File openssl-CVE-2022-4450-1of2.patch of Package openssl-1_1

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-CVE-2022-4450-1of2.patch of Package openssl-1_1 (Revision 39b8239120eb6e7288fb0c82e8b2fc62)

Currently displaying revision 39b8239120eb6e7288fb0c82e8b2fc62 , Show latest

commit 2fc14c59ca0eb275dfb9308e9d1d89a1dcbc2a24
Author: Matt Caswell <matt@openssl.org>
Date:   Tue Dec 13 14:54:55 2022 +0000

Avoid dangling ptrs in header and data params for PEM_read_bio_ex
    
    In the event of a failure in PEM_read_bio_ex() we free the buffers we
    allocated for the header and data buffers. However we were not clearing
    the ptrs stored in *header and *data. Since, on success, the caller is
    responsible for freeing these ptrs this can potentially lead to a double
    free if the caller frees them even on failure.
    
    Thanks to Dawei Wang for reporting this issue.
    
    Based on a proposed patch by Kurt Roeckx.
    
    CVE-2022-4450

diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c
index d416d939ea..328c30cdbb 100644
--- a/crypto/pem/pem_lib.c
+++ b/crypto/pem/pem_lib.c
@@ -957,7 +957,9 @@ int PEM_read_bio_ex(BIO *bp, char **name_out, char **header,
     *data = pem_malloc(len, flags);
     if (*header == NULL || *data == NULL) {
         pem_free(*header, flags, 0);
+        *header = NULL;
         pem_free(*data, flags, 0);
+        *data = NULL;
         goto end;
     }
     BIO_read(headerB, *header, headerlen);

Places

File openssl-CVE-2022-4450-1of2.patch of Package openssl-1_1 (Revision 39b8239120eb6e7288fb0c82e8b2fc62)

Places