From e37e2d88f1b7f6fa2c53768b8e72b0feb994f303 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Wed, 30 Mar 2022 07:17:48 +0000
Subject: Avoid segfaults in EVP_PKEY_CTX_free()
It is possible to call pmeth->cleanup() with an EVP_PKEY_CTX whose data
is NULL. If pmeth->init() in int_ctx_new() fails, EVP_PKEY_CTX_free() is
called with such a context. This in turn calls pmeth->cleanup(), and thus
these cleanup functions must be careful not to use NULL data. Most of
them are, but one of GOST's functions and HMAC's aren't.
Reported for HMAC by Masaru Masada
https://github.com/libressl-portable/openbsd/issues/129
ok bcook jsing
---
src/lib/libcrypto/gost/gostr341001_pmeth.c | 7 +++++--
src/lib/libcrypto/hmac/hm_pmeth.c | 7 +++++--
2 files changed, 10 insertions(+), 4 deletions(-)
(limited to 'src/lib')
diff --git a/src/lib/libcrypto/gost/gostr341001_pmeth.c b/src/lib/libcrypto/gost/gostr341001_pmeth.c
index b668761e67..ae39b05901 100644
--- a/src/lib/libcrypto/gost/gostr341001_pmeth.c
+++ b/src/lib/libcrypto/gost/gostr341001_pmeth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gostr341001_pmeth.c,v 1.15 2022/01/07 09:40:03 tb Exp $ */
+/* $OpenBSD: gostr341001_pmeth.c,v 1.16 2022/03/30 07:17:48 tb Exp $ */
/*
* Copyright (c) 2014 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* Copyright (c) 2005-2006 Cryptocom LTD
@@ -175,7 +175,10 @@ pkey_gost01_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
static void
pkey_gost01_cleanup(EVP_PKEY_CTX *ctx)
{
- struct gost_pmeth_data *data = EVP_PKEY_CTX_get_data(ctx);
+ struct gost_pmeth_data *data;
+
+ if ((data = EVP_PKEY_CTX_get_data(ctx)) == NULL)
+ return;
free(data->shared_ukm);
free(data);
diff --git a/src/lib/libcrypto/hmac/hm_pmeth.c b/src/lib/libcrypto/hmac/hm_pmeth.c
index 676305fdcb..4017f570b8 100644
--- a/src/lib/libcrypto/hmac/hm_pmeth.c
+++ b/src/lib/libcrypto/hmac/hm_pmeth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: hm_pmeth.c,v 1.12 2022/03/30 07:12:30 tb Exp $ */
+/* $OpenBSD: hm_pmeth.c,v 1.13 2022/03/30 07:17:48 tb Exp $ */
/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
* project 2007.
*/
@@ -116,7 +116,10 @@ pkey_hmac_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
static void
pkey_hmac_cleanup(EVP_PKEY_CTX *ctx)
{
- HMAC_PKEY_CTX *hctx = ctx->data;
+ HMAC_PKEY_CTX *hctx;
+
+ if ((hctx = ctx->data) == NULL)
+ return;
HMAC_CTX_cleanup(&hctx->ctx);
freezero(hctx->ktmp.data, hctx->ktmp.length);
--
cgit v1.2.3-55-g6feb