Commit a223bae5cf7629fb77b2af0b0df9d02c634520c0
2018-01-03T14:57:25
Merge pull request #4437 from pks-t/pks/openssl-hash-errors hash: openssl: check return values of SHA1_* functions
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90
diff --git a/src/hash/hash_openssl.h b/src/hash/hash_openssl.h
index 9a55d47..048c2bd 100644
--- a/src/hash/hash_openssl.h
+++ b/src/hash/hash_openssl.h
@@ -23,21 +23,36 @@ struct git_hash_ctx {
GIT_INLINE(int) git_hash_init(git_hash_ctx *ctx)
{
assert(ctx);
- SHA1_Init(&ctx->c);
+
+ if (SHA1_Init(&ctx->c) != 1) {
+ giterr_set(GITERR_SHA1, "hash_openssl: failed to initialize hash context");
+ return -1;
+ }
+
return 0;
}
GIT_INLINE(int) git_hash_update(git_hash_ctx *ctx, const void *data, size_t len)
{
assert(ctx);
- SHA1_Update(&ctx->c, data, len);
+
+ if (SHA1_Update(&ctx->c, data, len) != 1) {
+ giterr_set(GITERR_SHA1, "hash_openssl: failed to update hash");
+ return -1;
+ }
+
return 0;
}
GIT_INLINE(int) git_hash_final(git_oid *out, git_hash_ctx *ctx)
{
assert(ctx);
- SHA1_Final(out->id, &ctx->c);
+
+ if (SHA1_Final(out->id, &ctx->c) != 1) {
+ giterr_set(GITERR_SHA1, "hash_openssl: failed to finalize hash");
+ return -1;
+ }
+
return 0;
}
diff --git a/src/streams/openssl.c b/src/streams/openssl.c
index 9d56607..d00e98e 100644
--- a/src/streams/openssl.c
+++ b/src/streams/openssl.c
@@ -282,8 +282,9 @@ static int ssl_set_error(SSL *ssl, int error)
case SSL_ERROR_SYSCALL:
e = ERR_get_error();
if (e > 0) {
- giterr_set(GITERR_NET, "SSL error: %s",
- ERR_error_string(e, NULL));
+ char errmsg[256];
+ ERR_error_string_n(e, errmsg, sizeof(errmsg));
+ giterr_set(GITERR_NET, "SSL error: %s", errmsg);
break;
} else if (error < 0) {
giterr_set(GITERR_OS, "SSL error: syscall failure");
@@ -293,10 +294,13 @@ static int ssl_set_error(SSL *ssl, int error)
return GIT_EEOF;
break;
case SSL_ERROR_SSL:
+ {
+ char errmsg[256];
e = ERR_get_error();
- giterr_set(GITERR_NET, "SSL error: %s",
- ERR_error_string(e, NULL));
+ ERR_error_string_n(e, errmsg, sizeof(errmsg));
+ giterr_set(GITERR_NET, "SSL error: %s", errmsg);
break;
+ }
case SSL_ERROR_NONE:
case SSL_ERROR_ZERO_RETURN:
default:
@@ -645,8 +649,12 @@ out_err:
int git_openssl__set_cert_location(const char *file, const char *path)
{
if (SSL_CTX_load_verify_locations(git__ssl_ctx, file, path) == 0) {
+ char errmsg[256];
+
+ ERR_error_string_n(ERR_get_error(), errmsg, sizeof(errmsg));
giterr_set(GITERR_SSL, "OpenSSL error: failed to load certificates: %s",
- ERR_error_string(ERR_get_error(), NULL));
+ errmsg);
+
return -1;
}
return 0;