Apply a change by Toomas Kiisk <vix@cyber.ee>:

* Fix a crashbug and a logic bug in hwcrhk_load_pubkey()

crypto/engine/hw_ncipher.c

diff --git a/crypto/engine/hw_ncipher.c b/crypto/engine/hw_ncipher.c
index 39cf7f5..e3ce534 100644
--- a/crypto/engine/hw_ncipher.c
+++ b/crypto/engine/hw_ncipher.c
@@ -533,7 +533,7 @@
 	HWCryptoHook_ErrMsgBuf rmsg;
 
 	rmsg.buf = tempbuf;
-	rmsg.size = 1024;
+	rmsg.size = sizeof(tempbuf);
 
         *hac = p_hwcrhk_Init(&hwcrhk_globals, sizeof(hwcrhk_globals), &rmsg,
 		cac);
@@ -802,10 +802,16 @@
 	HWCryptoHook_RSAKeyHandle *hptr;
 #endif
 #if !defined(OPENSSL_NO_RSA)
+	char tempbuf[1024];
 	HWCryptoHook_ErrMsgBuf rmsg;
 #endif
 	HWCryptoHook_PassphraseContext ppctx;
 
+#if !defined(OPENSSL_NO_RSA)
+	rmsg.buf = tempbuf;
+	rmsg.size = sizeof(tempbuf);
+#endif
+
 	if(!hwcrhk_context)
 		{
 		HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PRIVKEY,
@@ -912,9 +918,12 @@
 			res->pkey.rsa = RSA_new();
 			res->pkey.rsa->n = rsa->n;
 			res->pkey.rsa->e = rsa->e;
+			rsa->n = NULL;
+			rsa->e = NULL;
 			CRYPTO_w_unlock(CRYPTO_LOCK_EVP_PKEY);
 			RSA_free(rsa);
 			}
+			break;
 #endif
 		default:
 			HWCRHKerr(HWCRHK_F_HWCRHK_LOAD_PUBKEY,
@@ -943,7 +952,7 @@
  
 	to_return = 0; /* expect failure */
 	rmsg.buf = tempbuf;
-	rmsg.size = 1024;
+	rmsg.size = sizeof(tempbuf);
 
 	if(!hwcrhk_context)
 		{
@@ -994,6 +1003,9 @@
 	HWCryptoHook_RSAKeyHandle *hptr;
 	int to_return = 0, ret;
 
+	rmsg.buf = tempbuf;
+	rmsg.size = sizeof(tempbuf);
+
 	if(!hwcrhk_context)
 		{
 		HWCRHKerr(HWCRHK_F_HWCRHK_MOD_EXP,HWCRHK_R_NOT_INITIALISED);
@@ -1015,9 +1027,6 @@
 			goto err;
 			}
 
-		rmsg.buf = tempbuf;
-		rmsg.size = 1024;
-
 		/* Prepare the params */
 		bn_expand2(r, rsa->n->top); /* Check for error !! */
 		BN2MPI(m_a, I);
@@ -1060,9 +1069,6 @@
 			goto err;
 			}
 
-		rmsg.buf = tempbuf;
-		rmsg.size = 1024;
-
 		/* Prepare the params */
 		bn_expand2(r, rsa->n->top); /* Check for error !! */
 		BN2MPI(m_a, I);
@@ -1131,7 +1137,7 @@
 	int ret;
 
 	rmsg.buf = tempbuf;
-	rmsg.size = 1024;
+	rmsg.size = sizeof(tempbuf);
 
 	if(!hwcrhk_context)
 		{
@@ -1183,7 +1189,7 @@
 #endif
 
 	rmsg.buf = tempbuf;
-	rmsg.size = 1024;
+	rmsg.size = sizeof(tempbuf);
 
 #ifndef OPENSSL_NO_RSA
 	hptr = (HWCryptoHook_RSAKeyHandle *) item;