From: Matt Caswell <matt@openssl.org>
Date: Mon, 22 Aug 2016 22:39:28 +0000 (+0100)
Subject: Check for error return from ASN1_object_size
X-Git-Tag: OpenSSL_1_1_0~72
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b197257d71694fd52ab61d173f77c8a120d3eead;p=openssl

Check for error return from ASN1_object_size

Otherwise we try to malloc a -1 size.

Reviewed-by: Tim Hudson <tjh@openssl.org>
---

diff --git a/crypto/ocsp/ocsp_ext.c b/crypto/ocsp/ocsp_ext.c
index 151cafaca4..e60a8d3677 100644
--- a/crypto/ocsp/ocsp_ext.c
+++ b/crypto/ocsp/ocsp_ext.c
@@ -256,6 +256,9 @@ static int ocsp_add1_nonce(STACK_OF(X509_EXTENSION) **exts,
      * relies on library internals.
      */
     os.length = ASN1_object_size(0, len, V_ASN1_OCTET_STRING);
+    if (os.length < 0)
+        goto err;
+
     os.data = OPENSSL_malloc(os.length);
     if (os.data == NULL)
         goto err;