From f802266ee2c993ad1c979c057f92717755cafb58 Mon Sep 17 00:00:00 2001 From: tb Date: Wed, 30 Mar 2022 07:17:48 +0000 Subject: [PATCH] Avoid segfaults in EVP_PKEY_CTX_free() It is possible to call pmeth->cleanup() with an EVP_PKEY_CTX whose data is NULL. If pmeth->init() in int_ctx_new() fails, EVP_PKEY_CTX_free() is called with such a context. This in turn calls pmeth->cleanup(), and thus these cleanup functions must be careful not to use NULL data. Most of them are, but one of GOST's functions and HMAC's aren't. Reported for HMAC by Masaru Masada https://github.com/libressl-portable/openbsd/issues/129 ok bcook jsing --- lib/libcrypto/gost/gostr341001_pmeth.c | 7 +++++-- lib/libcrypto/hmac/hm_pmeth.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/lib/libcrypto/gost/gostr341001_pmeth.c b/lib/libcrypto/gost/gostr341001_pmeth.c index b668761e67c..ae39b05901c 100644 --- a/lib/libcrypto/gost/gostr341001_pmeth.c +++ b/lib/libcrypto/gost/gostr341001_pmeth.c @@ -1,4 +1,4 @@ -/* $OpenBSD: gostr341001_pmeth.c,v 1.15 2022/01/07 09:40:03 tb Exp $ */ +/* $OpenBSD: gostr341001_pmeth.c,v 1.16 2022/03/30 07:17:48 tb Exp $ */ /* * Copyright (c) 2014 Dmitry Eremin-Solenikov * Copyright (c) 2005-2006 Cryptocom LTD @@ -175,7 +175,10 @@ pkey_gost01_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) static void pkey_gost01_cleanup(EVP_PKEY_CTX *ctx) { - struct gost_pmeth_data *data = EVP_PKEY_CTX_get_data(ctx); + struct gost_pmeth_data *data; + + if ((data = EVP_PKEY_CTX_get_data(ctx)) == NULL) + return; free(data->shared_ukm); free(data); diff --git a/lib/libcrypto/hmac/hm_pmeth.c b/lib/libcrypto/hmac/hm_pmeth.c index 676305fdcba..4017f570b85 100644 --- a/lib/libcrypto/hmac/hm_pmeth.c +++ b/lib/libcrypto/hmac/hm_pmeth.c @@ -1,4 +1,4 @@ -/* $OpenBSD: hm_pmeth.c,v 1.12 2022/03/30 07:12:30 tb Exp $ */ +/* $OpenBSD: hm_pmeth.c,v 1.13 2022/03/30 07:17:48 tb Exp $ */ /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL * project 2007. */ @@ -116,7 +116,10 @@ pkey_hmac_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) static void pkey_hmac_cleanup(EVP_PKEY_CTX *ctx) { - HMAC_PKEY_CTX *hctx = ctx->data; + HMAC_PKEY_CTX *hctx; + + if ((hctx = ctx->data) == NULL) + return; HMAC_CTX_cleanup(&hctx->ctx); freezero(hctx->ktmp.data, hctx->ktmp.length); -- 2.20.1