From: Tomas Mraz <tomas@openssl.org>
Date: Thu, 16 Dec 2021 15:24:44 +0000 (+0100)
Subject: ossl_provider_add_to_store: Avoid use-after-free
X-Git-Tag: openssl-3.2.0-alpha1~3183
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=33df7cbe5e38feb0cf962386bcac061c3743ecf2;p=thirdparty%2Fopenssl.git

ossl_provider_add_to_store: Avoid use-after-free

Avoid freeing a provider that was not up-ref-ed before.

Fixes #17292

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17295)
---

diff --git a/crypto/provider_core.c b/crypto/provider_core.c
index 1d5787a6482..e04734c12e3 100644
--- a/crypto/provider_core.c
+++ b/crypto/provider_core.c
@@ -602,6 +602,9 @@ int ossl_provider_add_to_store(OSSL_PROVIDER *prov, OSSL_PROVIDER **actualprov,
     OSSL_PROVIDER tmpl = { 0, };
     OSSL_PROVIDER *actualtmp = NULL;
 
+    if (actualprov != NULL)
+        *actualprov = NULL;
+
     if ((store = get_provider_store(prov->libctx)) == NULL)
         return 0;
 
@@ -658,7 +661,7 @@ int ossl_provider_add_to_store(OSSL_PROVIDER *prov, OSSL_PROVIDER **actualprov,
  err:
     CRYPTO_THREAD_unlock(store->lock);
     if (actualprov != NULL)
-        ossl_provider_free(actualtmp);
+        ossl_provider_free(*actualprov);
     return 0;
 }