If the allocation for "original" fails, "result" may be freed without being
properly initialized. Since result could hold a random value due to its
assignment in do_bio_comp_test(), freeing it without initialization is unsafe
and may lead to undefined behavior.
Fixes: 12e96a2360 ("Add brotli compression support (RFC7924)")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27569)
int size = sizes[n % 4];
int type = n / 4;
- if (!TEST_ptr(original = OPENSSL_malloc(BUFFER_SIZE))
- || !TEST_ptr(result = OPENSSL_malloc(BUFFER_SIZE)))
+ original = OPENSSL_malloc(BUFFER_SIZE);
+ result = OPENSSL_malloc(BUFFER_SIZE);
+
+ if (!TEST_ptr(original) || !TEST_ptr(result))
goto err;
switch (type) {