]> granicus.if.org Git - openssl/commit
Ensure minsize >= sizeof(SH_LIST)
authorPauli <paul.dale@oracle.com>
Fri, 17 Feb 2017 00:39:20 +0000 (10:39 +1000)
committerRich Salz <rsalz@openssl.org>
Tue, 21 Feb 2017 14:45:14 +0000 (09:45 -0500)
commit88bf0d36048569e0dd5e6193c4ec21d2a9da5aba
treec88fd0bc305e41301cdf7c6207e9a98c322cd89a
parentfd1ea63f9fcababfc4d4ea38ad5dd49a76fa6023
Ensure minsize >= sizeof(SH_LIST)

The sh_add_to_list function will overwrite subsequent slots in the free list
for small allocations.  This causes a segmentation fault if the writes goes
off the end of the secure memory.  I've not investigated if this problem
can overwrite memory without the segmentation fault, but it seems likely.

This fix limits the minsize to the sizeof of the SH_LIST structure (which
also has a side effect of properly aligning the pointers).

The alternative would be to return an error if minsize is too small.

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2657)

(cherry picked from commit 70e14ffbaf6a67dab56c24cae01f1248cf3f1e77)
crypto/mem_sec.c