1 files changed, 22 insertions, 16 deletions

diff --git a/src/lib/libcrypto/pkcs12/p12_key.c b/src/lib/libcrypto/pkcs12/p12_key.c
index a29794bbbc..424203f648 100644
--- a/src/lib/libcrypto/pkcs12/p12_key.c
+++ b/src/lib/libcrypto/pkcs12/p12_key.c
@@ -107,6 +107,7 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
         unsigned char *B, *D, *I, *p, *Ai;
         int Slen, Plen, Ilen, Ijlen;
         int i, j, u, v;
+        int ret = 0;
         BIGNUM *Ij, *Bpl1;      /* These hold Ij and B + 1 */
         EVP_MD_CTX ctx;
 #ifdef  DEBUG_KEYGEN
@@ -144,10 +145,8 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
         I = OPENSSL_malloc (Ilen);
         Ij = BN_new();
         Bpl1 = BN_new();
-        if (!D || !Ai || !B || !I || !Ij || !Bpl1) {
-                PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_MALLOC_FAILURE);
-                return 0;
-        }
+        if (!D || !Ai || !B || !I || !Ij || !Bpl1)
+                goto err;
         for (i = 0; i < v; i++) D[i] = id;
         p = I;
         for (i = 0; i < Slen; i++) *p++ = salt[i % saltlen];
@@ -164,28 +163,22 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
                 }
                 memcpy (out, Ai, min (n, u));
                 if (u >= n) {
-                        OPENSSL_free (Ai);
-                        OPENSSL_free (B);
-                        OPENSSL_free (D);
-                        OPENSSL_free (I);
-                        BN_free (Ij);
-                        BN_free (Bpl1);
-                        EVP_MD_CTX_cleanup(&ctx);
 #ifdef DEBUG_KEYGEN
                         fprintf(stderr, "Output KEY (length %d)\n", tmpn);
                         h__dump(tmpout, tmpn);
 #endif
-                        return 1;       
+                        ret = 1;
+                        goto end;
                 }
                 n -= u;
                 out += u;
                 for (j = 0; j < v; j++) B[j] = Ai[j % u];
                 /* Work out B + 1 first then can use B as tmp space */
-                BN_bin2bn (B, v, Bpl1);
-                BN_add_word (Bpl1, 1);
+                if (!BN_bin2bn (B, v, Bpl1)) goto err;
+                if (!BN_add_word (Bpl1, 1)) goto err;
                 for (j = 0; j < Ilen ; j+=v) {
-                        BN_bin2bn (I + j, v, Ij);
-                        BN_add (Ij, Ij, Bpl1);
+                        if (!BN_bin2bn (I + j, v, Ij)) goto err;
+                        if (!BN_add (Ij, Ij, Bpl1)) goto err;
                         BN_bn2bin (Ij, B);
                         Ijlen = BN_num_bytes (Ij);
                         /* If more than 2^(v*8) - 1 cut off MSB */
@@ -201,6 +194,19 @@ int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
                         } else BN_bn2bin (Ij, I + j);
                 }
         }
+
+err:
+        PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_MALLOC_FAILURE);
+
+end:
+        OPENSSL_free (Ai);
+        OPENSSL_free (B);
+        OPENSSL_free (D);
+        OPENSSL_free (I);
+        BN_free (Ij);
+        BN_free (Bpl1);
+        EVP_MD_CTX_cleanup(&ctx);
+        return ret;
 }
 #ifdef DEBUG_KEYGEN
 void h__dump (unsigned char *p, int len)