[openssl/openssl] e50931: Only free the read buffers if we're not using them

[Matt Caswell]

  Branch: refs/heads/openssl-3.3
  Home:   https://github.com/openssl/openssl
  Commit: e5093133c35ca82874ad83697af76f4b0f7e3bd8
      https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8
  Author: Matt Caswell <matt at openssl.org>
  Date:   2024-05-28 (Tue, 28 May 2024)

  Changed paths:
    M ssl/record/methods/tls_common.c

  Log Message:
  -----------
  Only free the read buffers if we're not using them

If we're part way through processing a record, or the application has
not released all the records then we should not free our buffer because
they are still needed.

CVE-2024-4741

Reviewed-by: Tomas Mraz <tomas at openssl.org>
Reviewed-by: Neil Horman <nhorman at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24395)

(cherry picked from commit 38690cab18de88198f46478565fab423cf534efa)


  Commit: d9dd9afc9354e739954f55db85af7401ec9ca6ba
      https://github.com/openssl/openssl/commit/d9dd9afc9354e739954f55db85af7401ec9ca6ba
  Author: Matt Caswell <matt at openssl.org>
  Date:   2024-05-28 (Tue, 28 May 2024)

  Changed paths:
    M ssl/record/methods/tls_common.c

  Log Message:
  -----------
  Set rl->packet to NULL after we've finished using it

In order to ensure we do not have a UAF we reset the rl->packet pointer
to NULL after we free it.

Follow on from CVE-2024-4741

Reviewed-by: Tomas Mraz <tomas at openssl.org>
Reviewed-by: Neil Horman <nhorman at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24395)

(cherry picked from commit bfb8128190632092b3a66465838b87b469455cec)


  Commit: 84e02300f343ac783d00b3c7f507416e45767900
      https://github.com/openssl/openssl/commit/84e02300f343ac783d00b3c7f507416e45767900
  Author: Matt Caswell <matt at openssl.org>
  Date:   2024-05-28 (Tue, 28 May 2024)

  Changed paths:
    M test/sslbuffertest.c

  Log Message:
  -----------
  Extend the SSL_free_buffers testing

Test that attempting to free the buffers at points where they should not
be freed works as expected.

Follow on from CVE-2024-4741

Reviewed-by: Tomas Mraz <tomas at openssl.org>
Reviewed-by: Neil Horman <nhorman at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24395)

(cherry picked from commit 566f3069169b9fab4fbb23da98c3c91730dd5209)


  Commit: 359b18de5b034fae1f876049875b6fdad002bc5f
      https://github.com/openssl/openssl/commit/359b18de5b034fae1f876049875b6fdad002bc5f
  Author: Matt Caswell <matt at openssl.org>
  Date:   2024-05-28 (Tue, 28 May 2024)

  Changed paths:
    M test/helpers/ssltestlib.c
    M test/helpers/ssltestlib.h
    M test/sslapitest.c

  Log Message:
  -----------
  Move the ability to load the dasync engine into ssltestlib.c

The sslapitest has a helper function to load the dasync engine which is
useful for testing pipelining. We would like to have the same facility
from sslbuffertest, so we move the function to the common location
ssltestlib.c

Follow on from CVE-2024-4741

Reviewed-by: Tomas Mraz <tomas at openssl.org>
Reviewed-by: Neil Horman <nhorman at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24395)

(cherry picked from commit 05752478df623a9ddf849f897b630c1e0728cb7c)


  Commit: 9c5ccb6c950989c42bc0426cd86f35fea308a525
      https://github.com/openssl/openssl/commit/9c5ccb6c950989c42bc0426cd86f35fea308a525
  Author: Matt Caswell <matt at openssl.org>
  Date:   2024-05-28 (Tue, 28 May 2024)

  Changed paths:
    M test/sslbuffertest.c

  Log Message:
  -----------
  Further extend the SSL_free_buffers testing

We extend the testing to test what happens when pipelining is in use.

Follow on from CVE-2024-4741

Reviewed-by: Tomas Mraz <tomas at openssl.org>
Reviewed-by: Neil Horman <nhorman at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24395)

(cherry picked from commit c1bd38a003fa19fd0d8ade85e1bbc20d8ae59dab)


Compare: https://github.com/openssl/openssl/compare/f84622c7e7f8...9c5ccb6c9509

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications