From 389728876b51de0df9f97b6a295948ebec1e0f0c Mon Sep 17 00:00:00 2001 From: Neil Horman Date: Wed, 13 Aug 2025 14:27:34 -0400 Subject: [PATCH] set SSLfatal if tls1_set_shared_sigalgs has a malloc failure MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Detected another memfail failure https://github.com/openssl/openssl/actions/runs/16926186604/job/47962169870 Tracking it back, it occurs because tls1_set_server_sigalgs attempts to preform an allocation, and in the event of failure, returns 0 without setting SSLfatal, like the other failure paths in this function do when returning 0, which translates to a return of WORK_ERROR higher up the stack The result is that on the next call to check_fatal in read_state_machine, we fail the assert when deubg is enabled (as it is in the coverage tests). Fix it by calling SSLfatal when the call to OPENSSL_calloc fails in this function. Reviewed-by: Saša Nedvědický Reviewed-by: Kurt Roeckx Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/28250) --- ssl/t1_lib.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index aa41a341ac1..e556bff2631 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -2960,8 +2960,10 @@ int tls1_set_server_sigalgs(SSL_CONNECTION *s) memset(s->s3.tmp.valid_flags, 0, s->ssl_pkey_num * sizeof(uint32_t)); else s->s3.tmp.valid_flags = OPENSSL_calloc(s->ssl_pkey_num, sizeof(uint32_t)); - if (s->s3.tmp.valid_flags == NULL) + if (s->s3.tmp.valid_flags == NULL) { + SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR); return 0; + } /* * If peer sent no signature algorithms check to see if we support * the default algorithm for each certificate type -- 2.47.3