[openssl] master update
Dr. Paul Dale
pauli at openssl.org
Wed Jun 24 21:50:28 UTC 2020
The branch master has been updated
via 19765f5bcfcb6dc181c3a562c32ddd489291502a (commit)
via 33c41876edbb8e63b2f6633db894726f48044932 (commit)
from 1b0f5b62ff51a89553a55f7fad2a76b7032ef31d (commit)
- Log -----------------------------------------------------------------
commit 19765f5bcfcb6dc181c3a562c32ddd489291502a
Author: Dr. David von Oheimb <David.von.Oheimb at siemens.com>
Date: Mon Jun 22 17:18:20 2020 +0200
apps/cmp.c: Add workaround for Coverity false positive; rename e -> engine
CID 1463570: (USE_AFTER_FREE)
CID 1463570: (USE_AFTER_FREE)
Passing freed pointer "e" as an argument to "release_engine".
Reviewed-by: Paul Dale <paul.dale at oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12231)
commit 33c41876edbb8e63b2f6633db894726f48044932
Author: Dr. David von Oheimb <David.von.Oheimb at siemens.com>
Date: Mon Jun 22 16:33:13 2020 +0200
apps/cmp.c: Fix memory leaks in handle_opt_geninfo() found by Coverity
CID 1463578: Resource leaks (RESOURCE_LEAK)
CID 1463575: Resource leaks (RESOURCE_LEAK)
Reviewed-by: Paul Dale <paul.dale at oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12231)
-----------------------------------------------------------------------
Summary of changes:
apps/cmp.c | 47 ++++++++++++++++++++++++-----------------------
1 file changed, 24 insertions(+), 23 deletions(-)
diff --git a/apps/cmp.c b/apps/cmp.c
index 05fae77d38..4a6074ba58 100644
--- a/apps/cmp.c
+++ b/apps/cmp.c
@@ -671,10 +671,10 @@ static char *next_item(char *opt) /* in list separated by comma and/or space */
}
static EVP_PKEY *load_key_pwd(const char *uri, int format,
- const char *pass, ENGINE *e, const char *desc)
+ const char *pass, ENGINE *eng, const char *desc)
{
char *pass_string = get_passwd(pass, desc);
- EVP_PKEY *pkey = load_key(uri, format, 0, pass_string, e, desc);
+ EVP_PKEY *pkey = load_key(uri, format, 0, pass_string, eng, desc);
clear_free(pass_string);
return pkey;
@@ -1329,7 +1329,7 @@ static int transform_opts(void)
return 1;
}
-static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *e)
+static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
{
OSSL_CMP_CTX *ctx; /* extra CMP (client) ctx partly used by server */
OSSL_CMP_SRV_CTX *srv_ctx = ossl_cmp_mock_srv_new();
@@ -1387,7 +1387,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *e)
if (opt_srv_key != NULL) {
EVP_PKEY *pkey = load_key_pwd(opt_srv_key, opt_keyform,
opt_srv_keypass,
- e, "private key for server cert");
+ engine, "private key for server cert");
if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {
EVP_PKEY_free(pkey);
@@ -1590,7 +1590,7 @@ static int setup_verification_ctx(OSSL_CMP_CTX *ctx)
* set up ssl_ctx for the OSSL_CMP_CTX based on options from config file/CLI.
* Returns pointer on success, NULL on error
*/
-static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
+static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
{
STACK_OF(X509) *untrusted_certs = OSSL_CMP_CTX_get0_untrusted_certs(ctx);
EVP_PKEY *pkey = NULL;
@@ -1682,7 +1682,7 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
}
pkey = load_key_pwd(opt_tls_key, opt_keyform, opt_tls_keypass,
- e, "TLS client private key");
+ engine, "TLS client private key");
cleanse(opt_tls_keypass);
if (pkey == NULL)
goto err;
@@ -1728,7 +1728,7 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
* file/CLI while parsing options and checking their consistency.
* Returns 1 on success, 0 on error
*/
-static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
+static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
{
if (!opt_unprotected_requests && opt_secret == NULL && opt_cert == NULL) {
CMP_err("must give client credentials unless -unprotected_requests is set");
@@ -1766,7 +1766,7 @@ static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
goto err;
if (opt_key != NULL) {
- EVP_PKEY *pkey = load_key_pwd(opt_key, opt_keyform, opt_keypass, e,
+ EVP_PKEY *pkey = load_key_pwd(opt_key, opt_keyform, opt_keypass, engine,
"private key for CMP client certificate");
if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {
@@ -1852,7 +1852,7 @@ static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
* based on options from config file/CLI.
