The ssl3_digest_cached_records() function does not handle errors properly

The ssl3_digest_cached_records() function was failing to handle errors
that might be returned from EVP_DigestSignInit() and
EVP_DigestSignUpdate().

RT#4180

Reviewed-by: Stephen Henson <steve@openssl.org>

1 files changed, 4 insertions, 5 deletions

diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index c1222a72c2..cb571c1d07 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -374,14 +374,13 @@ int ssl3_digest_cached_records(SSL *s, int keep)
         }
 
         md = ssl_handshake_md(s);
-        if (md == NULL) {
+        if (   md == NULL
+            || !EVP_DigestInit_ex(s->s3->handshake_dgst, md, NULL)
+            || !EVP_DigestUpdate(s->s3->handshake_dgst, hdata, hdatalen))
+        {
             SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_INTERNAL_ERROR);
             return 0;
         }
-
-        EVP_DigestInit_ex(s->s3->handshake_dgst, md, NULL);
-        EVP_DigestUpdate(s->s3->handshake_dgst, hdata, hdatalen);
-
     }
     if (keep == 0) {
         BIO_free(s->s3->handshake_buffer);