Skip to content

Commit 33833fb

Browse files
ADieaigrr
authored andcommitted
Fix memleak in rsa.c (#35)
* fix memleak in rsa.c * don't alloc block from the start;check block;don't use goto * fix whitespaces
1 parent 993a29f commit 33833fb

File tree

1 file changed

+18
-8
lines changed

1 file changed

+18
-8
lines changed

crypto/rsa.c

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -145,13 +145,19 @@ int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data,
145145
uint8_t *out_data, int out_len, int is_decryption)
146146
{
147147
const int byte_size = ctx->num_octets;
148-
int i = 0, size;
148+
int i = 0, size = -1;
149149
bigint *decrypted_bi, *dat_bi;
150-
uint8_t *block = (uint8_t *)malloc(byte_size);
150+
uint8_t *block = NULL;
151151
int pad_count = 0;
152152

153+
do
154+
{
153155
if (out_len < byte_size) /* check output has enough size */
154-
return -1;
156+
break;
157+
158+
block = (uint8_t *)malloc(byte_size);
159+
if (!block)
160+
break;
155161

156162
memset(out_data, 0, out_len); /* initialise */
157163

@@ -168,13 +174,13 @@ int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data,
168174
bi_export(ctx->bi_ctx, decrypted_bi, block, byte_size);
169175

170176
if (block[i++] != 0) /* leading 0? */
171-
return -1;
177+
break;
172178

173179
#ifdef CONFIG_SSL_CERT_VERIFICATION
174180
if (is_decryption == 0) /* PKCS1.5 signing pads with "0xff"s */
175181
{
176182
if (block[i++] != 0x01) /* BT correct? */
177-
return -1;
183+
break;
178184

179185
while (block[i++] == 0xff && i < byte_size)
180186
pad_count++;
@@ -183,21 +189,25 @@ int RSA_decrypt(const RSA_CTX *ctx, const uint8_t *in_data,
183189
#endif
184190
{
185191
if (block[i++] != 0x02) /* BT correct? */
186-
return -1;
192+
break;
187193

188194
while (block[i++] && i < byte_size)
189195
pad_count++;
190196
}
191197

192198
/* check separator byte 0x00 - and padding must be 8 or more bytes */
193199
if (i == byte_size || pad_count < 8)
194-
return -1;
200+
break;
195201

196202
size = byte_size - i;
197203

198204
/* get only the bit we want */
199205
memcpy(out_data, &block[i], size);
200-
free(block);
206+
} while(false);
207+
208+
if(block)
209+
free(block);
210+
201211
return size;
202212
}
203213

0 commit comments

Comments
 (0)