crypto: fix potential null pointer dereference when BIO_meth_new() fails · nodejs/node@3337b09 · GitHub

nodejs / node Public

• Notifications You must be signed in to change notification settings
• Fork 36.6k
• Star 120k

• Code
• Issues 635
• Pull requests 751
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit 3337b09

Browse filesBrowse the repository at this point in the historyBrowse files

ndossche

authored and

aduh95

committed

crypto: fix potential null pointer dereference when BIO_meth_new() fails

This function can return null, which will make the calls to BIO_meth_set_* trigger a null deref. Even after fixing this, there is an issue with the `BIOPointer::New(GetMethod())` call in `NodeBIO::New` because the `New` method cannot handle a null pointer despite other code already guarding for this (e.g. the `NodeBIO::New` function already checks `bio`). This patch solves the issues by adding more null checks. PR-URL: #61788 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

1 parent 46a6192 commit 3337b09
Copy full SHA for 3337b09

2 files changed

+2Lines changed: 2 additions & 0 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• deps/ncrypto
  • ncrypto.cc
• src/crypto
  • crypto_bio.cc

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎deps/ncrypto/ncrypto.cc‎

Copy file name to clipboardExpand all lines: deps/ncrypto/ncrypto.cc

+1Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -1470,6 +1470,7 @@ BIOPointer BIOPointer::NewSecMem() {
1470	1470	}
1471	1471
1472	1472	BIOPointer BIOPointer::New(const BIO_METHOD* method) {
	1473	+ if (method == nullptr) return {};
1473	1474	return BIOPointer(BIO_new(method));
1474	1475	}
1475	1476

Collapse file

‎src/crypto/crypto_bio.cc‎

Copy file name to clipboardExpand all lines: src/crypto/crypto_bio.cc

+1Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -226,6 +226,7 @@ const BIO_METHOD* NodeBIO::GetMethod() {
226	226	// Static initialization ensures that this is safe to use concurrently.
227	227	static const BIO_METHOD* method = [&]() {
228	228	BIO_METHOD* method = BIO_meth_new(BIO_TYPE_MEM, "node.js SSL buffer");
	229	+ CHECK_NOT_NULL(method);
229	230	BIO_meth_set_write(method, Write);
230	231	BIO_meth_set_read(method, Read);
231	232	BIO_meth_set_puts(method, Puts);

0 commit comments

Comments

0 (0)