PostgreSQL Bugs

Collected from the PG bugs email list.

Bug ID16070
PG Version10.10
OSubuntu 18
Opened2019-10-20 08:58:17+00
Reported byrongxin wu
StatusNew

Body of first available message related to this bug follows.

The following bug has been logged on the website:

Bug reference:      16070
Logged by:          rongxin wu
Email address:      (redacted)
PostgreSQL version: 10.10
Operating system:   ubuntu 18
Description:        

In
https://github.com/postgres/postgres/blob/REL_10_STABLE/src/interfaces/libpq/fe-secure-openssl.c,
at Line 1206, it would call the function "ENGINE_finish" and free
conn->engine. At Line 1207, it would call the function "ENGINE_free" and
free conn->engine again. This would lead to a double free bug. Please read
the following code snippet. 

https://github.com/postgres/postgres/blob/REL_10_STABLE/src/interfaces/libpq/fe-secure-openssl.c
896. static int
897. initialize_SSL(PGconn *conn)
898. {
...
1206. 				ENGINE_finish(conn->engine);
1207. 				ENGINE_free(conn->engine);
...

int ENGINE_finish(ENGINE *e)
{
...
    to_return = engine_unlocked_finish(e, 1);
...
    return to_return;
}

int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers)
{
    ...
    if (!engine_free_util(e, 0)) {
        ENGINEerr(ENGINE_F_ENGINE_UNLOCKED_FINISH,
ENGINE_R_FINISH_FAILED);
        return 0;
    }
    return to_return;
}

int engine_free_util(ENGINE *e, int not_locked)
{
    ...
    OPENSSL_free(e);  // a free wrapper
    return 1;
}

int ENGINE_free(ENGINE *e)
{
    return engine_free_util(e, 1);
}

Please help to check. Thanks.

Messages

DateAuthorSubject
2019-10-20 08:58:17+00PG Bug reporting formBUG #16070: A double-free bug in interfaces/libpq/fe-secure-openssl.c
2019-10-20 14:17:11+00Tom LaneRe: BUG #16070: A double-free bug in interfaces/libpq/fe-secure-openssl.c
2019-10-21 03:25:37+00Michael PaquierRe: BUG #16070: A double-free bug in interfaces/libpq/fe-secure-openssl.c
2019-10-21 03:44:25+00Tom LaneRe: BUG #16070: A double-free bug in interfaces/libpq/fe-secure-openssl.c