commit 79680ffaed9df169d73086bc8a9ce2d81483d428
author David Benjamin <davidben@chromium.org> Fri Oct 23 18:46:16 2015 -0400
committer Adam Langley <alangley@gmail.com> Mon Oct 26 19:41:01 2015 +0000
tree 50d15b18cf2ac5b53de9c2dd9e0b4a11dcde75f5
parent 68b4e8933e4083743ff8c98bff72db30f17ba927

Fix various malloc failure codepaths.

CRYPTO_MUTEX_init needs a CRYPTO_MUTEX_cleanup. Also a pile of problems
with x509_lu.c I noticed trying to import some upstream change.

Change-Id: I029a65cd2d30aa31f4832e8fbfe5b2ea0dbc66fe
Reviewed-on: https://boringssl-review.googlesource.com/6346
Reviewed-by: Adam Langley <alangley@gmail.com>

crypto/dh/dh.c

diff --git a/crypto/dh/dh.c b/crypto/dh/dh.c
index d25f358..87a640d 100644
--- a/crypto/dh/dh.c
+++ b/crypto/dh/dh.c
@@ -97,12 +97,14 @@
 
   dh->references = 1;
   if (!CRYPTO_new_ex_data(&g_ex_data_class, dh, &dh->ex_data)) {
+    CRYPTO_MUTEX_cleanup(&dh->method_mont_p_lock);
     OPENSSL_free(dh);
     return NULL;
   }
 
   if (dh->meth->init && !dh->meth->init(dh)) {
     CRYPTO_free_ex_data(&g_ex_data_class, dh, &dh->ex_data);
+    CRYPTO_MUTEX_cleanup(&dh->method_mont_p_lock);
     METHOD_unref(dh->meth);
     OPENSSL_free(dh);
     return NULL;

crypto/dsa/dsa.c

diff --git a/crypto/dsa/dsa.c b/crypto/dsa/dsa.c
index 3ff29c4..eb8e61f 100644
--- a/crypto/dsa/dsa.c
+++ b/crypto/dsa/dsa.c
@@ -103,6 +103,7 @@
   CRYPTO_MUTEX_init(&dsa->method_mont_p_lock);
 
   if (!CRYPTO_new_ex_data(&g_ex_data_class, dsa, &dsa->ex_data)) {
+    CRYPTO_MUTEX_cleanup(&dsa->method_mont_p_lock);
     METHOD_unref(dsa->meth);
     OPENSSL_free(dsa);
     return NULL;
@@ -110,6 +111,7 @@
 
   if (dsa->meth->init && !dsa->meth->init(dsa)) {
     CRYPTO_free_ex_data(&g_ex_data_class, dsa, &dsa->ex_data);
+    CRYPTO_MUTEX_cleanup(&dsa->method_mont_p_lock);
     METHOD_unref(dsa->meth);
     OPENSSL_free(dsa);
     return NULL;

crypto/rsa/rsa.c

diff --git a/crypto/rsa/rsa.c b/crypto/rsa/rsa.c
index 2a0b4ce..3ea4bff 100644
--- a/crypto/rsa/rsa.c
+++ b/crypto/rsa/rsa.c
@@ -100,6 +100,7 @@
   CRYPTO_MUTEX_init(&rsa->lock);
 
   if (!CRYPTO_new_ex_data(&g_ex_data_class, rsa, &rsa->ex_data)) {
+    CRYPTO_MUTEX_cleanup(&rsa->lock);
     METHOD_unref(rsa->meth);
     OPENSSL_free(rsa);
     return NULL;
@@ -107,6 +108,7 @@
 
   if (rsa->meth->init && !rsa->meth->init(rsa)) {
     CRYPTO_free_ex_data(&g_ex_data_class, rsa, &rsa->ex_data);
+    CRYPTO_MUTEX_cleanup(&rsa->lock);
     METHOD_unref(rsa->meth);
     OPENSSL_free(rsa);
     return NULL;

crypto/x509/x509_lu.c

diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c
index 6d7bc26..1bdcddf 100644
--- a/crypto/x509/x509_lu.c
+++ b/crypto/x509/x509_lu.c
@@ -187,12 +187,16 @@
 	if ((ret=(X509_STORE *)OPENSSL_malloc(sizeof(X509_STORE))) == NULL)
 		return NULL;
 	memset(ret, 0, sizeof(*ret));
-	ret->objs = sk_X509_OBJECT_new(x509_object_cmp);
 	CRYPTO_MUTEX_init(&ret->objs_lock);
+	ret->objs = sk_X509_OBJECT_new(x509_object_cmp);
+	if (ret->objs == NULL)
+		goto err;
 	ret->cache = 1;
 	ret->get_cert_methods = sk_X509_LOOKUP_new_null();
-
-	if ((ret->param = X509_VERIFY_PARAM_new()) == NULL)
+	if (ret->get_cert_methods == NULL)
+		goto err;
+	ret->param = X509_VERIFY_PARAM_new();
+	if (ret->param == NULL)
 		goto err;
 
 	ret->references = 1;
@@ -200,6 +204,7 @@
 err:
 	if (ret)
 		{
+		CRYPTO_MUTEX_cleanup(&ret->objs_lock);
 		if (ret->param)
 			X509_VERIFY_PARAM_free(ret->param);
 		if (ret->get_cert_methods)
@@ -498,6 +503,8 @@
 	X509 *x;
 	X509_OBJECT *obj;
 	sk = sk_X509_new_null();
+	if (sk == NULL)
+		return NULL;
 	CRYPTO_MUTEX_lock_write(&ctx->ctx->objs_lock);
 	idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt);
 	if (idx < 0)
@@ -546,6 +553,8 @@
 	X509_CRL *x;
 	X509_OBJECT *obj, xobj;
 	sk = sk_X509_CRL_new_null();
+	if (sk == NULL)
+		return NULL;
 	CRYPTO_MUTEX_lock_write(&ctx->ctx->objs_lock);
 	/* Check cache first */
 	idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);