Skip to content

Conversation

aleks-f
Copy link
Member

@aleks-f aleks-f commented Oct 31, 2024

replacement for #4663

This simple program crashes POCO (tested under Red Hat Enterprise Linux 9.4):

#include <Poco/Net/Context.h>

int main()
{
    const Poco::Net::Context context(Poco::Net::Context::CLIENT_USE, "/tmp", Poco::Net::Context::VERIFY_STRICT, 9, false, "ALL");
    return 0;
}

The problem is an incorrect usage of SSL_CTX_set0_tmp_dh_pkey() in Context::initDH(). The return value is not evaluated and the key is freed even if it has been successfully transferred to the SSL Context.

The relevant part of the OpenSSL manpage https://docs.openssl.org/3.1/man3/SSL_CTX_set_tmp_dh_callback/:

Ownership of the dhpkey value is passed to the SSL_CTX or SSL object as a result of this call, and so the caller should not free it if the function call is successful.

@pkl97

@aleks-f aleks-f added the bug label Oct 31, 2024
@aleks-f aleks-f added this to the Release 1.14.0 milestone Oct 31, 2024
@aleks-f aleks-f requested a review from obiltschnig October 31, 2024 01:11
@aleks-f aleks-f changed the title Openssl fix Openssl DH key size Oct 31, 2024
@aleks-f aleks-f requested a review from matejk November 11, 2024 17:01
@matejk matejk merged commit c4f66d5 into main Nov 11, 2024
44 checks passed
{
dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), 0);
dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), 0);
dh->length = 160;
}
{
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This must be in else: c4f66d5#r152747523

Issue link: #4877

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

5 participants