=ERR_R_MALLOC_FAILURE;
@@ -574,12 +576,15 @@ int PEM_write_bio(BIO *bp, const char *name, char *header, unsigned char *data,
         EVP_EncodeFinal(&ctx,buf,&outl);
         if ((outl > 0) && (BIO_write(bp,(char *)buf,outl) != outl)) goto err;
         OPENSSL_free(buf);
+        buf = NULL;
         if (    (BIO_write(bp,"-----END ",9) != 9) ||
                 (BIO_write(bp,name,nlen) != nlen) ||
                 (BIO_write(bp,"-----\n",6) != 6))
                 goto err;
         return(i+outl);
 err:
+        if (buf)
+                OPENSSL_free(buf);
         PEMerr(PEM_F_PEM_WRITE_BIO,reason);
         return(0);
         }