From: Matt Caswell <matt@openssl.org>
Date: Tue, 13 Dec 2022 14:54:55 +0000 (+0000)
Subject: Avoid dangling ptrs in header and data params for PEM_read_bio_ex
X-Git-Tag: openssl-3.2.0-alpha1~1338
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ee6243f3947107d655f6dee96f63861561a5aaeb;p=thirdparty%2Fopenssl.git

Avoid dangling ptrs in header and data params for PEM_read_bio_ex

In the event of a failure in PEM_read_bio_ex() we free the buffers we
allocated for the header and data buffers. However we were not clearing
the ptrs stored in *header and *data. Since, on success, the caller is
responsible for freeing these ptrs this can potentially lead to a double
free if the caller frees them even on failure.

Thanks to Dawei Wang for reporting this issue.

Based on a proposed patch by Kurt Roeckx.

CVE-2022-4450

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
---

diff --git a/crypto/pem/pem_lib.c b/crypto/pem/pem_lib.c
index 4035ac64e67..f7a1bd83021 100644
--- a/crypto/pem/pem_lib.c
+++ b/crypto/pem/pem_lib.c
@@ -995,7 +995,9 @@ int PEM_read_bio_ex(BIO *bp, char **name_out, char **header,
 
 out_free:
     PEM_FREE(*header, flags, 0);
+    *header = NULL;
     PEM_FREE(*data, flags, 0);
+    *data = NULL;
 end:
     EVP_ENCODE_CTX_free(ctx);
     PEM_FREE(name, flags, 0);