Fixed a null pointer dereference introduced during the usage metrics

[gssapi-openssh.git] / openssh / bufbn.c

diff --git a/openssh/bufbn.c b/openssh/bufbn.c
index 251cd09518c602916962b019bb0dad1496c950b5..6cf65d372ef60ea8616b89bcad7a701e559083fd 100644 (file)
--- a/openssh/bufbn.c
+++ b/openssh/bufbn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufbn.c,v 1.6 2007/06/02 09:04:58 djm Exp $*/
+/* $OpenBSD: bufbn.c,v 1.3 2006/08/03 03:34:41 deraadt Exp $*/
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -93,7 +93,7 @@ buffer_put_bignum(Buffer *buffer, const BIGNUM *value)
 }
 
 /*
- * Retrieves a BIGNUM from the buffer.
+ * Retrieves an BIGNUM from the buffer.
  */
 int
 buffer_get_bignum_ret(Buffer *buffer, BIGNUM *value)
@@ -101,7 +101,7 @@ buffer_get_bignum_ret(Buffer *buffer, BIGNUM *value)
        u_int bits, bytes;
        u_char buf[2], *bin;
 
-       /* Get the number of bits. */
+       /* Get the number for bits. */
        if (buffer_get_ret(buffer, (char *) buf, 2) == -1) {
                error("buffer_get_bignum_ret: invalid length");
                return (-1);
@@ -118,10 +118,7 @@ buffer_get_bignum_ret(Buffer *buffer, BIGNUM *value)
                return (-1);
        }
        bin = buffer_ptr(buffer);
-       if (BN_bin2bn(bin, bytes, value) == NULL) {
-               error("buffer_get_bignum_ret: BN_bin2bn failed");
-               return (-1);
-       }
+       BN_bin2bn(bin, bytes, value);
        if (buffer_consume_ret(buffer, bytes) == -1) {
                error("buffer_get_bignum_ret: buffer_consume failed");
                return (-1);
@@ -137,7 +134,7 @@ buffer_get_bignum(Buffer *buffer, BIGNUM *value)
 }
 
 /*
- * Stores a BIGNUM in the buffer in SSH2 format.
+ * Stores an BIGNUM in the buffer in SSH2 format.
  */
 int
 buffer_put_bignum2_ret(Buffer *buffer, const BIGNUM *value)
@@ -201,16 +198,11 @@ buffer_get_bignum2_ret(Buffer *buffer, BIGNUM *value)
                return (-1);
        }
        if (len > 8 * 1024) {
-               error("buffer_get_bignum2_ret: cannot handle BN of size %d",
-                   len);
-               xfree(bin);
-               return (-1);
-       }
-       if (BN_bin2bn(bin, len, value) == NULL) {
-               error("buffer_get_bignum2_ret: BN_bin2bn failed");
+               error("buffer_get_bignum2_ret: cannot handle BN of size %d", len);
                xfree(bin);
                return (-1);
        }
+       BN_bin2bn(bin, len, value);
        xfree(bin);
        return (0);
 }