From: Ben Laurie <ben@openssl.org>
Date: Thu, 5 Apr 2007 16:28:48 +0000 (+0000)
Subject: Don't use a negative number as a length. Coverity ID 57.
X-Git-Tag: OpenSSL_0_9_8k^2~907
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=fa9fed1c3ad00878312a0c77053a83f915ef68ef;p=openssl

Don't use a negative number as a length. Coverity ID 57.
---

diff --git a/ssl/s2_clnt.c b/ssl/s2_clnt.c
index d9750d0935..6d8883fbbd 100644
--- a/ssl/s2_clnt.c
+++ b/ssl/s2_clnt.c
@@ -863,8 +863,10 @@ static int client_certificate(SSL *s)
 		EVP_SignUpdate(&ctx,s->s2->key_material,
 			       s->s2->key_material_length);
 		EVP_SignUpdate(&ctx,cert_ch,(unsigned int)cert_ch_len);
-		n=i2d_X509(s->session->sess_cert->peer_key->x509,&p);
-		EVP_SignUpdate(&ctx,buf,(unsigned int)n);
+		i=i2d_X509(s->session->sess_cert->peer_key->x509,&p);
+		/* Don't update the signature if it fails - FIXME: probably should handle this better */
+		if(i > 0)
+			EVP_SignUpdate(&ctx,buf,(unsigned int)i);
 
 		p=buf;
 		d=p+6;