3 files changed, 10 insertions, 1 deletions
diff --git a/lib/libssl/src/ssl/s3_clnt.c b/lib/libssl/src/ssl/s3_clnt.c
index ffbd83b060b..602ab03fe1f 100644
--- a/lib/libssl/src/ssl/s3_clnt.c
+++ b/lib/libssl/src/ssl/s3_clnt.c
@@ -2458,6 +2458,11 @@ ssl3_send_client_key_exchange(SSL *s)
 			 * context data
 			 */
 			ukm_hash = EVP_MD_CTX_create();
+			if (ukm_hash == NULL) {
+				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+				    ERR_R_MALLOC_FAILURE);
+				goto err;
+			}
 			EVP_DigestInit(ukm_hash,
 			    EVP_get_digestbynid(NID_id_GostR3411_94));
 			EVP_DigestUpdate(ukm_hash,
diff --git a/lib/libssl/src/ssl/s3_enc.c b/lib/libssl/src/ssl/s3_enc.c
index c9284c395ff..aa729860feb 100644
--- a/lib/libssl/src/ssl/s3_enc.c
+++ b/lib/libssl/src/ssl/s3_enc.c
@@ -593,6 +593,10 @@ ssl3_digest_cached_records(SSL *s)
 	for (i = 0; ssl_get_handshake_digest(i, &mask, &md); i++) {
 		if ((mask & ssl_get_algorithm2(s)) && md) {
 			s->s3->handshake_dgst[i] = EVP_MD_CTX_create();
+			if (s->s3->handshake_dgst[i] == NULL) {
+				SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS,
+				    ERR_R_MALLOC_FAILURE);
+			}
 			EVP_DigestInit_ex(s->s3->handshake_dgst[i], md, NULL);
 			EVP_DigestUpdate(s->s3->handshake_dgst[i], hdata, hdatalen);
 		} else {
diff --git a/lib/libssl/src/ssl/ssl_lib.c b/lib/libssl/src/ssl/ssl_lib.c
index bf983542941..12d45ea0251 100644
--- a/lib/libssl/src/ssl/ssl_lib.c
+++ b/lib/libssl/src/ssl/ssl_lib.c
@@ -3235,7 +3235,7 @@ ssl_replace_hash(EVP_MD_CTX **hash, const EVP_MD *md)
 {
 	ssl_clear_hash_ctx(hash);
 	*hash = EVP_MD_CTX_create();
-	if (md)
+	if (*hash != NULL && md != NULL)
 		EVP_DigestInit_ex(*hash, md, NULL);
 	return (*hash);
 }