Make sure bs is assigned NULL when it's free'd, or there will be an

(incorrect) attempt to free it once more...

diff --git a/crypto/asn1/d2i_dsap.c b/crypto/asn1/d2i_dsap.c
index d97330791c2adfef1863c9179fb14b7e0e7988a6..1b6b7cd5bf447da10a767f54caf1465016391abd 100644 (file)
--- a/crypto/asn1/d2i_dsap.c
+++ b/crypto/asn1/d2i_dsap.c
@@ -84,6 +84,7 @@ DSA *d2i_DSAparams(DSA **a, const unsigned char **pp, long length)
        if ((ret->g=BN_bin2bn(bs->data,bs->length,ret->g)) == NULL) goto err_bn;
 
        M_ASN1_BIT_STRING_free(bs);
+       bs = NULL;
 
        M_ASN1_D2I_Finish_2(a);
 

diff --git a/crypto/asn1/d2i_r_pr.c b/crypto/asn1/d2i_r_pr.c
index 3d2dd656375ea0f50403fe4f1733ebda5b2d6cf7..46037a04e639b2c950735620137396f1152fa348 100644 (file)
--- a/crypto/asn1/d2i_r_pr.c
+++ b/crypto/asn1/d2i_r_pr.c
@@ -108,6 +108,7 @@ RSA *d2i_RSAPrivateKey(RSA **a, const unsigned char **pp, long length)
                goto err_bn;
 
        M_ASN1_INTEGER_free(bs);
+       bs = NULL;
 
        M_ASN1_D2I_Finish_2(a);
 err_bn:

diff --git a/crypto/dsa/dsa_asn1.c b/crypto/dsa/dsa_asn1.c
index 81c9c863b47c44aaebd7f72a41686994a4479f18..134fbeebf8ca984bead3d7e1cfeb054c77075abd 100644 (file)
--- a/crypto/dsa/dsa_asn1.c
+++ b/crypto/dsa/dsa_asn1.c
@@ -84,6 +84,7 @@ DSA_SIG *d2i_DSA_SIG(DSA_SIG **a, const unsigned char **pp, long length)
        if ((ret->s=BN_bin2bn(bs->data,bs->length,ret->s)) == NULL)
                goto err_bn;
        M_ASN1_BIT_STRING_free(bs);
+       bs = NULL;
        M_ASN1_D2I_Finish_2(a);
 
 err_bn: