From: Pauli <pauli@openssl.org>
Date: Mon, 13 Dec 2021 01:16:18 +0000 (+1100)
Subject: evp: address a use after free state when using HMAC and MD copy.
X-Git-Tag: openssl-3.2.0-alpha1~3188
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ad2fcee1632d3f21a37e8e108d4c0dcf9099686d;p=thirdparty%2Fopenssl.git

evp: address a use after free state when using HMAC and MD copy.

Fixes #17261

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17263)
---

diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c
index 7ebb2e32352..322cfe76461 100644
--- a/crypto/evp/digest.c
+++ b/crypto/evp/digest.c
@@ -521,7 +521,7 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
         if (out->fetched_digest != NULL)
             EVP_MD_free(out->fetched_digest);
         *out = *in;
-        return 1;
+        goto clone_pkey;
     }
 
     if (in->digest->prov == NULL
@@ -552,6 +552,7 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in)
         }
     }
 
+ clone_pkey:
     /* copied EVP_MD_CTX should free the copied EVP_PKEY_CTX */
     EVP_MD_CTX_clear_flags(out, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX);
 #ifndef FIPS_MODULE