Skip to content

Commit 309c55d

Browse files
ndosscherhenium
authored andcommitted
Fix memory leak if ossl_bn_new() fails
When that call fails, the `bn` BIGNUM is never freed in asn1integer_to_num(). To solve this, use rb_protect(). Example Valgrind report: ``` 32 (24 direct, 8 indirect) bytes in 1 blocks are definitely lost in loss record 11,113 of 25,910 malloc (at /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) CRYPTO_zalloc (at /usr/lib/x86_64-linux-gnu/libcrypto.so.3) BN_new (at /usr/lib/x86_64-linux-gnu/libcrypto.so.3) BN_bin2bn (at /usr/lib/x86_64-linux-gnu/libcrypto.so.3) <unknown stack frame> *asn1integer_to_num (ossl_asn1.c:136) *asn1integer_to_num_i (ossl_asn1.c:165) rb_protect (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) *decode_int (ossl_asn1.c:356) *int_ossl_asn1_decode0_prim (ossl_asn1.c:777) *ossl_asn1_decode0 (ossl_asn1.c:936) *ossl_asn1_decode_all (ossl_asn1.c:1058) <unknown stack frame> <unknown stack frame> <unknown stack frame> rb_vm_exec (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) <unknown stack frame> <unknown stack frame> rb_catch_obj (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) <unknown stack frame> <unknown stack frame> <unknown stack frame> rb_vm_exec (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) rb_yield (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) rb_ary_each (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) <unknown stack frame> <unknown stack frame> <unknown stack frame> rb_vm_exec (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) rb_yield (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) rb_ary_each (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) <unknown stack frame> <unknown stack frame> <unknown stack frame> rb_vm_exec (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) rb_yield (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) rb_ary_each (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) <unknown stack frame> <unknown stack frame> <unknown stack frame> rb_vm_exec (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) <unknown stack frame> <unknown stack frame> rb_catch_obj (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) <unknown stack frame> <unknown stack frame> <unknown stack frame> rb_vm_exec (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) rb_vm_invoke_proc (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) rb_proc_call_kw (at /usr/lib/x86_64-linux-gnu/libruby-3.2.so.3.2.3) ```
1 parent 38a1a4a commit 309c55d

File tree

1 file changed

+6
-4
lines changed

1 file changed

+6
-4
lines changed

ext/openssl/ossl_asn1.c

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -130,15 +130,17 @@ asn1integer_to_num(const ASN1_INTEGER *ai)
130130
if (!ai) {
131131
ossl_raise(rb_eTypeError, "ASN1_INTEGER is NULL!");
132132
}
133+
134+
num = ossl_bn_new(BN_value_one());
135+
bn = GetBNPtr(num);
136+
133137
if (ASN1_STRING_type(ai) == V_ASN1_ENUMERATED)
134-
bn = ASN1_ENUMERATED_to_BN(ai, NULL);
138+
bn = ASN1_ENUMERATED_to_BN(ai, bn);
135139
else
136-
bn = ASN1_INTEGER_to_BN(ai, NULL);
140+
bn = ASN1_INTEGER_to_BN(ai, bn);
137141

138142
if (!bn)
139143
ossl_raise(eOSSLError, NULL);
140-
num = ossl_bn_new(bn);
141-
BN_free(bn);
142144

143145
return num;
144146
}

0 commit comments

Comments
 (0)