The problem can be reproduced using
#include <openssl/engine.h>
#include <openssl/ssl.h>
#define GOST "gost"
void load(void)
{
ENGINE *e = ENGINE_by_id(GOST);
ENGINE_set_default(e, ENGINE_METHOD_ALL);
ENGINE_free(e);
}
int main(void)
{
ENGINE_load_builtin_engines();
load();
load();
SSL_CTX *ctx = SSL_CTX_new(SSLv3_client_method());
return 0;
}compile with
gcc -O0 -g -std=c99 -Wall -Werror gost.c -o gost -lcrypto -lssl
and it will crash similar to
==10725== Invalid read of size 8
==10725== at 0x4F0EF53: look_str_cb (tb_asnmth.c:216)
==10725== by 0x4F1BDDE: lh_doall_arg (lhash.c:292)
==10725== by 0x4F0D71B: engine_table_doall (eng_table.c:349)
==10725== by 0x4F0F312: ENGINE_pkey_asn1_find_str (tb_asnmth.c:236)
==10725== by 0x4F417C4: EVP_PKEY_asn1_find_str (ameth_lib.c:213)
==10725== by 0x524A2E3: get_optional_pkey_id (ssl_ciph.c:356)
==10725== by 0x524B41E: ssl_create_cipher_list (ssl_ciph.c:733)
==10725== by 0x5244D2F: SSL_CTX_new (ssl_lib.c:1762)
==10725== by 0x40079C: main (in /tmp/gost)
==10725== Address 0x5c45f50 is 96 bytes inside a block of size 216 free'd
==10725== at 0x4C2A82E: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10725== by 0x4E933EC: CRYPTO_free (mem.c:397)
==10725== by 0x4F0BB67: engine_free_util (eng_lib.c:136)
==10725== by 0x4F0C79B: engine_unlocked_finish (eng_init.c:112)
==10725== by 0x4F0D3C1: engine_table_register (eng_table.c:178)
==10725== by 0x4F0F091: ENGINE_set_default_pkey_asn1_meths (tb_asnmth.c:106)
==10725== by 0x4F0E007: ENGINE_set_default (eng_fat.c:96)
==10725== by 0x40076A: load (in /tmp/gost)
==10725== by 0x40078F: main (in /tmp/gost)
==10725==
adding ENGINE_cleanup instead of creating an SSL_CTX, it will crash in the ENGINE_cleanup.
Finishing the first engine after initializing the second,
https://github.com/openssl/openssl/blob/master/crypto/engine/eng_table.c#L130
free's the registered methods gost uses,
https://github.com/openssl/openssl/blob/master/crypto/engine/eng_lib.c#L128
but does not unregister them.
I'll submit a patch to address this.
The problem can be reproduced using
compile with
and it will crash similar to
adding ENGINE_cleanup instead of creating an SSL_CTX, it will crash in the ENGINE_cleanup.
Finishing the first engine after initializing the second,
https://github.com/openssl/openssl/blob/master/crypto/engine/eng_table.c#L130
free's the registered methods gost uses,
https://github.com/openssl/openssl/blob/master/crypto/engine/eng_lib.c#L128
but does not unregister them.
I'll submit a patch to address this.