Commit 9b25268
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -82,7 +82,7 @@ using EVPKeyCtxPointer = DeleteFnPtr<EVP_PKEY_CTX, EVP_PKEY_CTX_free>; | |||
| 82 | 82 | using EVPMDPointer = DeleteFnPtr<EVP_MD_CTX, EVP_MD_CTX_free>; | |
| 83 | 83 | using RSAPointer = DeleteFnPtr<RSA, RSA_free>; | |
| 84 | 84 | using ECPointer = DeleteFnPtr<EC_KEY, EC_KEY_free>; | |
| 85 | - using BignumPointer = DeleteFnPtr<BIGNUM, BN_free>; | ||
| 85 | + using BignumPointer = DeleteFnPtr<BIGNUM, BN_clear_free>; | ||
| 86 | 86 | using NetscapeSPKIPointer = DeleteFnPtr<NETSCAPE_SPKI, NETSCAPE_SPKI_free>; | |
| 87 | 87 | using ECGroupPointer = DeleteFnPtr<EC_GROUP, EC_GROUP_free>; | |
| 88 | 88 | using ECPointPointer = DeleteFnPtr<EC_POINT, EC_POINT_free>; | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -2,6 +2,7 @@ | |||
| 2 | 2 | #include "async_wrap-inl.h" | |
| 3 | 3 | #include "base_object-inl.h" | |
| 4 | 4 | #include "crypto/crypto_keys.h" | |
| 5 | + #include "crypto/crypto_util.h" | ||
| 5 | 6 | #include "env-inl.h" | |
| 6 | 7 | #include "memory_tracker-inl.h" | |
| 7 | 8 | #include "threadpoolwork-inl.h" | |
@@ -162,13 +163,11 @@ bool DiffieHellman::Init(const char* p, int p_len, int g) { | |||
| 162 | 163 | DH_R_BAD_GENERATOR, __FILE__, __LINE__); | |
| 163 | 164 | return false; | |
| 164 | 165 | } | |
| 165 | - BIGNUM* bn_p = | ||
| 166 | - BN_bin2bn(reinterpret_cast<const unsigned char*>(p), p_len, nullptr); | ||
| 167 | - BIGNUM* bn_g = BN_new(); | ||
| 168 | - if (!BN_set_word(bn_g, g) || | ||
| 169 | - !DH_set0_pqg(dh_.get(), bn_p, nullptr, bn_g)) { | ||
| 170 | - BN_free(bn_p); | ||
| 171 | - BN_free(bn_g); | ||
| 166 | + BignumPointer bn_p( | ||
| 167 | + BN_bin2bn(reinterpret_cast<const unsigned char*>(p), p_len, nullptr)); | ||
| 168 | + BignumPointer bn_g(BN_new()); | ||
| 169 | + if (bn_p == nullptr || bn_g == nullptr || !BN_set_word(bn_g.get(), g) || | ||
| 170 | + !DH_set0_pqg(dh_.get(), bn_p.release(), nullptr, bn_g.release())) { | ||
| 172 | 171 | return false; | |
| 173 | 172 | } | |
| 174 | 173 | return VerifyContext(); | |
@@ -186,21 +185,23 @@ bool DiffieHellman::Init(const char* p, int p_len, const char* g, int g_len) { | |||
| 186 | 185 | DH_R_BAD_GENERATOR, __FILE__, __LINE__); | |
| 187 | 186 | return false; | |
| 188 | 187 | } | |
| 189 | - BIGNUM* bn_g = | ||
| 190 | - BN_bin2bn(reinterpret_cast<const unsigned char*>(g), g_len, nullptr); | ||
| 191 | - if (BN_is_zero(bn_g) || BN_is_one(bn_g)) { | ||
| 192 | - BN_free(bn_g); | ||
| 188 | + BignumPointer bn_g( | ||
| 189 | + BN_bin2bn(reinterpret_cast<const unsigned char*>(g), g_len, nullptr)); | ||
| 190 | + if (BN_is_zero(bn_g.get()) || BN_is_one(bn_g.get())) { | ||
| 193 | 191 | ERR_put_error(ERR_LIB_DH, DH_F_DH_BUILTIN_GENPARAMS, | |
| 194 | 192 | DH_R_BAD_GENERATOR, __FILE__, __LINE__); | |
| 195 | 193 | return false; | |
| 196 | 194 | } | |
| 197 | - BIGNUM* bn_p = | ||
| 198 | - BN_bin2bn(reinterpret_cast<const unsigned char*>(p), p_len, nullptr); | ||
| 199 | - if (!DH_set0_pqg(dh_.get(), bn_p, nullptr, bn_g)) { | ||
| 200 | - BN_free(bn_p); | ||
| 201 | - BN_free(bn_g); | ||
| 195 | + BignumPointer bn_p( | ||
| 196 | + BN_bin2bn(reinterpret_cast<const unsigned char*>(p), p_len, nullptr)); | ||
| 197 | + if (!DH_set0_pqg(dh_.get(), bn_p.get(), nullptr, bn_g.get())) { | ||
| 202 | 198 | return false; | |
| 203 | 199 | } | |
| 200 | + // The DH_set0_pqg call above takes ownership of the bignums on success, | ||
| 201 | + // so we should release them here so we don't end with a possible | ||
| 202 | + // use-after-free or double free. | ||
| 203 | + bn_p.release(); | ||
| 204 | + bn_g.release(); | ||
| 204 | 205 | return VerifyContext(); | |
| 205 | 206 | } | |
| 206 | 207 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -65,7 +65,7 @@ using EVPKeyCtxPointer = DeleteFnPtr<EVP_PKEY_CTX, EVP_PKEY_CTX_free>; | |||
| 65 | 65 | using EVPMDPointer = DeleteFnPtr<EVP_MD_CTX, EVP_MD_CTX_free>; | |
| 66 | 66 | using RSAPointer = DeleteFnPtr<RSA, RSA_free>; | |
| 67 | 67 | using ECPointer = DeleteFnPtr<EC_KEY, EC_KEY_free>; | |
| 68 | - using BignumPointer = DeleteFnPtr<BIGNUM, BN_free>; | ||
| 68 | + using BignumPointer = DeleteFnPtr<BIGNUM, BN_clear_free>; | ||
| 69 | 69 | using BignumCtxPointer = DeleteFnPtr<BN_CTX, BN_CTX_free>; | |
| 70 | 70 | using NetscapeSPKIPointer = DeleteFnPtr<NETSCAPE_SPKI, NETSCAPE_SPKI_free>; | |
| 71 | 71 | using ECGroupPointer = DeleteFnPtr<EC_GROUP, EC_GROUP_free>; | |
0 commit comments