upstream commit

fix double-free() in error path of DSA key generation
 reported by Mateusz Kocielski; ok markus@

Upstream-ID: 4735d8f888b10599a935fa1b374787089116713c

diff --git a/sshkey.c b/sshkey.c
index dbb16e2fd1b01d0ddb8ac170553481a6474d85ab..32dd8f2254a2b347990e5fef872d2ddf0ffb402f 100644 (file)
--- a/sshkey.c
+++ b/sshkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshkey.c,v 1.20 2015/07/03 03:43:18 djm Exp $ */
+/* $OpenBSD: sshkey.c,v 1.21 2015/08/19 23:19:01 djm Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Alexander von Gernler.  All rights reserved.
@@ -1556,7 +1556,6 @@ dsa_generate_private_key(u_int bits, DSA **dsap)
        *dsap = NULL;
        if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL,
            NULL, NULL) || !DSA_generate_key(private)) {
-               DSA_free(private);
                ret = SSH_ERR_LIBCRYPTO_ERROR;
                goto out;
        }