6 files changed, 22 insertions, 4 deletions

diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index 60f36bb958..aed2895400 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -104,10 +104,12 @@ int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
                         l<<=7L;
                         l|= *(p++)&0x7f;
                         if (--max == 0) goto err;
+                        if (l > (INT_MAX >> 7L)) goto err;
                         }
                 l<<=7L;
                 l|= *(p++)&0x7f;
                 tag=(int)l;
+                if (--max == 0) goto err;
                 }
         else
                 { 
diff --git a/src/lib/libcrypto/asn1/tasn_dec.c b/src/lib/libcrypto/asn1/tasn_dec.c
index 76fc023230..2426cb6253 100644
--- a/src/lib/libcrypto/asn1/tasn_dec.c
+++ b/src/lib/libcrypto/asn1/tasn_dec.c
@@ -691,6 +691,7 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, unsigned char **in, long inl
 
 int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it)
 {
+        ASN1_VALUE **opval = NULL;
         ASN1_STRING *stmp;
         ASN1_TYPE *typ = NULL;
         int ret = 0;
@@ -705,6 +706,7 @@ int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char
                         *pval = (ASN1_VALUE *)typ;
                 } else typ = (ASN1_TYPE *)*pval;
                 if(utype != typ->type) ASN1_TYPE_set(typ, utype, NULL);
+                opval = pval;
                 pval = (ASN1_VALUE **)&typ->value.ptr;
         }
         switch(utype) {
@@ -796,7 +798,12 @@ int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char
 
         ret = 1;
         err:
-        if(!ret) ASN1_TYPE_free(typ);
+        if(!ret)
+                {
+                ASN1_TYPE_free(typ);
+                if (opval)
+                        *opval = NULL;
+                }
         return ret;
 }
 
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 552d1e7251..04997ba456 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -674,7 +674,7 @@ static int internal_verify(X509_STORE_CTX *ctx)
                                 ok=(*cb)(0,ctx);
                                 if (!ok) goto end;
                                 }
-                        if (X509_verify(xs,pkey) <= 0)
+                        else if (X509_verify(xs,pkey) <= 0)
                                 /* XXX  For the final trusted self-signed cert,
                                  * this is a waste of time.  That check should
                                  * optional so that e.g. 'openssl x509' can be
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_lib.c b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
index 60f36bb958..aed2895400 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_lib.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
@@ -104,10 +104,12 @@ int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
                         l<<=7L;
                         l|= *(p++)&0x7f;
                         if (--max == 0) goto err;
+                        if (l > (INT_MAX >> 7L)) goto err;
                         }
                 l<<=7L;
                 l|= *(p++)&0x7f;
                 tag=(int)l;
+                if (--max == 0) goto err;
                 }
         else
                 { 
diff --git a/src/lib/libssl/src/crypto/asn1/tasn_dec.c b/src/lib/libssl/src/crypto/asn1/tasn_dec.c
index 76fc023230..2426cb6253 100644
--- a/src/lib/libssl/src/crypto/asn1/tasn_dec.c
+++ b/src/lib/libssl/src/crypto/asn1/tasn_dec.c
@@ -691,6 +691,7 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, unsigned char **in, long inl
 
 int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it)
 {
+        ASN1_VALUE **opval = NULL;
         ASN1_STRING *stmp;
         ASN1_TYPE *typ = NULL;
         int ret = 0;
@@ -705,6 +706,7 @@ int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char
                         *pval = (ASN1_VALUE *)typ;
                 } else typ = (ASN1_TYPE *)*pval;
                 if(utype != typ->type) ASN1_TYPE_set(typ, utype, NULL);
+                opval = pval;
                 pval = (ASN1_VALUE **)&typ->value.ptr;
         }
         switch(utype) {
@@ -796,7 +798,12 @@ int asn1_ex_c2i(ASN1_VALUE **pval, unsigned char *cont, int len, int utype, char
 
         ret = 1;
         err:
-        if(!ret) ASN1_TYPE_free(typ);
+        if(!ret)
+                {
+                ASN1_TYPE_free(typ);
+                if (opval)
+                        *opval = NULL;
+                }
         return ret;
 }
 
diff --git a/src/lib/libssl/src/crypto/x509/x509_vfy.c b/src/lib/libssl/src/crypto/x509/x509_vfy.c
index 552d1e7251..04997ba456 100644
--- a/src/lib/libssl/src/crypto/x509/x509_vfy.c
+++ b/src/lib/libssl/src/crypto/x509/x509_vfy.c
@@ -674,7 +674,7 @@ static int internal_verify(X509_STORE_CTX *ctx)
                                 ok=(*cb)(0,ctx);
                                 if (!ok) goto end;
                                 }
-                        if (X509_verify(xs,pkey) <= 0)
+                        else if (X509_verify(xs,pkey) <= 0)
                                 /* XXX  For the final trusted self-signed cert,
                                  * this is a waste of time.  That check should
                                  * optional so that e.g. 'openssl x509' can be