SSL: SSL_CTX_set_tmp_dh() error handling. For example, it can fail due to weak DH parameters.
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c index 60cc358..2a0d005 100644 --- a/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c
@@ -1376,7 +1376,13 @@ return NGX_ERROR; } - SSL_CTX_set_tmp_dh(ssl->ctx, dh); + if (SSL_CTX_set_tmp_dh(ssl->ctx, dh) != 1) { + ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, + "SSL_CTX_set_tmp_dh(\"%s\") failed", file->data); + DH_free(dh); + BIO_free(bio); + return NGX_ERROR; + } DH_free(dh); BIO_free(bio);