{"action":"opened","issue":{"url":"https://api.github.com/repos/openssl/openssl/issues/2109","repository_url":"https://api.github.com/repos/openssl/openssl","labels_url":"https://api.github.com/repos/openssl/openssl/issues/2109/labels{/name}","comments_url":"https://api.github.com/repos/openssl/openssl/issues/2109/comments","events_url":"https://api.github.com/repos/openssl/openssl/issues/2109/events","html_url":"https://github.com/openssl/openssl/issues/2109","id":196353593,"number":2109,"title":"memory leaks in x_name.c","user":{"login":"bernd-edlinger","id":17638929,"avatar_url":"https://avatars.githubusercontent.com/u/17638929?v=3","gravatar_id":"","url":"https://api.github.com/users/bernd-edlinger","html_url":"https://github.com/bernd-edlinger","followers_url":"https://api.github.com/users/bernd-edlinger/followers","following_url":"https://api.github.com/users/bernd-edlinger/following{/other_user}","gists_url":"https://api.github.com/users/bernd-edlinger/gists{/gist_id}","starred_url":"https://api.github.com/users/bernd-edlinger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bernd-edlinger/subscriptions","organizations_url":"https://api.github.com/users/bernd-edlinger/orgs","repos_url":"https://api.github.com/users/bernd-edlinger/repos","events_url":"https://api.github.com/users/bernd-edlinger/events{/privacy}","received_events_url":"https://api.github.com/users/bernd-edlinger/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-12-19T08:10:18Z","updated_at":"2016-12-19T08:10:18Z","closed_at":null,"body":"Under low memory a memory leak was observed with openssl-1.0.2j:\r\n\r\nThe error handling in x509_name_ex_d2i is unable to clean up all x509 objects\r\nwhen an error happens in sk_X509_NAME_ENTRY_push due to OOM.\r\nAlso in x509_name_encode and x509_name_canon there is a small memory leak\r\nif sk_STACK_OF_X509_NAME_ENTRY_push fails due to OOM.\r\n\r\n```\r\n==11507==ERROR: LeakSanitizer: detected memory leaks\r\n\r\nDirect leak of 64 byte(s) in 2 object(s) allocated from:\r\n    #0 0x7f5f689e8310 in __interceptor_malloc ../../../../gcc-7-20161211/libsanitizer/asan/asan_malloc_linux.cc:62\r\n    #1 0x2153dfa in CRYPTO_malloc crypto/mem.c:346\r\n    #2 0x21ac92c in sk_new crypto/stack/stack.c:162\r\n    #3 0x21ac92c in sk_new_null crypto/stack/stack.c:154\r\n    #4 0x220a1f4 in asn1_template_noexp_d2i crypto/asn1/tasn_dec.c:634\r\n    #5 0x220ac6c in asn1_template_ex_d2i crypto/asn1/tasn_dec.c:584\r\n    #6 0x220bf53 in ASN1_item_ex_d2i crypto/asn1/tasn_dec.c:206\r\n    #7 0x21f5e00 in x509_name_ex_d2i crypto/asn1/x_name.c:207\r\n    #8 0x220be08 in ASN1_item_ex_d2i crypto/asn1/tasn_dec.c:244\r\n    #9 0x2208e33 in asn1_template_noexp_d2i crypto/asn1/tasn_dec.c:696\r\n    #10 0x220ac6c in asn1_template_ex_d2i crypto/asn1/tasn_dec.c:584\r\n    #11 0x220cbd4 in ASN1_item_ex_d2i crypto/asn1/tasn_dec.c:447\r\n    #12 0x2208e33 in asn1_template_noexp_d2i