From 9ed90fd44cc1b8039d82610d90f56275d519c204 Mon Sep 17 00:00:00 2001 From: Norbert Pocs Date: Wed, 28 May 2025 22:12:06 +0200 Subject: [PATCH] sslapitest: Add failing test for quic double free The double free happened on the EVP_MD object, when we used external quic implementation. This test makes the yield secret callback fail, to make the kdfdigest free path happen. Signed-off-by: Norbert Pocs Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/27713) --- test/sslapitest.c | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/test/sslapitest.c b/test/sslapitest.c index 3c13e4e876b..207382e38b3 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -12763,6 +12763,22 @@ static int yield_secret_cb(SSL *s, uint32_t prot_level, int direction, return 0; } +static int yield_secret_cb_fail(SSL *s, uint32_t prot_level, int direction, + const unsigned char *secret, size_t secret_len, + void *arg) +{ + (void)s; + (void)prot_level; + (void)direction; + (void)secret; + (void)secret_len; + (void)arg; + /* + * This callback is to test double free in quic tls + */ + return 0; +} + static int got_transport_params_cb(SSL *s, const unsigned char *params, size_t params_len, void *arg) @@ -12803,13 +12819,14 @@ static int alert_cb(SSL *s, unsigned char alert_code, void *arg) * Test 0: Normal run * Test 1: Force a failure * Test 3: Use a CCM based ciphersuite + * Test 4: fail yield_secret_cb to see double free */ static int test_quic_tls(int idx) { SSL_CTX *sctx = NULL, *cctx = NULL; SSL *serverssl = NULL, *clientssl = NULL; int testresult = 0; - const OSSL_DISPATCH qtdis[] = { + OSSL_DISPATCH qtdis[] = { {OSSL_FUNC_SSL_QUIC_TLS_CRYPTO_SEND, (void (*)(void))crypto_send_cb}, {OSSL_FUNC_SSL_QUIC_TLS_CRYPTO_RECV_RCD, (void (*)(void))crypto_recv_rcd_cb}, @@ -12831,6 +12848,9 @@ static int test_quic_tls(int idx) }; int i; + if (idx == 4) + qtdis[3].function = (void (*)(void))yield_secret_cb_fail; + memset(&sdata, 0, sizeof(sdata)); memset(&cdata, 0, sizeof(cdata)); sdata.peer = &cdata; @@ -12869,7 +12889,7 @@ static int test_quic_tls(int idx) sizeof(sparams)))) goto end; - if (idx != 1) { + if (idx != 1 && idx != 4) { if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE))) goto end; } else { @@ -13409,7 +13429,7 @@ int setup_tests(void) #endif ADD_ALL_TESTS(test_alpn, 4); #if !defined(OSSL_NO_USABLE_TLS1_3) - ADD_ALL_TESTS(test_quic_tls, 3); + ADD_ALL_TESTS(test_quic_tls, 5); ADD_TEST(test_quic_tls_early_data); #endif return 1; -- 2.47.2