From b8ae4a83de0de38fd382f3981e503f2ab5461c07 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Wed, 4 Nov 2020 11:31:55 +0000 Subject: [PATCH] Don't clear errors on failure in CONF_modules_load_file_ex() The call to CONF_modules_load() in CONF_modules_load_file_ex() can return a negative number to indicate failure. This was incorrectly being interpreted as "success" and therefore errors were being cleared incorrectly. Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/13311) --- crypto/conf/conf_mod.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/conf/conf_mod.c b/crypto/conf/conf_mod.c index bd945766b8..e7fb890378 100644 --- a/crypto/conf/conf_mod.c +++ b/crypto/conf/conf_mod.c @@ -187,10 +187,11 @@ int CONF_modules_load_file_ex(OSSL_LIB_CTX *libctx, const char *filename, if ((flags & CONF_MFLAGS_IGNORE_RETURN_CODES) != 0 && !diagnostics) ret = 1; - if (ret) + if (ret > 0) ERR_pop_to_mark(); else ERR_clear_last_mark(); + return ret; }