commit 1b878e7cc69f60407457024a212750c52bcc9ae5
author David Benjamin <davidben@google.com> Sat Mar 30 11:05:37 2019 -0500
committer Adam Langley <agl@google.com> Mon Apr 29 16:14:52 2019 +0000
tree 8595f332a7c1d14b37af7cc19f78f3011887aa9e
parent 1e77ef4189ec7d4e64b60e844bc80102bd3e9ddd

Check for errors when setting up X509_STORE_CTX.

Change-Id: Icf308d33374bf3d6505058eb4e82767f4b4b8a6b
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/35787
Reviewed-by: Adam Langley <agl@google.com>

ssl/ssl_x509.cc

diff --git a/ssl/ssl_x509.cc b/ssl/ssl_x509.cc
index f76118c..cda7611 100644
--- a/ssl/ssl_x509.cc
+++ b/ssl/ssl_x509.cc
@@ -376,24 +376,20 @@
 
   X509 *leaf = sk_X509_value(cert_chain, 0);
   ScopedX509_STORE_CTX ctx;
-  if (!X509_STORE_CTX_init(ctx.get(), verify_store, leaf, cert_chain)) {
+  if (!X509_STORE_CTX_init(ctx.get(), verify_store, leaf, cert_chain) ||
+      !X509_STORE_CTX_set_ex_data(
+          ctx.get(), SSL_get_ex_data_X509_STORE_CTX_idx(), hs->ssl) ||
+      // We need to inherit the verify parameters. These can be determined by
+      // the context: if its a server it will verify SSL client certificates or
+      // vice versa.
+      !X509_STORE_CTX_set_default(
+          ctx.get(), hs->ssl->server ? "ssl_client" : "ssl_server") ||
+      // Anything non-default in "param" should overwrite anything in the ctx.
+      !X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(ctx.get()),
+                              hs->config->param)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_X509_LIB);
     return false;
   }
-  if (!X509_STORE_CTX_set_ex_data(
-          ctx.get(), SSL_get_ex_data_X509_STORE_CTX_idx(), hs->ssl)) {
-    return false;
-  }
-
-  // We need to inherit the verify parameters. These can be determined by the
-  // context: if its a server it will verify SSL client certificates or vice
-  // versa.
-  X509_STORE_CTX_set_default(ctx.get(),
-                             hs->ssl->server ? "ssl_client" : "ssl_server");
-
-  // Anything non-default in "param" should overwrite anything in the ctx.
-  X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(ctx.get()),
-                         hs->config->param);
 
   if (hs->config->verify_callback) {
     X509_STORE_CTX_set_verify_cb(ctx.get(), hs->config->verify_callback);