Fix memory leaks: uninstantiate DRBG during health checks. Cleanup md_ctx

when performing ECDSA selftest.

diff --git a/crypto/fips_err.h b/crypto/fips_err.h
index 9c235080aca7be41a18796d4301b558c09e152e6..9a824c7306bc541f6f9391d5ffe5a4845c5cfb51 100644 (file)
--- a/crypto/fips_err.h
+++ b/crypto/fips_err.h
@@ -157,6 +157,7 @@ static ERR_STRING_DATA FIPS_str_reasons[]=
 {ERR_REASON(FIPS_R_SELFTEST_FAILURE)     ,"selftest failure"},
 {ERR_REASON(FIPS_R_STRENGTH_ERROR_UNDETECTED),"strength error undetected"},
 {ERR_REASON(FIPS_R_TEST_FAILURE)         ,"test failure"},
+{ERR_REASON(FIPS_R_UNINSTANTIATE_ERROR)  ,"uninstantiate error"},
 {ERR_REASON(FIPS_R_UNINSTANTIATE_ZEROISE_ERROR),"uninstantiate zeroise error"},
 {ERR_REASON(FIPS_R_UNSUPPORTED_DRBG_TYPE),"unsupported drbg type"},
 {ERR_REASON(FIPS_R_UNSUPPORTED_PLATFORM) ,"unsupported platform"},

diff --git a/fips/ecdsa/fips_ecdsa_selftest.c b/fips/ecdsa/fips_ecdsa_selftest.c
index 722ae673bcd92a3fe203de5a5562e0add7bc53d3..7f7ddda603e9a4e266eb77df75e097e0d5ba0568 100644 (file)
--- a/fips/ecdsa/fips_ecdsa_selftest.c
+++ b/fips/ecdsa/fips_ecdsa_selftest.c
@@ -151,6 +151,8 @@ int FIPS_selftest_ecdsa()
 
        err:
 
+       FIPS_md_ctx_cleanup(&mctx);
+
        if (x)
                BN_clear_free(x);
        if (y)

diff --git a/fips/fips.h b/fips/fips.h
index 92f61a89a8e6ca2237b61b60d387f72f15254016..0481983f7866b919076930e3815d638f35274bb9 100644 (file)
--- a/fips/fips.h
+++ b/fips/fips.h
@@ -280,6 +280,7 @@ void ERR_load_FIPS_strings(void);
 #define FIPS_R_SELFTEST_FAILURE                                 135
 #define FIPS_R_STRENGTH_ERROR_UNDETECTED                136
 #define FIPS_R_TEST_FAILURE                             137
+#define FIPS_R_UNINSTANTIATE_ERROR                      141
 #define FIPS_R_UNINSTANTIATE_ZEROISE_ERROR              138
 #define FIPS_R_UNSUPPORTED_DRBG_TYPE                    139
 #define FIPS_R_UNSUPPORTED_PLATFORM                     140

diff --git a/fips/rand/fips_drbg_selftest.c b/fips/rand/fips_drbg_selftest.c
index d1f9dd118be9683386fad09221e2989071e4d7e5..496ea734817d99bda86dfc2ae5c1f7cdf3fccd48 100644 (file)
--- a/fips/rand/fips_drbg_selftest.c
+++ b/fips/rand/fips_drbg_selftest.c
@@ -859,6 +859,13 @@ static int fips_drbg_health_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td)
                goto err;
                }
 
+       dctx->flags &= ~DRBG_FLAG_NOERR;
+       if (!FIPS_drbg_uninstantiate(dctx))
+               {
+               FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
+               goto err;
+               }
+
        /* Instantiate with valid data. NB: errors now reported again */
        if (!FIPS_drbg_init(dctx, td->nid, td->flags))
                goto err;
@@ -911,6 +918,14 @@ static int fips_drbg_health_check(DRBG_CTX *dctx, DRBG_SELFTEST_DATA *td)
                goto err;
                }
                
+       dctx->flags &= ~DRBG_FLAG_NOERR;
+
+       if (!FIPS_drbg_uninstantiate(dctx))
+               {
+               FIPSerr(FIPS_F_FIPS_DRBG_HEALTH_CHECK, FIPS_R_UNINSTANTIATE_ERROR);
+               goto err;
+               }
+
 
        /* Instantiate again with valid data */