From 7eae6ee0e503b0961d4f2e75baac981f2766b892 Mon Sep 17 00:00:00 2001 From: Neil Horman Date: Wed, 22 Nov 2023 14:20:39 -0500 Subject: [PATCH] Add locking to CRYPTO_secure_used Coverity issue 1551719 noted CRYPTO_secure_used referenced a shared variable without taking the appropriate read lock. Add that. Reviewed-by: Tomas Mraz Reviewed-by: Todd Short (Merged from https://github.com/openssl/openssl/pull/22802) --- crypto/mem_sec.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/crypto/mem_sec.c b/crypto/mem_sec.c index 557c697c9aa..269c7dcb6d4 100644 --- a/crypto/mem_sec.c +++ b/crypto/mem_sec.c @@ -260,11 +260,17 @@ int CRYPTO_secure_allocated(const void *ptr) size_t CRYPTO_secure_used(void) { + size_t ret = 0; + #ifndef OPENSSL_NO_SECURE_MEMORY - return secure_mem_used; -#else - return 0; + if (!CRYPTO_THREAD_read_lock(sec_malloc_lock)) + return 0; + + ret = secure_mem_used; + + CRYPTO_THREAD_unlock(sec_malloc_lock); #endif /* OPENSSL_NO_SECURE_MEMORY */ + return ret; } size_t CRYPTO_secure_actual_size(void *ptr) -- 2.47.2