Merge pull request #490 from h2o/kazuho/evp_keyex_init-on-error
[evp_keyex_init] keep refcount unchanged when the function fails
diff --git a/lib/openssl.c b/lib/openssl.c
index 294fb60..a6abafe 100644
--- a/lib/openssl.c
+++ b/lib/openssl.c
@@ -608,6 +608,9 @@
return ret;
}
+/**
+ * Upon success, ownership of `pkey` is transferred to the object being created. Otherwise, the refcount remains unchanged.
+ */
static int evp_keyex_init(ptls_key_exchange_algorithm_t *algo, ptls_key_exchange_context_t **_ctx, EVP_PKEY *pkey)
{
struct st_evp_keyex_context_t *ctx = NULL;
@@ -630,8 +633,10 @@
*_ctx = &ctx->super;
ret = 0;
Exit:
- if (ret != 0 && ctx != NULL)
+ if (ret != 0 && ctx != NULL) {
+ ctx->privkey = NULL; /* do not decrement refcount of pkey in case of error */
evp_keyex_free(ctx);
+ }
return ret;
}
