From: Matt Caswell <matt@openssl.org>
Date: Thu, 26 May 2016 14:45:14 +0000 (+0100)
Subject: The ssl3_digest_cached_records() function does not handle errors properly
X-Git-Tag: OpenSSL_1_0_2i~171
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ada5de7ca1deae28713303319694806214dfa7d9;p=openssl

The ssl3_digest_cached_records() function does not handle errors properly

The ssl3_digest_cached_records() function was failing to handle errors
that might be returned from EVP_DigestSignInit() and
EVP_DigestSignUpdate().

RT#4180

Reviewed-by: Stephen Henson <steve@openssl.org>
---

diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index 47a0ec9fe0..b9fc0c7049 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -624,8 +624,12 @@ int ssl3_digest_cached_records(SSL *s)
                                      EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
             }
 #endif
-            EVP_DigestInit_ex(s->s3->handshake_dgst[i], md, NULL);
-            EVP_DigestUpdate(s->s3->handshake_dgst[i], hdata, hdatalen);
+            if (!EVP_DigestInit_ex(s->s3->handshake_dgst[i], md, NULL)
+                || !EVP_DigestUpdate(s->s3->handshake_dgst[i], hdata,
+                                     hdatalen)) {
+                SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, ERR_R_INTERNAL_ERROR);
+                return 0;
+            }
         } else {
             s->s3->handshake_dgst[i] = NULL;
         }