From 2e492d0d1b25a1da998231b1fe3bfbada0df7d65 Mon Sep 17 00:00:00 2001 From: Timo Sirainen Date: Thu, 3 Dec 2015 12:13:11 +0200 Subject: [PATCH] lib-ssl-iostream: Check for SSL_CTX_set_ecdh_auto() failure. This shouldn't happen though. --- src/lib-ssl-iostream/iostream-openssl-context.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/lib-ssl-iostream/iostream-openssl-context.c b/src/lib-ssl-iostream/iostream-openssl-context.c index 96b6e7b916..ec5917676b 100644 --- a/src/lib-ssl-iostream/iostream-openssl-context.c +++ b/src/lib-ssl-iostream/iostream-openssl-context.c @@ -465,7 +465,7 @@ ssl_proxy_ctx_get_pkey_ec_curve_name(const struct ssl_iostream_settings *set, static int ssl_proxy_ctx_set_crypto_params(SSL_CTX *ssl_ctx, const struct ssl_iostream_settings *set ATTR_UNUSED, - const char **error_r ATTR_UNUSED) + const char **error_r) { #if defined(HAVE_ECDH) && !defined(SSL_CTRL_SET_ECDH_AUTO) EC_KEY *ecdh; @@ -483,7 +483,12 @@ ssl_proxy_ctx_set_crypto_params(SSL_CTX *ssl_ctx, #ifdef SSL_CTRL_SET_ECDH_AUTO /* OpenSSL >= 1.0.2 automatically handles ECDH temporary key parameter selection. */ - SSL_CTX_set_ecdh_auto(ssl_ctx, 1); + if (!SSL_CTX_set_ecdh_auto(ssl_ctx, 1)) { + /* shouldn't happen */ + *error_r = t_strdup_printf("SSL_CTX_set_ecdh_auto() failed: %s", + openssl_iostream_error()); + return -1; + } #else /* For OpenSSL < 1.0.2, ECDH temporary key parameter selection must be performed manually. Attempt to select the same curve as that used -- 2.47.3