tr_create_dh_params does not return when it should

Bug #1730679 reported by Stefan Paetow
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Moonshot Trust-Router
Fix Released
High
Jennifer Richards

Bug Description

The tr_create_dh_params function (in common/tr_dh.c) defines the following at the top of the function (from line 94 onwards):

  if (NULL == (dh = DH_new()))
    return NULL;

  if ((NULL == (dh->g = BN_new())) ||
      (NULL == (dh->p = BN_new())) ||
      (NULL == (dh->q = BN_new()))) {
    DH_free(dh);
  }

  BN_set_word(dh->g, 2);
  dh->p = BN_bin2bn(tr_2048_dhprime, sizeof(tr_2048_dhprime), NULL);
  BN_rshift1(dh->q, dh->p);

The first if () is uncontroversial. It is pretty clear. However, the second does not return after freeing the 'dh' structure... I'm sure it's never happened before that BN_new() returns a failure (NULL), but this would cause a crash, no?

Should there be a 'return NULL;' after the 'DH_free(dh);' line? I suspect yes?

description: updated
Revision history for this message
Jennifer Richards (jennifer-k) wrote :

Yes, I would expect this to cause a segmentation fault. It should return failure as you suggest.

Revision history for this message
Jennifer Richards (jennifer-k) wrote :

I think it's probably not an emergency as it should rarely come up and would very likely cause a crash rather than runaway behavior.

Revision history for this message
Jennifer Richards (jennifer-k) wrote :

Fix committed to master

Changed in moonshot-tr:
status: New → Fix Committed
assignee: nobody → Jennifer Richards (jennifer-k)
Revision history for this message
Stefan Paetow (stefan-paetow) wrote :

Yes, given it's not killed the service before, it's something we can release whenever we're ready.

information type: Private Security → Public
Changed in moonshot-tr:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.