diff options
| author | Matt Caswell <matt@openssl.org> | 2022-12-13 14:54:55 +0000 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2023-02-07 17:05:10 +0100 |
| commit | ee6243f3947107d655f6dee96f63861561a5aaeb (patch) | |
| tree | d76e4c96b7c0c4bce581e9facd487497a5007dee /crypto/pem | |
| parent | b1892d21f8f0435deb0250f24a97915dc641c807 (diff) | |
| download | openssl-new-ee6243f3947107d655f6dee96f63861561a5aaeb.tar.gz | |
Avoid dangling ptrs in header and data params for PEM_read_bio_ex
In the event of a failure in PEM_read_bio_ex() we free the buffers we
allocated for the header and data buffers. However we were not clearing
the ptrs stored in *header and *data. Since, on success, the caller is
responsible for freeing these ptrs this can potentially lead to a double
free if the caller frees them even on failure.
Thanks to Dawei Wang for reporting this issue.
Based on a proposed patch by Kurt Roeckx.
CVE-2022-4450
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Diffstat (limited to 'crypto/pem')
| -rw-r--r-- | crypto/pem/pem_lib.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c index 4035ac64e6..f7a1bd8302 100644 --- a/crypto/pem/pem_lib.c +++ b/crypto/pem/pem_lib.c @@ -995,7 +995,9 @@ int PEM_read_bio_ex(BIO *bp, char **name_out, char **header, out_free: PEM_FREE(*header, flags, 0); + *header = NULL; PEM_FREE(*data, flags, 0); + *data = NULL; end: EVP_ENCODE_CTX_free(ctx); PEM_FREE(name, flags, 0); |