* Returns pointer on success, NULL on error
*/
-static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
+static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
{
if (opt_subject == NULL && opt_oldcert == NULL && opt_cert == NULL)
CMP_warn("no -subject given, neither -oldcert nor -cert available as default");
@@ -1865,12 +1865,12 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
const int format = opt_keyform;
const char *pass = opt_newkeypass;
const char *desc = "new private or public key for cert to be enrolled";
- EVP_PKEY *pkey = load_key_pwd(file, format, pass, e, NULL);
+ EVP_PKEY *pkey = load_key_pwd(file, format, pass, engine, NULL);
int priv = 1;
if (pkey == NULL) {
ERR_clear_error();
- pkey = load_pubkey(file, format, 0, pass, e, desc);
+ pkey = load_pubkey(file, format, 0, pass, engine, desc);
priv = 0;
}
cleanse(opt_newkeypass);
@@ -2042,12 +2042,11 @@ static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)
return 0;
}
- aint = ASN1_INTEGER_new();
- if (aint == NULL || !ASN1_INTEGER_set(aint, value))
+ if ((aint = ASN1_INTEGER_new()) == NULL)
goto oom;
val = ASN1_TYPE_new();
- if (val == NULL) {
+ if (!ASN1_INTEGER_set(aint, value) || val == NULL) {
ASN1_INTEGER_free(aint);
goto oom;
}
@@ -2065,6 +2064,7 @@ static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)
return 1;
oom:
+ ASN1_OBJECT_free(type);
CMP_err("out of memory");
return 0;
}
@@ -2076,7 +2076,7 @@ static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)
* Prints reason for error to bio_err.
* Returns 1 on success, 0 on error
*/
-static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
+static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
{
int ret = 0;
char server_buf[200] = { '\0' };
@@ -2210,17 +2210,17 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
info->port = server_port_s;
info->use_proxy = opt_proxy != NULL;
info->timeout = OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_MSG_TIMEOUT);
- info->ssl_ctx = setup_ssl_ctx(ctx, e);
+ info->ssl_ctx = setup_ssl_ctx(ctx, engine);
if (info->ssl_ctx == NULL)
goto err;
(void)OSSL_CMP_CTX_set_http_cb(ctx, app_http_tls_cb);
#endif
}
- if (!setup_protection_ctx(ctx, e))
+ if (!setup_protection_ctx(ctx, engine))
goto err;
- if (!setup_request_ctx(ctx, e))
+ if (!setup_request_ctx(ctx, engine))
goto err;
if (!set_name(opt_recipient, OSSL_CMP_CTX_set1_recipient, ctx, "recipient")
@@ -2857,7 +2857,7 @@ int cmp_main(int argc, char **argv)
char *configfile = NULL;
int i;
X509 *newcert = NULL;
- ENGINE *e = NULL;
+ ENGINE *engine = NULL;
char mock_server[] = "mock server:1";
int ret = 0; /* default: failure */
@@ -2936,7 +2936,7 @@ int cmp_main(int argc, char **argv)
}
if (opt_engine != NULL)
- e = setup_engine_methods(opt_engine, 0 /* not: ENGINE_METHOD_ALL */, 0);
+ engine = setup_engine_methods(opt_engine, 0 /* not: ENGINE_METHOD_ALL */, 0);
if (opt_port != NULL) {
if (opt_use_mock_srv) {
@@ -2960,7 +2960,7 @@ int cmp_main(int argc, char **argv)
if ((opt_use_mock_srv || opt_port != NULL)) {
OSSL_CMP_SRV_CTX *srv_ctx;
- if ((srv_ctx = setup_srv_ctx(e)) == NULL)
+ if ((srv_ctx = setup_srv_ctx(engine)) == NULL)
goto err;
OSSL_CMP_CTX_set_transfer_cb_arg(cmp_ctx, srv_ctx);
if (!OSSL_CMP_CTX_set_log_cb(OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx),
@@ -3051,7 +3051,7 @@ int cmp_main(int argc, char **argv)
}
}
- if (!setup_client_ctx(cmp_ctx, e)) {
+ if (!setup_client_ctx(cmp_ctx, engine)) {
CMP_err("cannot set up CMP context");
goto err;
}
@@ -3186,7 +3186,8 @@ int cmp_main(int argc, char **argv)
X509_STORE_free(OSSL_CMP_CTX_get_certConf_cb_arg(cmp_ctx));
OSSL_CMP_CTX_free(cmp_ctx);
X509_VERIFY_PARAM_free(vpm);
- release_engine(e);
+ if (engine != NULL) /* workaround for Coverity false positive */
+ release_engine(engine);
NCONF_free(conf); /* must not do as long as opt_... variables are used */
OSSL_CMP_log_close();
More information about the openssl-commits
mailing list