openssl/crypto
Bernd Edlinger b7e28c0bb1 Fix a memory leak in X509_issuer_and_serial_hash
This is reproducible with my error injection patch.

The test vector has been validated on the 1.1.1 branch
but the issue is of course identical in all branches.

$ ERROR_INJECT=1653267699 ../util/shlib_wrap.sh ./x509-test ./corpora/x509/5f4034ae85d6587dcad4da3e812e80f3d312894d
ERROR_INJECT=1653267699
    #0 0x7fd485a6ad4f in __sanitizer_print_stack_trace ../../../../src/libsanitizer/asan/asan_stack.cc:36
    #1 0x55c12d268724 in my_malloc fuzz/test-corpus.c:114
    #2 0x7fd484f51a75 in CRYPTO_zalloc crypto/mem.c:230
    #3 0x7fd484ed778d in EVP_DigestInit_ex crypto/evp/digest.c:139
    #4 0x7fd4850a9849 in X509_issuer_and_serial_hash crypto/x509/x509_cmp.c:44
    #5 0x55c12d268951 in FuzzerTestOneInput fuzz/x509.c:44
    #6 0x55c12d268239 in testfile fuzz/test-corpus.c:182
    #7 0x55c12d267c7f in main fuzz/test-corpus.c:226
    #8 0x7fd483a42082 in __libc_start_main ../csu/libc-start.c:308
    #9 0x55c12d267e5d in _start (/home/ed/OPCToolboxV5/Source/Core/OpenSSL/openssl/fuzz/x509-test+0x3e5d)

=================================================================
==1058475==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 268 byte(s) in 1 object(s) allocated from:
    #0 0x7fd485a5dc3e in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163
    #1 0x7fd484d2eb9b in BUF_MEM_grow crypto/buffer/buffer.c:97
    #2 0x7fd4850b2913 in X509_NAME_oneline crypto/x509/x509_obj.c:43
    #3 0x7fd4850a982f in X509_issuer_and_serial_hash crypto/x509/x509_cmp.c:41
    #4 0x55c12d268951 in FuzzerTestOneInput fuzz/x509.c:44
    #5 0x55c12d268239 in testfile fuzz/test-corpus.c:182
    #6 0x55c12d267c7f in main fuzz/test-corpus.c:226
    #7 0x7fd483a42082 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: 268 byte(s) leaked in 1 allocation(s).

