commit 5bd8a09f2a262c77c1816e6fa6c524961ea6a994
author David Benjamin <davidben@google.com> Mon Feb 06 17:54:20 2017 -0500
committer Adam Langley <agl@google.com> Tue Feb 07 00:45:22 2017 +0000
tree 16766c1969603e9d4cd073a99165f81f3b5a4a65
parent 023d419eaed2933222597bca54234aa7d7056eb8

Fix a crash with malformed user notice policy numbers

(Imported from upstream's efe8398649a1d7fc9d84d2818592652e0632a8a8.)

Change-Id: I0d04b3e75ec26a7dd3a7af31b0e115723c4b24d9
Reviewed-on: https://boringssl-review.googlesource.com/13661
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>

crypto/x509v3/v3_cpols.c

diff --git a/crypto/x509v3/v3_cpols.c b/crypto/x509v3/v3_cpols.c
index d67dcb0..7de5496 100644
--- a/crypto/x509v3/v3_cpols.c
+++ b/crypto/x509v3/v3_cpols.c
@@ -400,10 +400,10 @@
     return 1;
 
  merr:
+    ASN1_INTEGER_free(aint);
     OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
 
  err:
-    sk_ASN1_INTEGER_pop_free(nnums, ASN1_STRING_free);
     return 0;
 }