From: Matt Caswell Date: Fri, 14 May 2021 14:33:40 +0000 (+0100) Subject: Fix a use-after-free in the child provider code X-Git-Tag: openssl-3.0.0-alpha17~82 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a227ff336fc934b4a52c4659ae423dfa10efd5f3;p=thirdparty%2Fopenssl.git Fix a use-after-free in the child provider code If the child provider context data gets cleaned up before all usage of providers has finished then a use-after-free can occur. We change the priority of this data so that it gets freed later. Fixes #15284 Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/15286) --- diff --git a/crypto/provider_child.c b/crypto/provider_child.c index 2487d43fd7a..14d00546241 100644 --- a/crypto/provider_child.c +++ b/crypto/provider_child.c @@ -47,7 +47,7 @@ static void child_prov_ossl_ctx_free(void *vgbl) } static const OSSL_LIB_CTX_METHOD child_prov_ossl_ctx_method = { - OSSL_LIB_CTX_METHOD_DEFAULT_PRIORITY, + OSSL_LIB_CTX_METHOD_LOW_PRIORITY, child_prov_ossl_ctx_new, child_prov_ossl_ctx_free, }; diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h index d943419a52d..966c8f26f18 100644 --- a/include/internal/cryptlib.h +++ b/include/internal/cryptlib.h @@ -168,6 +168,7 @@ typedef struct ossl_ex_data_global_st { # define OSSL_LIB_CTX_CHILD_PROVIDER_INDEX 18 # define OSSL_LIB_CTX_MAX_INDEXES 19 +# define OSSL_LIB_CTX_METHOD_LOW_PRIORITY -1 # define OSSL_LIB_CTX_METHOD_DEFAULT_PRIORITY 0 # define OSSL_LIB_CTX_METHOD_PRIORITY_1 1 # define OSSL_LIB_CTX_METHOD_PRIORITY_2 2