On Sat, Nov 29, 2003 at 12:07:01AM +0100, Richard Levitte via RT wrote:
>
> [jaenicke - Sun Nov 16 17:55:25 2003]:
>
> > [guest - Thu Oct 30 23:51:10 2003]:
> >
> > >
> > > Using the null cipher is causing us some problems with 0.9.7c. Not
> > sure
> > > how important this is but for one it causes at least one 0 byte
> > malloc
> > > that causes efence to barf:
> > >
> > > #0 0x4032d5f1 in kill () from /lib/libc.so.6
> > > #1 0x40017eb6 in EF_Abort () from /usr/lib/libefence.so
> > > #2 0x4001741a in memalign () from /usr/lib/libefence.so
> > > #3 0x40017a6e in malloc () from /usr/lib/libefence.so
> > > #4 0x401d9910 in default_malloc_ex (num=0, file=0x402ab1e7
> > "evp_enc.c",
> > > line=151) at mem.c:79
> > > #5 0x401d9fcc in CRYPTO_malloc (num=0, file=0x402ab1e7 "evp_enc.c",
> > > line=151)
> > > at mem.c:304
> > > #6 0x4022f48a in EVP_CipherInit_ex (ctx=0x4289af74,
> > cipher=0x402c1cc0,
> > > impl=0x0, key=0x427d1000 <Address 0x427d1000 out of bounds>,
> > > iv=0x427d1000 <Address 0x427d1000 out of bounds>, enc=1) at
> > > evp_enc.c:151
> > > #7 0x40185ced in ssl3_change_cipher_state (s=0x42227ef4, which=18)
> > > at s3_enc.c:334
> > > #8 0x4018089e in ssl3_connect (s=0x42227ef4) at s3_clnt.c:382
> > > #9 0x401911b6 in SSL_do_handshake (s=0x42227ef4) at ssl_lib.c:1827
> > > #10 0x4019c419 in ssl_ctrl (b=0x4226bfc0, cmd=101, num=0, ptr=0x0)
> > > at bio_ssl.c:417
> > > #11 0x4021df70 in BIO_ctrl (b=0x4226bfc0, cmd=101, larg=0, parg=0x0)
> > > at bio_lib.c:324
> >
> > Hmm. From some research it seems, that some UNIX implementations of
> > malloc() will return NULL on malloc(0) which indicates that we should
> > have a look into this issue!
>
> One way to solve that would be for CRYPTO_malloc() to return NULL if it
> gets 0 as the size to allocate.
Yes, that would be ok. We however also should explicitely take care of the
issue behind it: in evp_enc.c:151, memory for cipher_data is allocated without
checking the length first. If the length is 0, the malloc() should not be
called and NULL should be set for clarity...
Best regards,
Lutz
--
Lutz Jaenicke [EMAIL PROTECTED]
http://www.aet.TU-Cottbus.DE/personen/jaenicke/
BTU Cottbus, Allgemeine Elektrotechnik
Universitaetsplatz 3-4, D-03044 Cottbus
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