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18371)
2022-05-24 11:52:46 +02:00
..
aes Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
aria Change loops conditions to make zero loop risk more obvious. 2022-05-24 14:11:20 +10:00
asn1 Update copyright year 2022-05-03 13:34:51 +01:00
async Update copyright year 2022-05-03 13:34:51 +01:00
bf Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
bio Fix KTLS with BIO_new_connect 2022-05-17 13:16:03 +02:00
bn Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
buffer
camellia Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
cast Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
chacha Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
cmac
cmp Remove duplicated #include headers 2022-05-04 13:46:10 +10:00
cms Remove duplicated #include headers 2022-05-04 13:46:10 +10:00
comp
conf Update copyright year 2022-05-03 13:34:51 +01:00
crmf crmf_lib.c: Make sure Ed signature for POPO is called without digest 2022-05-05 09:52:27 +02:00
ct
des Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
dh Remove duplicated #include headers 2022-05-04 13:46:10 +10:00
dsa Update copyright year 2022-05-03 13:34:51 +01:00
dso Update copyright year 2022-05-03 13:34:51 +01:00
ec Fix undefined behaviour in EC_GROUP_new_from_ecparameters 2022-05-24 11:42:57 +02:00
encode_decode Remove the _fetch_by_number functions 2022-05-06 10:38:55 +10:00
engine Update copyright year 2022-05-03 13:34:51 +01:00
err err: get rid of err_free_strings_int() 2022-05-10 09:47:54 +02:00
ess
evp Fix check of EVP_CIPHER_CTX_ctrl 2022-05-24 08:57:37 +02:00
ffc Update copyright year 2022-05-03 13:34:51 +01:00
hmac
http Update copyright year 2022-05-03 13:34:51 +01:00
idea
kdf
lhash performance: improve ossl_lh_strcasehash 2022-05-21 21:53:39 +02:00
md2
md4
md5 Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
mdc2
modes Change loops conditions to make zero loop risk more obvious. 2022-05-24 14:11:20 +10:00
objects objects.txt: Add newly registered OIDs according to CMP Updates, for use in extended CMPv2 2022-05-04 13:23:31 +02:00
ocsp Update copyright year 2022-05-03 13:34:51 +01:00
pem Update copyright year 2022-05-03 13:34:51 +01:00
perlasm x86asm: Generate endbr32 based on __CET__. 2022-05-24 13:16:06 +10:00
pkcs7 Update copyright year 2022-05-03 13:34:51 +01:00
pkcs12 Update copyright year 2022-05-03 13:34:51 +01:00
poly1305 Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
property Complete the cleanup of an algorithm in OSSL_METHOD_STORE 2022-05-05 15:06:11 +02:00
rand remove legacy VxWorks workaround 2022-05-09 11:13:37 +02:00
rc2
rc4 Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
rc5 Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
ripemd Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
rsa Update copyright year 2022-05-03 13:34:51 +01:00
seed
sha Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
siphash Update copyright year 2022-05-03 13:34:51 +01:00
sm2 Remove duplicated #include headers 2022-05-04 13:46:10 +10:00
sm3 Update copyright year 2022-05-03 13:34:51 +01:00
sm4 Update copyright year 2022-05-03 13:34:51 +01:00
srp
stack
store Fix Coverity 1503329 use after free 2022-05-06 18:21:22 +10:00
ts Update copyright year 2022-05-03 13:34:51 +01:00
txt_db
ui Update copyright year 2022-05-03 13:34:51 +01:00
whrlpool Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
x509 Fix a memory leak in X509_issuer_and_serial_hash 2022-05-24 11:52:46 +02:00
alphacpuid.pl
arm64cpuid.pl Update copyright year 2022-05-03 13:34:51 +01:00
arm_arch.h Apply the AES-GCM unroll8 optimization patch to Neoverse N2 2022-05-23 11:05:51 +10:00
armcap.c Apply the AES-GCM unroll8 optimization patch to Neoverse N2 2022-05-23 11:05:51 +10:00
armv4cpuid.pl
asn1_dsa.c
bsearch.c
build.info Rename x86-32 assembly files from .s to .S. 2022-05-24 13:16:06 +10:00
c64xpluscpuid.pl
context.c Update copyright year 2022-05-03 13:34:51 +01:00
core_algorithm.c Refactor method construction pre- and post-condition 2022-05-05 15:05:54 +02:00
core_fetch.c Always try to construct methods as new provider might be added 2022-05-12 08:28:12 +02:00
core_namemap.c Drop ossl_namemap_add_name_n() and simplify ossl_namemap_add_names() 2022-05-21 21:49:54 +02:00
cpt_err.c
cpuid.c Update copyright year 2022-05-03 13:34:51 +01:00
cryptlib.c Update copyright year 2022-05-03 13:34:51 +01:00
ctype.c tolower: refine the tolower code to avoid a memory access 2022-05-23 09:51:28 +10:00
cversion.c
der_writer.c
dllmain.c Update copyright year 2022-05-03 13:34:51 +01:00
ebcdic.c
ex_data.c
getenv.c Update copyright year 2022-05-03 13:34:51 +01:00
ia64cpuid.S
info.c Update copyright year 2022-05-03 13:34:51 +01:00
init.c strcasecmp: implement strcasecmp and strncasecmp 2022-05-23 09:51:28 +10:00
initthread.c Update copyright year 2022-05-03 13:34:51 +01:00
LPdir_nyi.c
LPdir_unix.c Update copyright year 2022-05-03 13:34:51 +01:00
LPdir_vms.c
LPdir_win32.c
LPdir_win.c
LPdir_wince.c
mem_clr.c
mem_sec.c Update copyright year 2022-05-03 13:34:51 +01:00
mem.c Update copyright year 2022-05-03 13:34:51 +01:00
mips_arch.h
o_dir.c Update copyright year 2022-05-03 13:34:51 +01:00
o_fopen.c Update copyright year 2022-05-03 13:34:51 +01:00
o_init.c Update copyright year 2022-05-03 13:34:51 +01:00
o_str.c strcasecmp: implement strcasecmp and strncasecmp 2022-05-23 09:51:28 +10:00
o_time.c
packet.c
param_build_set.c Update copyright year 2022-05-03 13:34:51 +01:00
param_build.c Update copyright year 2022-05-03 13:34:51 +01:00
params_dup.c Update copyright year 2022-05-03 13:34:51 +01:00
params_from_text.c
params.c Update copyright year 2022-05-03 13:34:51 +01:00
pariscid.pl
passphrase.c Update copyright year 2022-05-03 13:34:51 +01:00
ppccap.c Update copyright year 2022-05-03 13:34:51 +01:00
ppccpuid.pl Update copyright year 2022-05-03 13:34:51 +01:00
provider_child.c For child libctx / provider, don't count self-references in parent 2022-05-05 15:06:11 +02:00
provider_conf.c Update copyright year 2022-05-03 13:34:51 +01:00
provider_core.c Add method store cache flush and method removal to non-EVP operations 2022-05-05 15:06:12 +02:00
provider_local.h
provider_predefined.c
provider.c
punycode.c
README-sparse_array.md
riscv64cpuid.pl Add basic RISC-V cpuid and OPENSSL_riscvcap 2022-05-19 16:32:49 +10:00
riscvcap.c Add basic RISC-V cpuid and OPENSSL_riscvcap 2022-05-19 16:32:49 +10:00
s390x_arch.h Update copyright year 2022-05-03 13:34:51 +01:00
s390xcap.c s390: Add new machine generation 2022-04-12 13:04:57 +02:00
s390xcpuid.pl
self_test_core.c Update copyright year 2022-05-03 13:34:51 +01:00
sparccpuid.S
sparcv9cap.c
sparse_array.c Update copyright year 2022-05-03 13:34:51 +01:00
threads_lib.c
threads_none.c
threads_pthread.c Update copyright year 2022-05-03 13:34:51 +01:00
threads_win.c
trace.c Update copyright year 2022-05-03 13:34:51 +01:00
uid.c
vms_rms.h
x86_64cpuid.pl
x86cpuid.pl