From b1d44876bdba29ad998ac5f7b7678d4a823ffc40 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 30 Jun 2026 15:20:50 +0200 Subject: [PATCH] libseckey: FIx memory leak in error path (OpenSSL 1.1.1 only) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When EVP_PKEY_get0_EC_KEY(), EC_KEY_set_ex_data(), EVP_PKEY_get0_RSA() or RSA_set_ex_data() fails, the function returns -EIO without freeing the data struct or the data->key_blob that were allocated before. Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- libseckey/sk_pkeymeth.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/libseckey/sk_pkeymeth.c b/libseckey/sk_pkeymeth.c index e56ec29e..c1333a2a 100644 --- a/libseckey/sk_pkeymeth.c +++ b/libseckey/sk_pkeymeth.c @@ -698,6 +698,7 @@ static int sk_pkey_meth_setup_pkey(EVP_PKEY *pkey, struct sk_pkey_data *data; EC_KEY *ec; RSA *rsa; + int rc; if (pkey == NULL || secure_key == NULL || secure_key_size == 0 || funcs == NULL) @@ -733,12 +734,14 @@ static int sk_pkey_meth_setup_pkey(EVP_PKEY *pkey, ec = EVP_PKEY_get0_EC_KEY(pkey); if (ec == NULL) { sk_debug(debug, "EVP_PKEY_get0_EC_KEY failed"); - return -EIO; + rc = -EIO; + goto error; } if (!EC_KEY_set_ex_data(ec, sk_pkey_data_ec_index, data)) { sk_debug(debug, "EC_KEY_set_ex_data failed"); - return -EIO; + rc = -EIO; + goto error; } break; case EVP_PKEY_RSA: @@ -746,17 +749,29 @@ static int sk_pkey_meth_setup_pkey(EVP_PKEY *pkey, rsa = EVP_PKEY_get0_RSA(pkey); if (rsa == NULL) { sk_debug(debug, "EVP_PKEY_get0_RSA failed"); - return -EIO; + rc = -EIO; + goto error; } if (!RSA_set_ex_data(rsa, sk_pkey_data_rsa_index, data)) { sk_debug(debug, "RSA_set_ex_data failed"); - return -EIO; + rc = -EIO; + goto error; } break; + default: + rc = -EIO; + goto error; } return 0; + +error: + if (data != NULL) { + OPENSSL_free(data->key_blob); + OPENSSL_free(data); + } + return rc; } /**