From 372bc0c02e14a08643b1d5c606eb4e728a3366ac Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Mon, 30 Nov 2015 10:29:29 +1100
Subject: [PATCH] 4265.   [bug]           Address unchecked isc_mem_get calls.
 [RT #41187]

(cherry picked from commit 8e73941f33fad57111142a62d99717abc001912e)
---
 CHANGES                   | 2 ++
 lib/dns/openssldsa_link.c | 2 ++
 lib/dns/rdata.c           | 3 +++
 lib/dns/tkey.c            | 9 ++-------
 lib/isc/md5.c             | 2 ++
 5 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/CHANGES b/CHANGES
index 4408f3ab87..b0bca79eb3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4265.	[bug]		Address unchecked isc_mem_get calls. [RT #41187]
+
 4264.	[bug]		Check const of strchr/strrchr assignments match
 			argument's const status. [RT #41150]
 
diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c
index 6eab1122cc..81a09cf2f3 100644
--- a/lib/dns/openssldsa_link.c
+++ b/lib/dns/openssldsa_link.c
@@ -78,6 +78,8 @@ openssldsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 	UNUSED(key);
 
 	sha1ctx = isc_mem_get(dctx->mctx, sizeof(isc_sha1_t));
+	if (sha1ctx == NULL)
+		return (ISC_R_NOMEMORY);
 	isc_sha1_init(sha1ctx);
 	dctx->ctxdata.sha1ctx = sha1ctx;
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index b6d6625906..ebb9e8b519 100644
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -1783,6 +1783,9 @@ static isc_result_t
 mem_tobuffer(isc_buffer_t *target, void *base, unsigned int length) {
 	isc_region_t tr;
 
+	if (length == 0U)
+		return (ISC_R_SUCCESS);
+
 	isc_buffer_availableregion(target, &tr);
 	if (length > tr.length)
 		return (ISC_R_NOSPACE);
diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 0b5440a67d..0012bbff44 100644
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -987,7 +987,7 @@ dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name,
 	if (nonce != NULL)
 		isc_buffer_usedregion(nonce, &r);
 	else {
-		r.base = isc_mem_get(msg->mctx, 0);
+		r.base = NULL;
 		r.length = 0;
 	}
 	tkey.error = 0;
@@ -998,9 +998,6 @@ dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name,
 
 	RETERR(buildquery(msg, name, &tkey, ISC_FALSE));
 
-	if (nonce == NULL)
-		isc_mem_put(msg->mctx, r.base, 0);
-
 	RETERR(dns_message_gettemprdata(msg, &rdata));
 	RETERR(isc_buffer_allocate(msg->mctx, &dynbuf, 1024));
 	RETERR(dst_key_todns(key, dynbuf));
@@ -1231,12 +1228,10 @@ dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,
 	if (nonce != NULL)
 		isc_buffer_usedregion(nonce, &r2);
 	else {
-		r2.base = isc_mem_get(rmsg->mctx, 0);
+		r2.base = NULL;
 		r2.length = 0;
 	}
 	RETERR(compute_secret(shared, &r2, &r, &secret));
-	if (nonce == NULL)
-		isc_mem_put(rmsg->mctx, r2.base, 0);
 
 	isc_buffer_usedregion(&secret, &r);
 	result = dns_tsigkey_create(tkeyname, &rtkey.algorithm,
diff --git a/lib/isc/md5.c b/lib/isc/md5.c
index 579d61c20b..ef2c14a6e0 100644
--- a/lib/isc/md5.c
+++ b/lib/isc/md5.c
@@ -57,6 +57,8 @@ isc_md5_invalidate(isc_md5_t *ctx) {
 
 void
 isc_md5_update(isc_md5_t *ctx, const unsigned char *buf, unsigned int len) {
+	if (len == 0U)
+		return;
 	RUNTIME_CHECK(EVP_DigestUpdate(ctx,
 				       (const void *) buf,
 				       (size_t) len) == 1);