From 3b6943ea7f6cc543fd185d87c30f0b8a50a15a55 Mon Sep 17 00:00:00 2001
From: kenjiro <>
Date: Mon, 10 Aug 2026 20:27:51 +0000
Subject: Check HMAC() return value to avoid a later use of uninitialized data

CID 25423

ok tb@
---
 src/usr.bin/openssl/s_cb.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/usr.bin/openssl/s_cb.c b/src/usr.bin/openssl/s_cb.c
index fcb2cd3076..b7832ff7db 100644
--- a/src/usr.bin/openssl/s_cb.c
+++ b/src/usr.bin/openssl/s_cb.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_cb.c,v 1.22 2025/01/02 13:10:03 tb Exp $ */
+/* $OpenBSD: s_cb.c,v 1.23 2026/08/10 20:27:51 kenjiro Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -847,8 +847,12 @@ generate_cookie_callback(SSL * ssl, unsigned char *cookie,
 	}
 
 	/* Calculate HMAC of buffer using the secret */
-	HMAC(EVP_sha1(), cookie_secret, COOKIE_SECRET_LENGTH,
-	    buffer, length, result, &resultlength);
+	if (HMAC(EVP_sha1(), cookie_secret, COOKIE_SECRET_LENGTH,
+	    buffer, length, result, &resultlength) == NULL) {
+		free(buffer);
+		return 0;
+	}
+
 	free(buffer);
 
 	memcpy(cookie, result, resultlength);
-- 
cgit v1.2.3-55-g6feb