[openssl-dev] [openssl.org #3754] [OpenSSL bug-report] if malloc failed on EVP_PKEY_new_mac_key() ?

[장영휘 via RT]

[bug-report]

Hi, I am openssl-user Jang Young-Hwi.

My webwerver uses OpenSSL-1.0.1h, and downed with core dump.
The core dump occurs when the pkey is NULL. (if malloc() failed)

I think that the exception code is required..

Below..
========== [core dump]
...
Program terminated with signal 11, Segmentation fault.
SEGV_MAPERR - Address not mapped to object
#0  EVP_PKEY_assign () at p_lib.c:267
267     p_lib.c: No such file or directory.
        in p_lib.c
(gdb) where
#0  EVP_PKEY_assign () at p_lib.c:267
#1  0x400000000051a820:0 in pkey_hmac_keygen () at hm_pmeth.c:132
#2  0x400000000044d830:0 in EVP_PKEY_new_mac_key () at pmeth_gn.c:156
#3  0x400000000031fdc0:0 in tls1_change_cipher_state () at t1_enc.c:500
#4  0x400000000037b6e0:0 in ssl3_do_change_cipher_spec () at s3_pkt.c:1473
#5  0x4000000000379bb0:0 in ssl3_read_bytes () at s3_pkt.c:1334
#6  0x400000000037dbc0:0 in ssl3_get_message () at s3_both.c:457
#7  0x4000000000367130:0 in ssl3_get_cert_verify () at s3_srvr.c:2917
#8  0x400000000035ce90:0 in ssl3_accept () at s3_srvr.c:678
#9  0x400000000032d2e0:0 in SSL_accept () at ssl_lib.c:940 </verbatim>
========== [source 0]
#0  EVP_PKEY_assign () at p_lib.c:267
  263 int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key)
  264         {
  265         if (!EVP_PKEY_set_type(pkey, type))
  266                 return 0;
  267         pkey->pkey.ptr=key;  /* if pkey is NULL?? */
  268         return (key != NULL);
  269         }
========== [source 1]
#1  0x400000000051a820:0 in pkey_hmac_keygen () at hm_pmeth.c:132
  128 static int pkey_hmac_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
  129         {
  130         ASN1_OCTET_STRING *hkey = NULL;
  131         HMAC_PKEY_CTX *hctx = ctx->data;
  132         if (!hctx->ktmp.data)
  133                 return 0;
  134         hkey = ASN1_OCTET_STRING_dup(&hctx->ktmp);
  135         if (!hkey)
  136                 return 0;
  137         EVP_PKEY_assign(pkey, EVP_PKEY_HMAC, hkey);
  138
  139         return 1;
  140         }
========== [source 2]
#2  0x400000000044d830:0 in EVP_PKEY_new_mac_key () at pmeth_gn.c:156
  134 int EVP_PKEY_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY **ppkey)
  135         {
  136         int ret;
  137
  138         if (!ctx || !ctx->pmeth || !ctx->pmeth->keygen)
  139                 {
  140                 EVPerr(EVP_F_EVP_PKEY_KEYGEN,
  141
EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
  142                 return -2;
  143                 }
  144         if (ctx->operation != EVP_PKEY_OP_KEYGEN)
  145                 {
  146                 EVPerr(EVP_F_EVP_PKEY_KEYGEN,
EVP_R_OPERATON_NOT_INITIALIZED);
  147                 return -1;
  148                 }
  149
  150         if (!ppkey)
  151                 return -1;
  152
  153         if (!*ppkey)
  154                 *ppkey = EVP_PKEY_new(); /* ==> if *ppkey is NULL?? */
  155
  156         ret = ctx->pmeth->keygen(ctx, *ppkey);
  157         if (ret <= 0)
  158                 {
  159                 EVP_PKEY_free(*ppkey);
  160                 *ppkey = NULL;
  161                 }
  162         return ret;
  163         }
==========


Thanks..

I always appreciate you..