{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/4221","labels_url":"https://api.github.com/repos/nodejs/node/issues/4221/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/4221/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/4221/events","html_url":"https://github.com/nodejs/node/issues/4221","id":121356665,"number":4221,"title":"errors in native modules that use openssl prevent hashes from being created","user":{"login":"calvinmetcalf","id":1128607,"avatar_url":"https://avatars.githubusercontent.com/u/1128607?v=3","gravatar_id":"","url":"https://api.github.com/users/calvinmetcalf","html_url":"https://github.com/calvinmetcalf","followers_url":"https://api.github.com/users/calvinmetcalf/followers","following_url":"https://api.github.com/users/calvinmetcalf/following{/other_user}","gists_url":"https://api.github.com/users/calvinmetcalf/gists{/gist_id}","starred_url":"https://api.github.com/users/calvinmetcalf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calvinmetcalf/subscriptions","organizations_url":"https://api.github.com/users/calvinmetcalf/orgs","repos_url":"https://api.github.com/users/calvinmetcalf/repos","events_url":"https://api.github.com/users/calvinmetcalf/events{/privacy}","received_events_url":"https://api.github.com/users/calvinmetcalf/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/openssl","name":"openssl","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-12-09T22:34:56Z","updated_at":"2016-01-15T20:36:22Z","closed_at":null,"body":"There is a small regression in 5.1.0, that comes up in some edge cases that I might have been the only one using (and have fixed in my code).  If\r\n\r\n1. you have a c module that is using openssl (like [raw-ecdsa](https://github.com/indutny/raw-ecdsa)).\r\n2. if that module has an error (like in raw-ecdsa where it tries a couple different ways to parse a key in order).\r\n3. and does not clear the error stack\r\n\r\nthen due to the addition of [this line](https://github.com/nodejs/node/pull/3753/files#diff-801e3948990f4965a8ea4aca4a423864R3538) running crypto.createHash with throw an error."},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/172086307","html_url":"https://github.com/nodejs/node/issues/4221#issuecomment-172086307","issue_url":"https://api.github.com/repos/nodejs/node/issues/4221","id":172086307,"user":{"login":"ncopa","id":66357,"avatar_url":"https://avatars.githubusercontent.com/u/66357?v=3","gravatar_id":"","url":"https://api.github.com/users/ncopa","html_url":"https://github.com/ncopa","followers_url":"https://api.github.com/users/ncopa/followers","following_url":"https://api.github.com/users/ncopa/following{/other_user}","gists_url":"https://api.github.com/users/ncopa/gists{/gist_id}","starred_url":"https://api.github.com/users/ncopa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ncopa/subscriptions","organizations_url":"https://api.github.com/users/ncopa/orgs","repos_url":"https://api.github.com/users/ncopa/repos","events_url":"https://api.github.com/users/ncopa/events{/privacy}","received_events_url":"https://api.github.com/users/ncopa/received_events","type":"User","site_admin":false},"created_at":"2016-01-15T20:36:22Z","updated_at":"2016-01-15T20:36:22Z","body":"If you wonder why it fails on alpine system openssl and not on any other, then the reason is this patch: http://git.alpinelinux.org/cgit/aports/tree/main/openssl/1004-crypto-engine-autoload-padlock-dynamic-engine.patch\r\n\r\nIt tries to load padlock crypto engine (used on via cpu), which will give you an awesome performance on those VIA cpu boxes. But apparently it does save an error on the error stack when no padlock hardware exists. (So the error should not happen on the VIA cpu.)\r\n\r\nWe discussed this morning if we should clear the error stack in case of error, but its risky as the api will not let you pop the last error from the stack, only the first. This means that if there is another unhandeled error in the queue, it will free the wrong error and leave the crypto engine error in the stack. or we'd need reset the entire stack, which would mean that potential errors will get lost. Basically, the API makes it hard to solve it correctly. If we bump into this problem again then we probably will reset the error queue in our patch (which til now has worked since [2010-06-04](http://git.alpinelinux.org/cgit/aports/commit/main/openssl?id=2d8adebb5ac89dda780d75c3b9cad107bfe28f7f))\r\n\r\nIn any case, I think nodejs should properly check function return status instead of only relying on error stack. Then at least the nodejs code will be robust."}}