From: Matt Caswell <matt@openssl.org>
Date: Wed, 4 Nov 2020 11:31:55 +0000 (+0000)
Subject: Don't clear errors on failure in CONF_modules_load_file_ex()
X-Git-Tag: openssl-3.0.0-alpha9~167
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b8ae4a83de0de38fd382f3981e503f2ab5461c07;p=thirdparty%2Fopenssl.git

Don't clear errors on failure in CONF_modules_load_file_ex()

The call to CONF_modules_load() in CONF_modules_load_file_ex() can
return a negative number to indicate failure. This was incorrectly
being interpreted as "success" and therefore errors were being cleared
incorrectly.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/13311)
---

diff --git a/crypto/conf/conf_mod.c b/crypto/conf/conf_mod.c
index bd945766b89..e7fb8903789 100644
--- a/crypto/conf/conf_mod.c
+++ b/crypto/conf/conf_mod.c
@@ -187,10 +187,11 @@ int CONF_modules_load_file_ex(OSSL_LIB_CTX *libctx, const char *filename,
     if ((flags & CONF_MFLAGS_IGNORE_RETURN_CODES) != 0 && !diagnostics)
         ret = 1;
 
-    if (ret)
+    if (ret > 0)
         ERR_pop_to_mark();
     else
         ERR_clear_last_mark();
+
     return ret;
 }