Fix small correctness issues from pen-test

Author: prasden

crypto/bio/bio.c

@@ -305,6 +305,9 @@ int BIO_write(BIO *bio, const void *in, int inl) {
 }
 
 int BIO_write_ex(BIO *bio, const void *data, size_t data_len, size_t *written_bytes) {
+  if (written_bytes != NULL) {
+    *written_bytes = 0;
+  }
   if (bio == NULL) {
     OPENSSL_PUT_ERROR(BIO, BIO_R_NULL_PARAMETER);
     return 0;

crypto/conf/conf.c

@@ -484,6 +484,11 @@ int NCONF_load_bio(CONF *conf, BIO *in, long *out_error_line) {
     // we now have a line with trailing \r\n removed
 
     // i is the number of bytes
+    // Ensure addition doesn't overflow and corrupt the signed buffer position
+    if (i > INT_MAX - bufnum) {
+      OPENSSL_PUT_ERROR(CONF, ERR_R_OVERFLOW);
+      goto err;
+    }
     bufnum += i;
 
     v = NULL;

crypto/fipsmodule/bn/bytes.c

@@ -91,6 +91,7 @@ BIGNUM *BN_le2bn(const uint8_t *in, size_t len, BIGNUM *ret) {
     return NULL;
   }
   ret->width = (int)num_words;
+  ret->neg = 0;
 
   bn_little_endian_to_words(ret->d, ret->width, in, len);
 

crypto/pem/pem_lib.c

@@ -483,7 +483,8 @@ int PEM_write(FILE *fp, const char *name, const char *header,
 
 int PEM_write_bio(BIO *bp, const char *name, const char *header,
                   const unsigned char *data, long len) {
-  int nlen, n, i, j, outl;
+  int nlen, n, i, outl;
+  long j;
   unsigned char *buf = NULL;
   EVP_ENCODE_CTX ctx;
   int reason = ERR_R_BUF_LIB;

crypto/x509/x_crl.c

@@ -138,6 +138,8 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
           X509_CRL_get_ext_d2i(crl, NID_issuing_distribution_point, &i, NULL);
       if (crl->idp != NULL) {
         if (!setup_idp(crl, crl->idp)) {
+          ISSUING_DIST_POINT_free(crl->idp);
+          crl->idp = NULL;
           return 0;
         }
       } else if (i != -1) {
@@ -147,6 +149,8 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
       crl->akid =
           X509_CRL_get_ext_d2i(crl, NID_authority_key_identifier, &i, NULL);
       if (crl->akid == NULL && i != -1) {
+        ISSUING_DIST_POINT_free(crl->idp);
+        crl->idp = NULL;
         return 0;
       }
 
@@ -169,6 +173,10 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
       }
 
       if (!crl_parse_entry_extensions(crl)) {
+        AUTHORITY_KEYID_free(crl->akid);
+        crl->akid = NULL;
+        ISSUING_DIST_POINT_free(crl->idp);
+        crl->idp = NULL;
         return 0;
       }