mmo-ref/dep-openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

crypto/evp: fix double free of tmp_keymgmt in sig/kem/asym init

Browse source 
Commit ecb4757b37 "crypto/evp/m_sigver.c: fix potential double free
on error path in do_sigver_init" has fixed double-free of tmp_keymgmt
in do_sigver_init() by setting it to NULL after EVP_KEYMGMT_free() call;
the same issue present in evp_kem_init(), evp_pkey_asym_cipher_init(),
and evp_pkey_signature_init().  Address it similarly, by setting
the pointers to NULL after *_free() calls.

Complements: ecb4757b37 "crypto/evp/m_sigver.c: fix potential double free on error path in do_sigver_init"
Fixes: 839ffdd11c "EVP: Allow a fallback for operations that work with an EVP_PKEY"
CLA: trivial

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun May 31 11:03:15 2026
(Merged from https://github.com/openssl/openssl/pull/31312)
This commit is contained in:
rootvector2 2026-05-27 23:44:23 +05:30 • committed by Eugene Syromiatnikov
parent 31d61a1ceb
commit a21f77dbc9
3 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
crypto/evp/asymcipher.c
View file

@ -102,7 +102,9 @@ static int evp_pkey_asym_cipher_init(EVP_PKEY_CTX *ctx, int operation,
* iteration we're on.
*/
EVP_ASYM_CIPHER_free(cipher);
cipher = NULL;
EVP_KEYMGMT_free(tmp_keymgmt);
tmp_keymgmt = NULL;
switch (iter) {
case 1:

2
crypto/evp/kem.c
View file

@ -97,7 +97,9 @@ static int evp_kem_init(EVP_PKEY_CTX *ctx, int operation,
* iteration we're on.
*/
EVP_KEM_free(kem);
kem = NULL;
EVP_KEYMGMT_free(tmp_keymgmt);
tmp_keymgmt = NULL;
switch (iter) {
case 1:

2
crypto/evp/signature.c
View file

@ -736,7 +736,9 @@ static int evp_pkey_signature_init(EVP_PKEY_CTX *ctx, EVP_SIGNATURE *signature,
* iteration we're on.
*/
EVP_SIGNATURE_free(signature);
signature = NULL;
EVP_KEYMGMT_free(tmp_keymgmt);
tmp_keymgmt = NULL;
switch (iter) {
case 1: