From e59ed0bfeece9db433809af2cebbe271a402d59b Mon Sep 17 00:00:00 2001 From: Neil Horman Date: Thu, 9 Nov 2023 08:13:58 -0500 Subject: zero data in hm_fragment on alloc if we allocate a new hm_frament in dtls1_buffer_message with dtls1_hm_fragment_new, the returned fragment contains uninitalized data in the msg_header field. If an error then occurs, and we free the fragment, dtls_hm_fragment_free interrogates the msg_header field (which is garbage), and potentially references undefined values, or worse, accidentally references available memory that is not owned, leading to various corruptions. Reviewed-by: Dmitry Belyavskiy Reviewed-by: Tim Hudson Reviewed-by: Tomas Mraz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/22679) --- ssl/statem/statem_dtls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'ssl') diff --git a/ssl/statem/statem_dtls.c b/ssl/statem/statem_dtls.c index a88b0dfeac..97d9f4591c 100644 --- a/ssl/statem/statem_dtls.c +++ b/ssl/statem/statem_dtls.c @@ -62,7 +62,7 @@ static hm_fragment *dtls1_hm_fragment_new(size_t frag_len, int reassembly) unsigned char *buf = NULL; unsigned char *bitmask = NULL; - if ((frag = OPENSSL_malloc(sizeof(*frag))) == NULL) + if ((frag = OPENSSL_zalloc(sizeof(*frag))) == NULL) return NULL; if (frag_len) { -- cgit v1.2.3