Fix segfault in RSA_free() (and DSA/DH/EC_KEY)
authorNicola Tuveri <nic.tuv@gmail.com>
Wed, 5 Sep 2018 08:58:55 +0000 (11:58 +0300)
committerNicola Tuveri <nic.tuv@gmail.com>
Wed, 5 Sep 2018 12:26:40 +0000 (15:26 +0300)
commitc28a2ffd01dc1da932aa55d518b57a933cdc51be
treed82e21f4f94927c8c0f5ad6384c68aa1e2956ddc
parent374804bd0973e8af05046caecc40e6b906d1a375
Fix segfault in RSA_free() (and DSA/DH/EC_KEY)

`RSA_free()` and friends are called in case of error from
`RSA_new_method(ENGINE *e)` (or the respective equivalent functions).

For the rest of the description I'll talk about `RSA_*`, but the same
applies for the equivalent `DSA_free()`, `DH_free()`, `EC_KEY_free()`.

If `RSA_new_method()` fails because the engine does not implement the
required method, when `RSA_free(RSA *r)` is called,
`r->meth == NULL` and a segfault happens while checking if
`r->meth->finish` is defined.

This commit fixes this issue by ensuring that `r->meth` is not NULL
before dereferencing it to check for `r->meth->finish`.

Fixes #7102 .

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7121)
crypto/dh/dh_lib.c
crypto/dsa/dsa_lib.c
crypto/ec/ec_key.c
crypto/rsa/rsa_lib.c