From 43ef7d43fbc99230c909d57b8c2931e19c1889e8 Mon Sep 17 00:00:00 2001
From: Johanna Amann <johanna@corelight.com>
Date: Mon, 5 Jul 2021 09:40:04 +0100
Subject: [PATCH] X509: add check if function succeeds

Addresses feedback of GH-1634
---
 src/file_analysis/analyzer/x509/functions.bif | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/file_analysis/analyzer/x509/functions.bif b/src/file_analysis/analyzer/x509/functions.bif
index 95ee203e8b..fb49705bf8 100644
--- a/src/file_analysis/analyzer/x509/functions.bif
+++ b/src/file_analysis/analyzer/x509/functions.bif
@@ -1088,6 +1088,11 @@ function x509_check_cert_hostname%(cert_opaque: opaque of x509, hostname: string
 			{
 			char buf[2048];
 			BIO *bio = BIO_new(BIO_s_mem());
+			if ( ! bio )
+			{
+			zeek::emit_builtin_error(zeek::util::fmt("Could create bio"));
+			return zeek::make_intrusive<zeek::StringVal>("");
+			}
 			ASN1_STRING_print(bio, X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject, found_nid)));
 			size_t len = BIO_gets(bio, buf, sizeof(buf));
 			BIO_free(bio);