[openssl] master update

Dr. Paul Dale pauli at openssl.org
Thu Jul 1 03:20:15 UTC 2021


The branch master has been updated
       via  a5a4dac988c536bb021c4145ebba88e1507834f8 (commit)
       via  514b76917c36836ae4243392e71785f01d8233c9 (commit)
      from  d720e60357c0a477ff547edac539d15b0a9e320e (commit)


- Log -----------------------------------------------------------------
commit a5a4dac988c536bb021c4145ebba88e1507834f8
Author: Pauli <pauli at openssl.org>
Date:   Wed Jun 30 09:25:40 2021 +1000

    ci: add a memory sanitiser test run
    
    This omission noted in #15950
    
    Reviewed-by: Tomas Mraz <tomas at openssl.org>
    Reviewed-by: Shane Lontis <shane.lontis at oracle.com>
    (Merged from https://github.com/openssl/openssl/pull/15952)

commit 514b76917c36836ae4243392e71785f01d8233c9
Author: Pauli <pauli at openssl.org>
Date:   Wed Jun 30 10:21:17 2021 +1000

    afalg: add some memory initialisation calls to pacify memory sanitisation.
    
    The engine is modifying memory without the sanitiser realising.  By pre-
    initialising this memory, the sanitiser now thinks that read accesses are okay.
    
    Reviewed-by: Tomas Mraz <tomas at openssl.org>
    Reviewed-by: Shane Lontis <shane.lontis at oracle.com>
    (Merged from https://github.com/openssl/openssl/pull/15952)

-----------------------------------------------------------------------

Summary of changes:
 .github/workflows/ci.yml | 14 +++++++++++++-
 engines/e_afalg.c        |  9 +++++++++
 test/afalgtest.c         | 50 ++++++++++++++++++++++++++++++------------------
 3 files changed, 53 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a34ab933c0..5ff0750681 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -125,7 +125,7 @@ jobs:
     - name: make test
       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0 TESTS="-test_fuzz* -test_ssl_* -test_evp -test_cmp_http -test_verify -test_cms -test_store -test_enc -[01][0-9]"
 
-  sanitizers:
+  address_ub_sanitizer:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout at v2
@@ -136,6 +136,18 @@ jobs:
     - name: make test
       run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0
 
+  memory_sanitizer:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout at v2
+    - name: config
+      # --debug -O1 is to produce a debug build that runs in a reasonable amount of time
+      run: CC=clang ./config --banner=Configured --debug -O1 -fsanitize=memory -DOSSL_SANITIZE_MEMORY -fno-optimize-sibling-calls enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-fips && perl configdata.pm --dump
+    - name: make
+      run: make -s -j4
+    - name: make test
+      run: make test HARNESS_JOBS=${HARNESS_JOBS:-4} OPENSSL_TEST_RAND_ORDER=0
+
   threads_sanitizer:
     runs-on: ubuntu-latest
     steps:
diff --git a/engines/e_afalg.c b/engines/e_afalg.c
index f36665acf6..d8d3ef610c 100644
--- a/engines/e_afalg.c
+++ b/engines/e_afalg.c
@@ -324,6 +324,15 @@ static int afalg_fin_cipher_aio(afalg_aio *aio, int sfd, unsigned char *buf,
         }
         if (eval > 0) {
 
