diff options
author | Shane Lontis <shane.lontis@oracle.com> | 2019-11-18 13:13:05 +1000 |
---|---|---|
committer | Shane Lontis <shane.lontis@oracle.com> | 2019-11-18 13:13:05 +1000 |
commit | f75abcc0f073b1c3e2d81df3fcde8fe45dd1e61f (patch) | |
tree | 9e55a53ddf04b053cc081fbe0c9e8244a13b5f22 /crypto/property | |
parent | de0799b0fc845869d775520382b4e7f9995732e5 (diff) |
Fix Use after free when copying cipher ctx
Fixes #10438
issue found by clusterfuzz/ossfuzz
The dest was getting a copy of the src structure which contained a pointer that should point to an offset inside itself - because of the copy it was pointing to the original structure.
The setup for a ctx is mainly done by the initkey method in the PROV_CIPHER_HW structure. Because of this it makes sense that the structure should also contain a copyctx method that is use to resolve any pointers that need to be setup.
A dup_ctx has been added to the cipher_enc tests in evp_test. It does a dup after setup and then frees the original ctx. This detects any floating pointers in the duplicated context that were pointing back to the freed ctx.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10443)
Diffstat (limited to 'crypto/property')
0 files changed, 0 insertions, 0 deletions