Fix Use after free when copying cipher ctx
authorShane Lontis <shane.lontis@oracle.com>
Mon, 18 Nov 2019 03:13:05 +0000 (13:13 +1000)
committerShane Lontis <shane.lontis@oracle.com>
Mon, 18 Nov 2019 03:13:05 +0000 (13:13 +1000)
commitf75abcc0f073b1c3e2d81df3fcde8fe45dd1e61f
tree9e55a53ddf04b053cc081fbe0c9e8244a13b5f22
parentde0799b0fc845869d775520382b4e7f9995732e5
Fix Use after free when copying cipher ctx

Fixes #10438
issue found by clusterfuzz/ossfuzz

The dest was getting a copy of the src structure which contained a pointer that should point to an offset inside itself - because of the copy it was pointing to the original structure.

The setup for a ctx is mainly done by the initkey method in the PROV_CIPHER_HW structure. Because of this it makes sense that the structure should also contain a copyctx method that is use to resolve any pointers that need to be setup.

A dup_ctx has been added to the cipher_enc tests in evp_test. It does a dup after setup and then frees the original ctx. This detects any floating pointers in the duplicated context that were pointing back to the freed ctx.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10443)
17 files changed:
providers/common/include/prov/ciphercommon.h
providers/implementations/ciphers/cipher_aes.c
providers/implementations/ciphers/cipher_aes_hw.c
providers/implementations/ciphers/cipher_aes_hw_aesni.inc
providers/implementations/ciphers/cipher_aes_hw_s390x.inc
providers/implementations/ciphers/cipher_aes_hw_t4.inc
providers/implementations/ciphers/cipher_aes_ocb.c
providers/implementations/ciphers/cipher_aes_xts.c
providers/implementations/ciphers/cipher_aes_xts_hw.c
providers/implementations/ciphers/cipher_aria.c
providers/implementations/ciphers/cipher_aria_hw.c
providers/implementations/ciphers/cipher_camellia.c
providers/implementations/ciphers/cipher_camellia_hw.c
providers/implementations/ciphers/cipher_camellia_hw_t4.inc
providers/implementations/ciphers/cipher_sm4.c
providers/implementations/ciphers/cipher_sm4_hw.c
test/evp_test.c