+#ifdef OSSL_SANITIZE_MEMORY
+            /*
+             * In a memory sanitiser build, the changes to memory made by the
+             * system call aren't reliably detected.  By initialising the
+             * memory here, the sanitiser is told that they are okay.
+             */
+            memset(events, 0, sizeof(events));
+#endif
+
             /* Get results of AIO read */
             r = io_getevents(aio->aio_ctx, 1, MAX_INFLIGHTS,
                              events, &timeout);
diff --git a/test/afalgtest.c b/test/afalgtest.c
index 6e6bbd5530..1177ceaf8e 100644
--- a/test/afalgtest.c
+++ b/test/afalgtest.c
@@ -48,27 +48,39 @@ static int test_afalg_aes_cbc(int keysize_idx)
 {
     EVP_CIPHER_CTX *ctx;
     const EVP_CIPHER *cipher;
-    unsigned char key[] = "\x06\xa9\x21\x40\x36\xb8\xa1\x5b"
-                          "\x51\x2e\x03\xd5\x34\x12\x00\x06"
-                          "\x06\xa9\x21\x40\x36\xb8\xa1\x5b"
-                          "\x51\x2e\x03\xd5\x34\x12\x00\x06";
-    unsigned char iv[] = "\x3d\xaf\xba\x42\x9d\x9e\xb4\x30"
-                         "\xb4\x22\xda\x80\x2c\x9f\xac\x41";
-    /* input = "Single block msg\n"  17Bytes*/
-    unsigned char in[BUFFER_SIZE] = "\x53\x69\x6e\x67\x6c\x65\x20\x62"
-                                    "\x6c\x6f\x63\x6b\x20\x6d\x73\x67\x0a";
     unsigned char ebuf[BUFFER_SIZE + 32];
     unsigned char dbuf[BUFFER_SIZE + 32];
-    unsigned char encresult_128[] = "\xe3\x53\x77\x9c\x10\x79\xae\xb8"
-                                    "\x27\x08\x94\x2d\xbe\x77\x18\x1a\x2d";
-    unsigned char encresult_192[] = "\xf7\xe4\x26\xd1\xd5\x4f\x8f\x39"
-                                    "\xb1\x9e\xe0\xdf\x61\xb9\xc2\x55\xeb";
-    unsigned char encresult_256[] = "\xa0\x76\x85\xfd\xc1\x65\x71\x9d"
-                                    "\xc7\xe9\x13\x6e\xae\x55\x49\xb4\x13";
-    unsigned char *enc_result = NULL;
-
+    const unsigned char *enc_result = NULL;
     int encl, encf, decl, decf;
     int ret = 0;
+    static const unsigned char key[] =
+        "\x06\xa9\x21\x40\x36\xb8\xa1\x5b\x51\x2e\x03\xd5\x34\x12\x00\x06"
+        "\x06\xa9\x21\x40\x36\xb8\xa1\x5b\x51\x2e\x03\xd5\x34\x12\x00\x06";
+    static const unsigned char iv[] =
+        "\x3d\xaf\xba\x42\x9d\x9e\xb4\x30\xb4\x22\xda\x80\x2c\x9f\xac\x41";
+    /* input = "Single block msg\n" 17 Bytes*/
+    static const unsigned char in[BUFFER_SIZE] =
+        "\x53\x69\x6e\x67\x6c\x65\x20\x62\x6c\x6f\x63\x6b\x20\x6d\x73\x67"
+        "\x0a";
+    static const unsigned char encresult_128[BUFFER_SIZE] =
+        "\xe3\x53\x77\x9c\x10\x79\xae\xb8\x27\x08\x94\x2d\xbe\x77\x18\x1a"
+        "\x2d";
+    static const unsigned char encresult_192[BUFFER_SIZE] =
+        "\xf7\xe4\x26\xd1\xd5\x4f\x8f\x39\xb1\x9e\xe0\xdf\x61\xb9\xc2\x55"
+        "\xeb";
+    static const unsigned char encresult_256[BUFFER_SIZE] =
+        "\xa0\x76\x85\xfd\xc1\x65\x71\x9d\xc7\xe9\x13\x6e\xae\x55\x49\xb4"
+        "\x13";
+
+#ifdef OSSL_SANITIZE_MEMORY
+    /*
+     * Initialise the encryption & decryption buffers to pacify the memory
+     * sanitiser.  The sanitiser doesn't know that this memory is modified
+     * by the engine, this tells it that all is good.
+     */
+    OPENSSL_cleanse(ebuf, sizeof(ebuf));
+    OPENSSL_cleanse(dbuf, sizeof(dbuf));
+#endif
 
     switch (keysize_idx) {
         case 0:
@@ -91,7 +103,7 @@ static int test_afalg_aes_cbc(int keysize_idx)
 
     if (!TEST_true(EVP_CipherInit_ex(ctx, cipher, e, key, iv, 1))
             || !TEST_true(EVP_CipherUpdate(ctx, ebuf, &encl, in, BUFFER_SIZE))
-            || !TEST_true(EVP_CipherFinal_ex(ctx, ebuf+encl, &encf)))
+            || !TEST_true(EVP_CipherFinal_ex(ctx, ebuf + encl, &encf)))
         goto end;
     encl += encf;
 
@@ -101,7 +113,7 @@ static int test_afalg_aes_cbc(int keysize_idx)
     if (!TEST_true(EVP_CIPHER_CTX_reset(ctx))
             || !TEST_true(EVP_CipherInit_ex(ctx, cipher, e, key, iv, 0))
             || !TEST_true(EVP_CipherUpdate(ctx, dbuf, &decl, ebuf, encl))
-            || !TEST_true(EVP_CipherFinal_ex(ctx, dbuf+decl, &decf)))
+            || !TEST_true(EVP_CipherFinal_ex(ctx, dbuf + decl, &decf)))
         goto end;
     decl += decf;
 


More information about the openssl-commits mailing list