4 files changed, 29 insertions, 12 deletions

diff --git a/src/lib/libcrypto/pkcs12/p12_crpt.c b/src/lib/libcrypto/pkcs12/p12_crpt.c
index 5e8958612b..003ec7a33e 100644
--- a/src/lib/libcrypto/pkcs12/p12_crpt.c
+++ b/src/lib/libcrypto/pkcs12/p12_crpt.c
@@ -88,7 +88,7 @@ int PKCS12_PBE_keyivgen (EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
                 ASN1_TYPE *param, const EVP_CIPHER *cipher, const EVP_MD *md, int en_de)
 {
         PBEPARAM *pbe;
-        int saltlen, iter;
+        int saltlen, iter, ret;
         unsigned char *salt, *pbuf;
         unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH];
 
@@ -117,8 +117,8 @@ int PKCS12_PBE_keyivgen (EVP_CIPHER_CTX *ctx, const char *pass, int passlen,
                 return 0;
         }
         PBEPARAM_free(pbe);
-        EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, en_de);
+        ret = EVP_CipherInit_ex(ctx, cipher, NULL, key, iv, en_de);
         OPENSSL_cleanse(key, EVP_MAX_KEY_LENGTH);
         OPENSSL_cleanse(iv, EVP_MAX_IV_LENGTH);
-        return 1;
+        return ret;
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_init.c b/src/lib/libcrypto/pkcs12/p12_init.c
index eb837a78cf..5276b12669 100644
--- a/src/lib/libcrypto/pkcs12/p12_init.c
+++ b/src/lib/libcrypto/pkcs12/p12_init.c
@@ -76,15 +76,17 @@ PKCS12 *PKCS12_init (int mode)
                         if (!(pkcs12->authsafes->d.data =
                                  M_ASN1_OCTET_STRING_new())) {
                         PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
-                        return NULL;
+                        goto err;
                 }
                 break;
                 default:
-                        PKCS12err(PKCS12_F_PKCS12_INIT,PKCS12_R_UNSUPPORTED_PKCS12_MODE);
-                        PKCS12_free(pkcs12);
-                        return NULL;
-                break;
+                        PKCS12err(PKCS12_F_PKCS12_INIT,
+                                PKCS12_R_UNSUPPORTED_PKCS12_MODE);
+                        goto err;
         }
                 
         return pkcs12;
+err:
+        if (pkcs12 != NULL) PKCS12_free(pkcs12);
+        return NULL;
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_kiss.c b/src/lib/libcrypto/pkcs12/p12_kiss.c
index 885087ad00..2b31999e11 100644
--- a/src/lib/libcrypto/pkcs12/p12_kiss.c
+++ b/src/lib/libcrypto/pkcs12/p12_kiss.c
@@ -249,14 +249,26 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
                 if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate )
                                                                  return 1;
                 if (!(x509 = PKCS12_certbag2x509(bag))) return 0;
-                if(ckid) X509_keyid_set1(x509, ckid->data, ckid->length);
+                if(ckid)
+                        {
+                        if (!X509_keyid_set1(x509, ckid->data, ckid->length))
+                                {
+                                X509_free(x509);
+                                return 0;
+                                }
+                        }
                 if(fname) {
-                        int len;
+                        int len, r;
                         unsigned char *data;
                         len = ASN1_STRING_to_UTF8(&data, fname);
                         if(len > 0) {
-                                X509_alias_set1(x509, data, len);
+                                r = X509_alias_set1(x509, data, len);
                                 OPENSSL_free(data);
+                                if (!r)
+                                        {
+                                        X509_free(x509);
+                                        return 0;
+                                        }
                         }
                 }
 
diff --git a/src/lib/libcrypto/pkcs12/p12_mutl.c b/src/lib/libcrypto/pkcs12/p12_mutl.c
index 0fb67f74b8..4886b9b289 100644
--- a/src/lib/libcrypto/pkcs12/p12_mutl.c
+++ b/src/lib/libcrypto/pkcs12/p12_mutl.c
@@ -148,7 +148,10 @@ int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
                         PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);
                         return 0;
                 }
-                ASN1_INTEGER_set(p12->mac->iter, iter);
+                if (!ASN1_INTEGER_set(p12->mac->iter, iter)) {
+                        PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
         }
         if (!saltlen) saltlen = PKCS12_SALT_LEN;
         p12->mac->salt->length = saltlen;