From 16f790d01f7a6fc6c94e2a033a67b80c8ec5291c Mon Sep 17 00:00:00 2001
From: jsing <>
Date: Mon, 9 Feb 2015 15:49:22 +0000
Subject: BN_CTX_get() can fail - consistently check its return value.

There are currently cases where the return from each call is checked,
the return from only the last call is checked and cases where it is not
checked at all (including code in bn, ec and engine).

Checking the last return value is valid as once the function fails it will
continue to return NULL. However, in order to be consistent check each
call with the same idiom. This makes it easy to verify.

Note there are still a handful of cases that do not follow the idiom -
these will be handled separately.

ok beck@ doug@
---
 src/lib/libcrypto/engine/eng_rsax.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

(limited to 'src/lib/libcrypto/engine')

diff --git a/src/lib/libcrypto/engine/eng_rsax.c b/src/lib/libcrypto/engine/eng_rsax.c
index c33a776707..784b74a22f 100644
--- a/src/lib/libcrypto/engine/eng_rsax.c
+++ b/src/lib/libcrypto/engine/eng_rsax.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: eng_rsax.c,v 1.12 2014/11/19 13:35:37 krw Exp $ */
+/* $OpenBSD: eng_rsax.c,v 1.13 2015/02/09 15:49:22 jsing Exp $ */
 /* Copyright (c) 2010-2010 Intel Corp.
  *   Author: Vinodh.Gopal@intel.com
  *           Jim Guilford
@@ -519,9 +519,12 @@ e_rsax_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
 	int ret = 0;
 
 	BN_CTX_start(ctx);
-	r1 = BN_CTX_get(ctx);
-	m1 = BN_CTX_get(ctx);
-	vrfy = BN_CTX_get(ctx);
+	if ((r1 = BN_CTX_get(ctx)) == NULL)
+		goto err;
+	if ((m1 = BN_CTX_get(ctx)) == NULL)
+		goto err;
+	if ((vrfy = BN_CTX_get(ctx)) == NULL)
+		goto err;
 
 	{
 		BIGNUM local_p, local_q;
-- 
cgit v1.2.3-55-g6feb