Openssl: NULL deref in dgst_main on alloc failure

Created on 27 Jun 2020  路  1Comment  路  Source: openssl/openssl

When the allocation in https://github.com/openssl/openssl/blob/270540fd5413b00a746a581e8939c30862c689b1/apps/dgst.c#L115 fails, there is a NULL deref in both https://github.com/openssl/openssl/blob/270540fd5413b00a746a581e8939c30862c689b1/apps/dgst.c#L405 and https://github.com/openssl/openssl/blob/270540fd5413b00a746a581e8939c30862c689b1/apps/dgst.c#L426 depending on number of command line arguments.

The source is both missing a NULL check here, but also could be improved by doing this allocation much closer to where it actually is used (only those two places near the end).

bug report

Most helpful comment

app_malloc is a wrapper around malloc that exits on failure.

>All comments

app_malloc is a wrapper around malloc that exits on failure.

Was this page helpful?
0 / 5 - 0 ratings

Related issues

enriquejcobo picture enriquejcobo  路  3Comments

Legends picture Legends  路  3Comments

alexh-sauce picture alexh-sauce  路  3Comments

kirin10000 picture kirin10000  路  3Comments

shrimpwagon picture shrimpwagon  路  3Comments