From bbb76be9b55390683ad025e80d2872ac6f1216f5 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 12 Nov 2014 11:18:09 +0000 Subject: Fix free of garbage pointer. PR#3595 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reviewed-by: Emilia Käsper (cherry picked from commit e04d426bf98ebb22abf0f15b6f09d333a6e8b2ad) --- crypto/ec/ec_mult.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/crypto/ec/ec_mult.c b/crypto/ec/ec_mult.c index 19f21675fb..e81200b255 100644 --- a/crypto/ec/ec_mult.c +++ b/crypto/ec/ec_mult.c @@ -445,15 +445,16 @@ int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]); wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]); /* includes space for pivot */ val_sub = OPENSSL_malloc(totalnum * sizeof val_sub[0]); - + + /* Ensure wNAF is initialised in case we end up going to err */ + if (wNAF) wNAF[0] = NULL; /* preliminary pivot */ + if (!wsize || !wNAF_len || !wNAF || !val_sub) { ECerr(EC_F_EC_WNAF_MUL, ERR_R_MALLOC_FAILURE); goto err; } - wNAF[0] = NULL; /* preliminary pivot */ - /* num_val will be the total number of temporarily precomputed points */ num_val = 0; -- cgit v1.2.3