diff options
| author | Neil Horman <nhorman@openssl.org> | 2024-10-16 20:34:08 +0200 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2024-12-10 14:58:08 +0100 |
| commit | dc10ffc2834e0d2f5ebc1c3e29bd97f1f43a0ead (patch) | |
| tree | a1d95258cc0d64a93beae647034347d4db528f0d /crypto/dsa | |
| parent | Fix memory ordering guarantees and TSAN errors (diff) | |
| download | openssl-dc10ffc2834e0d2f5ebc1c3e29bd97f1f43a0ead.tar.xz openssl-dc10ffc2834e0d2f5ebc1c3e29bd97f1f43a0ead.zip | |
Fix potential use-after-free in REF_PRINT_COUNT
We use REF_PRINT_COUNT to dump out the value of various reference
counters in our code
However, we commonly use this macro after an increment or decrement. On
increment its fine, but on decrement its not, because the macro
dereferences the object holding the counter value, which may be freed by
another thread, as we've given up our ref count to it prior to using the
macro.
The rule is that we can't reference memory for an object once we've
released our reference, so lets fix this by altering REF_PRINT_COUNT to
accept the value returned by CRYPTO_[UP|DOWN]_REF instead. The
eliminates the need to dereference the memory the object points to an
allows us to use the call after we release our reference count
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25664)
Diffstat (limited to 'crypto/dsa')
| -rw-r--r-- | crypto/dsa/dsa_lib.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/crypto/dsa/dsa_lib.c b/crypto/dsa/dsa_lib.c index 7997c2ac25..db6e3b059b 100644 --- a/crypto/dsa/dsa_lib.c +++ b/crypto/dsa/dsa_lib.c @@ -218,7 +218,7 @@ void DSA_free(DSA *r) return; CRYPTO_DOWN_REF(&r->references, &i); - REF_PRINT_COUNT("DSA", r); + REF_PRINT_COUNT("DSA", i, r); if (i > 0) return; REF_ASSERT_ISNT(i < 0); @@ -249,7 +249,7 @@ int DSA_up_ref(DSA *r) if (CRYPTO_UP_REF(&r->references, &i) <= 0) return 0; - REF_PRINT_COUNT("DSA", r); + REF_PRINT_COUNT("DSA", i, r); REF_ASSERT_ISNT(i < 2); return ((i > 1) ? 1 : 0); } |