[openssl-commits] [openssl] master update

Matt Caswell matt at openssl.org
Mon Sep 21 09:29:19 UTC 2015


The branch master has been updated
       via  bf95cde28712cfcad90cb3975cdcb8e5c0f20fde (commit)
       via  dfd6211ce3536cdf6a2d455ac108fb35ab1b865d (commit)
      from  4e7e623012e1604d985e2ef362c2957d464f3f01 (commit)


- Log -----------------------------------------------------------------
commit bf95cde28712cfcad90cb3975cdcb8e5c0f20fde
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Sep 16 10:24:37 2015 +0100

    Fix SRP memory leaks
    
    There were some memory leaks in the creation of an SRP verifier (both on
    successful completion and also on some error paths).
    
    Reviewed-by: Emilia Käsper <emilia at openssl.org>

commit dfd6211ce3536cdf6a2d455ac108fb35ab1b865d
Author: Matt Caswell <matt at openssl.org>
Date:   Wed Sep 16 09:50:33 2015 +0100

    Fix -srpvfile option in srp command line
    
    The -srpvfile option was broken in the srp command line app. Using it would
    always result in "-dbfile and -configfile cannot be specified together."
    The error message is also wrong because the option is "-srpvfile" not
    "-dbfile", so that has been fixed too.
    
    Reviewed-by: Emilia Käsper <emilia at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 apps/srp.c           | 28 ++++++++++++++++------------
 crypto/srp/srp_vfy.c | 33 ++++++++++++++++++++++++---------
 2 files changed, 40 insertions(+), 21 deletions(-)

diff --git a/apps/srp.c b/apps/srp.c
index c730d6d..24fb798 100644
--- a/apps/srp.c
+++ b/apps/srp.c
@@ -260,8 +260,8 @@ int srp_main(int argc, char **argv)
     char *user = NULL, *passinarg = NULL, *passoutarg = NULL;
     char *passin = NULL, *passout = NULL, *gN = NULL, *userinfo = NULL;
     char *randfile = NULL, *tofree = NULL, *section = NULL;
-    char **gNrow = NULL, *configfile = default_config_file;
-    char *dbfile = NULL, **pp, *prog;
+    char **gNrow = NULL, *configfile = NULL;
+    char *srpvfile = NULL, **pp, *prog;
     OPTION_CHOICE o;
 
     prog = opt_init(argc, argv, srp_options);
@@ -286,7 +286,7 @@ int srp_main(int argc, char **argv)
             section = opt_arg();
             break;
         case OPT_SRPVFILE:
-            dbfile = opt_arg();
+            srpvfile = opt_arg();
             break;
         case OPT_ADD:
         case OPT_DELETE:
@@ -320,9 +320,9 @@ int srp_main(int argc, char **argv)
     argc = opt_num_rest();
     argv = opt_rest();
 
-    if (dbfile && configfile) {
+    if (srpvfile && configfile) {
         BIO_printf(bio_err,
-                   "-dbfile and -configfile cannot be specified together.\n");
+                   "-srpvfile and -configfile cannot be specified together.\n");
         goto end;
     }
     if (mode == OPT_ERR) {
@@ -347,14 +347,17 @@ int srp_main(int argc, char **argv)
         goto end;
     }
 
-    if (!dbfile) {
+    if (!srpvfile) {
+        if (!configfile)
+            configfile = default_config_file;
+
         if (verbose)
             BIO_printf(bio_err, "Using configuration from %s\n",
                        configfile);
         conf = app_load_config(configfile);
         if (conf == NULL)
             goto end;
-	if (!app_load_modules(conf))
+        if (!app_load_modules(conf))
             goto end;
 
         /* Lets get the config section we are using */
@@ -379,7 +382,8 @@ int srp_main(int argc, char **argv)
                        "trying to read " ENV_DATABASE " in section \"%s\"\n",
                        section);
 
-        if ((dbfile = NCONF_get_string(conf, section, ENV_DATABASE)) == NULL) {
+        if ((srpvfile = NCONF_get_string(conf, section, ENV_DATABASE))
+                == NULL) {
             lookup_fail(section, ENV_DATABASE);
             goto end;
         }
@@ -392,9 +396,9 @@ int srp_main(int argc, char **argv)
 
     if (verbose)
         BIO_printf(bio_err, "Trying to read SRP verifier file \"%s\"\n",
-                   dbfile);
+                   srpvfile);
 
-    db = load_index(dbfile, &db_attr);
+    db = load_index(srpvfile, &db_attr);
     if (db == NULL)
         goto end;
 
