From: Sergey Kandaurov <pluknet@nginx.com>
Date: Wed, 4 Aug 2021 18:27:51 +0000 (+0300)
Subject: SSL: SSL_CTX_set_tmp_dh() error handling.
X-Git-Tag: release-1.20.2~11
X-Git-Url: http://www.kaiwu.me/postgresql/commit/?a=commitdiff_plain;h=c2db2f8f2d8a1fe40d8ff9b1c256aad7362d13bb;p=nginx.git

SSL: SSL_CTX_set_tmp_dh() error handling.

For example, it can fail due to weak DH parameters.
---

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 60cc35876..2a0d0054f 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -1376,7 +1376,13 @@ ngx_ssl_dhparam(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *file)
         return NGX_ERROR;
     }
 
-    SSL_CTX_set_tmp_dh(ssl->ctx, dh);
+    if (SSL_CTX_set_tmp_dh(ssl->ctx, dh) != 1) {
+        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+                      "SSL_CTX_set_tmp_dh(\"%s\") failed", file->data);
+        DH_free(dh);
+        BIO_free(bio);
+        return NGX_ERROR;
+    }
 
     DH_free(dh);
     BIO_free(bio);