Bug 1312112 - Memory leak in PKCS12_parse with unnamed bags
Summary: Memory leak in PKCS12_parse with unnamed bags
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: openssl
Version: 7.2
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: rc
: ---
Assignee: Tomas Mraz
QA Contact: Hubert Kario
URL:
Whiteboard:
Depends On: 1229871
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-02-25 18:37 UTC by Hubert Kario
Modified: 2016-11-04 02:05 UTC (History)
4 users (show)

Fixed In Version: openssl-1.0.1e-56.el7
Doc Type: Bug Fix
Doc Text:
Clone Of: 1229871
Environment:
Last Closed: 2016-11-04 02:05:51 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2271 0 normal SHIPPED_LIVE openssl bug fix and enhancement update 2016-11-03 13:34:37 UTC

Description Hubert Kario 2016-02-25 18:37:59 UTC 
Issue present with openssl-1.0.1e-51.el7_2.2.x86_64

+++ This bug was initially created as a clone of Bug #1229871 +++

Description of problem:
When a certificate bag in a PKCS12 file has no friendly name, PKCS12_parse will leak 1 byte on every call.

Version-Release number of selected component (if applicable):
1.0.1e-30

How reproducible:
Always

Steps to Reproduce:
1. Create a PKCS12 structure with a certificate that has no friendly name.  PKCS12_create should easily create such a structure.
2. Call PKCS12_parse to get the certificate back out.  Free the certificate, key, and ca stack.
3. Run with valgrind to show that 1 byte has been leaked from the call.

Actual results:
Memory leak

Expected results:
All memory freed

Additional info:
This is fixed in OpenSSL 1.0.2a (crypto/pkcs12/p12_kiss.c)
Comment 5 errata-xmlrpc 2016-11-04 02:05:51 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2271.html
Note You need to log in before you can comment on or make changes to this bug.