@@ -619,12 +623,12 @@ int srp_main(int argc, char **argv)
 
         if (verbose)
             BIO_printf(bio_err, "Trying to update srpvfile.\n");
-        if (!save_index(dbfile, "new", db))
+        if (!save_index(srpvfile, "new", db))
             goto end;
 
         if (verbose)
             BIO_printf(bio_err, "Temporary srpvfile created.\n");
-        if (!rotate_index(dbfile, "new", "old"))
+        if (!rotate_index(srpvfile, "new", "old"))
             goto end;
 
         if (verbose)
diff --git a/crypto/srp/srp_vfy.c b/crypto/srp/srp_vfy.c
index 39c89e8..e81ae01 100644
--- a/crypto/srp/srp_vfy.c
+++ b/crypto/srp/srp_vfy.c
@@ -522,12 +522,12 @@ char *SRP_create_verifier(const char *user, const char *pass, char **salt,
                           char **verifier, const char *N, const char *g)
 {
     int len;
-    char *result = NULL;
-    char *vf;
+    char *result = NULL, *vf = NULL;
     BIGNUM *N_bn = NULL, *g_bn = NULL, *s = NULL, *v = NULL;
     unsigned char tmp[MAX_LEN];
     unsigned char tmp2[MAX_LEN];
     char *defgNid = NULL;
+    int vfsize = 0;
 
     if ((user == NULL) ||
         (pass == NULL) || (salt == NULL) || (verifier == NULL))
@@ -565,22 +565,23 @@ char *SRP_create_verifier(const char *user, const char *pass, char **salt,
         goto err;
 
     BN_bn2bin(v, tmp);
-    if (((vf = OPENSSL_malloc(BN_num_bytes(v) * 2)) == NULL))
+    vfsize = BN_num_bytes(v) * 2;
+    if (((vf = OPENSSL_malloc(vfsize)) == NULL))
         goto err;
     t_tob64(vf, tmp, BN_num_bytes(v));
 
-    *verifier = vf;
     if (*salt == NULL) {
         char *tmp_salt;
 
         if ((tmp_salt = OPENSSL_malloc(SRP_RANDOM_SALT_LEN * 2)) == NULL) {
-            OPENSSL_free(vf);
             goto err;
         }
         t_tob64(tmp_salt, tmp2, SRP_RANDOM_SALT_LEN);
         *salt = tmp_salt;
     }
 
+    *verifier = vf;
+    vf = NULL;
     result = defgNid;
 
  err:
@@ -588,11 +589,20 @@ char *SRP_create_verifier(const char *user, const char *pass, char **salt,
         BN_free(N_bn);
         BN_free(g_bn);
     }
+    OPENSSL_clear_free(vf, vfsize);
+    BN_clear_free(s);
+    BN_clear_free(v);
     return result;
 }
 
 /*
- * create a verifier (*salt,*verifier,g and N are BIGNUMs)
+ * create a verifier (*salt,*verifier,g and N are BIGNUMs). If *salt != NULL
+ * then the provided salt will be used. On successful exit *verifier will point
+ * to a newly allocated BIGNUM containing the verifier and (if a salt was not
+ * provided) *salt will be populated with a newly allocated BIGNUM containing a
+ * random salt.
+ * The caller is responsible for freeing the allocated *salt and *verifier
+ * BIGNUMS.
  */
 int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt,
                            BIGNUM **verifier, const BIGNUM *N,
@@ -602,6 +612,7 @@ int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt,
     BIGNUM *x = NULL;
     BN_CTX *bn_ctx = BN_CTX_new();
     unsigned char tmp2[MAX_LEN];
+    BIGNUM *salttmp = NULL;
 
     if ((user == NULL) ||
         (pass == NULL) ||
@@ -613,10 +624,12 @@ int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt,
         if (RAND_bytes(tmp2, SRP_RANDOM_SALT_LEN) <= 0)
             goto err;
 
-        *salt = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL);
+        salttmp = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL);
+    } else {
+        salttmp = *salt;
     }
 
-    x = SRP_Calc_x(*salt, user, pass);
+    x = SRP_Calc_x(salttmp, user, pass);
 
     *verifier = BN_new();
     if (*verifier == NULL)
@@ -628,9 +641,11 @@ int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt,
     }
 
     result = 1;
+    *salt = salttmp;
 
  err:
-
+    if (*salt != salttmp)
+        BN_clear_free(salttmp);
     BN_clear_free(x);
     BN_CTX_free(bn_ctx);
     return result;


More information about the openssl-commits mailing list