The branch master has been updated
via 3bbd1d63e2d77e4e36e869640086f74714b3a4ee (commit)
from e113c9c59dcb419dd00525cec431edb854a6c897 (commit)
- Log -----------------------------------------------------------------
commit 3bbd1d63e2d77e4e36e869640086f74714b3a4ee
Author: Matt Caswell <[email protected]>
Date: Thu Nov 12 15:54:30 2015 +0000
Fix a NULL deref in an error path
The SRP_create_verifier_BN function goes to the |err| label if the |salt|
value passed to it is NULL. It is then deref'd.
Reviewed-by: Rich Salz <[email protected]>
-----------------------------------------------------------------------
Summary of changes:
crypto/srp/srp_vfy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/crypto/srp/srp_vfy.c b/crypto/srp/srp_vfy.c
index e81ae01..b271c99 100644
--- a/crypto/srp/srp_vfy.c
+++ b/crypto/srp/srp_vfy.c
@@ -644,7 +644,7 @@ int SRP_create_verifier_BN(const char *user, const char
*pass, BIGNUM **salt,
*salt = salttmp;
err:
- if (*salt != salttmp)
+ if (salt != NULL && *salt != salttmp)
BN_clear_free(salttmp);
BN_clear_free(x);
BN_CTX_free(bn_ctx);
_____
openssl-commits mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-commits
