Add lots of checks for memory allocation failure, error codes to indicate

failure and freeing up memory if a failure occurs.

PR:620

3 files changed, 26 insertions, 9 deletions

diff --git a/crypto/pkcs12/p12_init.c b/crypto/pkcs12/p12_init.c
index eb837a78cf..5276b12669 100644
--- a/crypto/pkcs12/p12_init.c
+++ b/crypto/pkcs12/p12_init.c
@@ -76,15 +76,17 @@ PKCS12 *PKCS12_init (int mode)
 			if (!(pkcs12->authsafes->d.data =
 				 M_ASN1_OCTET_STRING_new())) {
 			PKCS12err(PKCS12_F_PKCS12_INIT,ERR_R_MALLOC_FAILURE);
-			return NULL;
+			goto err;
 		}
 		break;
 		default:
-			PKCS12err(PKCS12_F_PKCS12_INIT,PKCS12_R_UNSUPPORTED_PKCS12_MODE);
-			PKCS12_free(pkcs12);
-			return NULL;
-		break;
+			PKCS12err(PKCS12_F_PKCS12_INIT,
+				PKCS12_R_UNSUPPORTED_PKCS12_MODE);
+			goto err;
 	}
 		
 	return pkcs12;
+err:
+	if (pkcs12 != NULL) PKCS12_free(pkcs12);
+	return NULL;
 }
diff --git a/crypto/pkcs12/p12_kiss.c b/crypto/pkcs12/p12_kiss.c
index 885087ad00..2b31999e11 100644
--- a/crypto/pkcs12/p12_kiss.c
+++ b/crypto/pkcs12/p12_kiss.c
@@ -249,14 +249,26 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
 		if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate )
 								 return 1;
 		if (!(x509 = PKCS12_certbag2x509(bag))) return 0;
-		if(ckid) X509_keyid_set1(x509, ckid->data, ckid->length);
+		if(ckid)
+			{
+			if (!X509_keyid_set1(x509, ckid->data, ckid->length))
+				{
+				X509_free(x509);
+				return 0;
+				}
+			}
 		if(fname) {
-			int len;
+			int len, r;
 			unsigned char *data;
 			len = ASN1_STRING_to_UTF8(&data, fname);
 			if(len > 0) {
-				X509_alias_set1(x509, data, len);
+				r = X509_alias_set1(x509, data, len);
 				OPENSSL_free(data);
+				if (!r)
+					{
+					X509_free(x509);
+					return 0;
+					}
 			}
 		}
 
diff --git a/crypto/pkcs12/p12_mutl.c b/crypto/pkcs12/p12_mutl.c
index 0fb67f74b8..4886b9b289 100644
--- a/crypto/pkcs12/p12_mutl.c
+++ b/crypto/pkcs12/p12_mutl.c
@@ -148,7 +148,10 @@ int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
 			PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);
 			return 0;
 		}
-		ASN1_INTEGER_set(p12->mac->iter, iter);
+		if (!ASN1_INTEGER_set(p12->mac->iter, iter)) {
+			PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);
+			return 0;
+		}
 	}
 	if (!saltlen) saltlen = PKCS12_SALT_LEN;
 	p12->mac->salt->length = saltlen;