Skip to content

Commit b530466

Browse files
davidbenantsmartian
authored andcommitted
tls: fix malloc mismatch in SSL_set_tlsext_status_ocsp_resp call
SSL_set_tlsext_status_ocsp_resp expects the data to be allocated with OPENSSL_malloc, not libc malloc, so use OpenSSLMalloc. Additionally, though OpenSSL doesn't type-check due to it being a macro, the function is documented to take an unsigned char pointer: https://www.openssl.org/docs/man1.1.0/ssl/SSL_set_tlsext_status_ocsp_resp.html (By default, OPENSSL_malloc is the same as libc malloc, but it is possible to customize this.) PR-URL: #25706 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent c3fd504 commit b530466

File tree

1 file changed

+10
-9
lines changed

1 file changed

+10
-9
lines changed

src/node_crypto.cc

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -326,6 +326,14 @@ bool EntropySource(unsigned char* buffer, size_t length) {
326326
}
327327

328328

329+
template <typename T>
330+
static T* MallocOpenSSL(size_t count) {
331+
void* mem = OPENSSL_malloc(MultiplyWithOverflowCheck(count, sizeof(T)));
332+
CHECK_IMPLIES(mem == nullptr, count == 0);
333+
return static_cast<T*>(mem);
334+
}
335+
336+
329337
void SecureContext::Initialize(Environment* env, Local<Object> target) {
330338
Local<FunctionTemplate> t = env->NewFunctionTemplate(New);
331339
t->InstanceTemplate()->SetInternalFieldCount(1);
@@ -2473,11 +2481,11 @@ int SSLWrap<Base>::TLSExtStatusCallback(SSL* s, void* arg) {
24732481
size_t len = Buffer::Length(obj);
24742482

24752483
// OpenSSL takes control of the pointer after accepting it
2476-
char* data = node::Malloc(len);
2484+
unsigned char* data = MallocOpenSSL<unsigned char>(len);
24772485
memcpy(data, resp, len);
24782486

24792487
if (!SSL_set_tlsext_status_ocsp_resp(s, data, len))
2480-
free(data);
2488+
OPENSSL_free(data);
24812489
w->ocsp_response_.Reset();
24822490

24832491
return SSL_TLSEXT_ERR_OK;
@@ -2699,13 +2707,6 @@ static bool IsSupportedAuthenticatedMode(const EVP_CIPHER_CTX* ctx) {
26992707
return IsSupportedAuthenticatedMode(cipher);
27002708
}
27012709

2702-
template <typename T>
2703-
static T* MallocOpenSSL(size_t count) {
2704-
void* mem = OPENSSL_malloc(MultiplyWithOverflowCheck(count, sizeof(T)));
2705-
CHECK_IMPLIES(mem == nullptr, count == 0);
2706-
return static_cast<T*>(mem);
2707-
}
2708-
27092710
enum class ParsePublicKeyResult {
27102711
kParsePublicOk,
27112712
kParsePublicNotRecognized,

0 commit comments

Comments
 (0)