crypto/asn1/tasn_dec.c:696\r\n    #13 0x220ac6c in asn1_template_ex_d2i crypto/asn1/tasn_dec.c:584\r\n    #14 0x220e917 in ASN1_item_ex_d2i crypto/asn1/tasn_dec.c:447\r\n    #15 0x220e917 in ASN1_item_d2i crypto/asn1/tasn_dec.c:146\r\n    #16 0x235d291 in ASN1_item_d2i_bio crypto/asn1/a_d2i_fp.c:119\r\n    #17 0x223c801 in X509_load_cert_file crypto/x509/by_file.c:163\r\n    #18 0x223c801 in by_file_ctrl crypto/x509/by_file.c:118\r\n\r\nDirect leak of 32 byte(s) in 1 object(s) allocated from:\r\n    #0 0x7f5f689e8310 in __interceptor_malloc ../../../../gcc-7-20161211/libsanitizer/asan/asan_malloc_linux.cc:62\r\n    #1 0x2153dfa in CRYPTO_malloc crypto/mem.c:346\r\n    #2 0x21ac92c in sk_new crypto/stack/stack.c:162\r\n    #3 0x21ac92c in sk_new_null crypto/stack/stack.c:154\r\n    #4 0x220a1f4 in asn1_template_noexp_d2i crypto/asn1/tasn_dec.c:634\r\n    #5 0x220ac6c in asn1_template_ex_d2i crypto/asn1/tasn_dec.c:584\r\n    #6 0x22094e9 in ASN1_item_ex_d2i crypto/asn1/tasn_dec.c:206\r\n    #7 0x22094e9 in asn1_template_noexp_d2i crypto/asn1/tasn_dec.c:668\r\n    #8 0x220ac6c in asn1_template_ex_d2i crypto/asn1/tasn_dec.c:584\r\n    #9 0x220bf53 in ASN1_item_ex_d2i crypto/asn1/tasn_dec.c:206\r\n    #10 0x21f5e00 in x509_name_ex_d2i crypto/asn1/x_name.c:207\r\n    #11 0x220be08 in ASN1_item_ex_d2i crypto/asn1/tasn_dec.c:244\r\n    #12 0x2208e33 in asn1_template_noexp_d2i crypto/asn1/tasn_dec.c:696\r\n    #13 0x220ac6c in asn1_template_ex_d2i crypto/asn1/tasn_dec.c:584\r\n    #14 0x220cbd4 in ASN1_item_ex_d2i crypto/asn1/tasn_dec.c:447\r\n    #15 0x2208e33 in asn1_template_noexp_d2i crypto/asn1/tasn_dec.c:696\r\n    #16 0x220ac6c in asn1_template_ex_d2i crypto/asn1/tasn_dec.c:584\r\n    #17 0x220e917 in ASN1_item_ex_d2i crypto/asn1/tasn_dec.c:447\r\n    #18 0x220e917 in ASN1_item_d2i crypto/asn1/tasn_dec.c:146\r\n    #19 0x2102889 in ssl3_get_client_certificate ssl/s3_srvr.c:3243\r\n    #20 0x2107c97 in ssl3_accept ssl/s3_srvr.c:593\r\n    #21 0x212c7de in ssl3_read_bytes ssl/s3_pkt.c:1207\r\n    #22 0x211e625 in ssl3_read_internal ssl/s3_lib.c:4459\r\n    #23 0x211e625 in ssl3_read ssl/s3_lib.c:4483\r\n\r\n\r\n--- crypto/asn1/x_name.c.orig   2016-09-26 11:49:07.000000000 +0200\r\n+++ crypto/asn1/x_name.c        2016-12-17 11:46:49.537496141 +0100\r\n@@ -178,6 +178,16 @@ static void x509_name_ex_free(ASN1_VALUE\r\n     *pval = NULL;\r\n }\r\n\r\n+static void local_sk_X509_NAME_ENTRY_free(STACK_OF(X509_NAME_ENTRY) *ne)\r\n+{\r\n+    sk_X509_NAME_ENTRY_free(ne);\r\n+}\r\n+\r\n+static void local_sk_X509_NAME_ENTRY_pop_free(STACK_OF(X509_NAME_ENTRY) *ne)\r\n+{\r\n+    sk_X509_NAME_ENTRY_pop_free(ne, X509_NAME_ENTRY_free);\r\n+}\r\n+\r\n static int x509_name_ex_d2i(ASN1_VALUE **val,\r\n                             const unsigned char **in, long len,\r\n                             const ASN1_ITEM *it, int tag, int aclass,\r\n@@ -228,13 +238,14 @@ static int x509_name_ex_d2i(ASN1_VALUE *\r\n             entry->set = i;\r\n             if (!sk_X509_NAME_ENTRY_push(nm.x->entries, entry))\r\n                 goto err;\r\n+            sk_X509_NAME_ENTRY_set(entries, j, NULL);\r\n         }\r\n-        sk_X509_NAME_ENTRY_free(entries);\r\n     }\r\n-    sk_STACK_OF_X509_NAME_ENTRY_free(intname.s);\r\n     ret = x509_name_canon(nm.x);\r\n     if (!ret)\r\n         goto err;\r\n+    sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,\r\n+                                         local_sk_X509_NAME_ENTRY_free);\r\n     nm.x->modified = 0;\r\n     *val = nm.a;\r\n     *in = p;\r\n@@ -242,6 +253,8 @@ static int x509_name_ex_d2i(ASN1_VALUE *\r\n  err:\r\n     if (nm.x != NULL)\r\n         X509_NAME_free(nm.x);\r\n+    sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,\r\n+                                         local_sk_X509_NAME_ENTRY_pop_free);\r\n     ASN1err(ASN1_F_X509_NAME_EX_D2I, ERR_R_NESTED_ASN1_ERROR);\r\n     return 0;\r\n }\r\n@@ -267,16 +280,6 @@ static int x509_name_ex_i2d(ASN1_VALUE *\r\n     return ret;\r\n }\r\n\r\n-static void local_sk_X509_NAME_ENTRY_free(STACK_OF(X509_NAME_ENTRY) *ne)\r\n-{\r\n-    sk_X509_NAME_ENTRY_free(ne);\r\n-}\r\n-\r\n-static void local_sk_X509_NAME_ENTRY_pop_free(STACK_OF(X509_NAME_ENTRY) *ne)\r\n-{\r\n-    sk_X509_NAME_ENTRY_pop_free(ne, X509_NAME_ENTRY_free);\r\n-}\r\n-\r\n static int x509_name_encode(X509_NAME *a)\r\n {\r\n     union {\r\n@@ -299,12 +302,16 @@ static int x509_name_encode(X509_NAME *a\r\n             entries = sk_X509_NAME_ENTRY_new_null();\r\n             if (!entries)\r\n                 goto memerr;\r\n-            if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname.s, entries))\r\n+            if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname.s, entries)) {\r\n+                sk_X509_NAME_ENTRY_free(entries);\r\n                 goto memerr;\r\n+            }\r\n             set = entry->set;\r\n         }\r\n-        if (!sk_X509_NAME_ENTRY_push(entries, entry))\r\n+        if (!sk_X509_NAME_ENTRY_push(entries, entry)) {\r\n+            X509_NAME_ENTRY_free(entry);\r\n             goto memerr;\r\n+        }\r\n     }\r\n     len = ASN1_item_ex_i2d(&intname.a, NULL,\r\n                            ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);\r\n@@ -370,8 +377,10 @@ static int x509_name_canon(X509_NAME *a)\r\n             entries = sk_X509_NAME_ENTRY_new_null();\r\n             if (!entries)\r\n                 goto err;\r\n-            if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname, entries))\r\n+            if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname, entries)) {\r\n+                sk_X509_NAME_ENTRY_free(entries);\r\n                 goto err;\r\n+            }\r\n             set = entry->set;\r\n         }\r\n         tmpentry = X509_NAME_ENTRY_new();\r\n\r\n```"}}
{"actor":{"display_login":"bernd-edlinger"}}