From 34cbd7e5361bfb7d4f9dde8a9e89fd4883e08892 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Thu, 23 Aug 2018 14:36:33 +0100 Subject: [PATCH 1/5] Correct memory-leak in pk_encrypt example program --- programs/pkey/pk_encrypt.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/programs/pkey/pk_encrypt.c b/programs/pkey/pk_encrypt.c index 7ca9d5ad9..e27acbeaa 100644 --- a/programs/pkey/pk_encrypt.c +++ b/programs/pkey/pk_encrypt.c @@ -70,6 +70,8 @@ int main( int argc, char *argv[] ) ret = 1; mbedtls_ctr_drbg_init( &ctr_drbg ); + mbedtls_entropy_init( &entropy ); + mbedtls_pk_init( &pk ); if( argc != 3 ) { @@ -85,7 +87,6 @@ int main( int argc, char *argv[] ) mbedtls_printf( "\n . Seeding the random number generator..." ); fflush( stdout ); - mbedtls_entropy_init( &entropy ); if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) @@ -97,8 +98,6 @@ int main( int argc, char *argv[] ) mbedtls_printf( "\n . Reading public key from '%s'", argv[1] ); fflush( stdout ); - mbedtls_pk_init( &pk ); - if( ( ret = mbedtls_pk_parse_public_keyfile( &pk, argv[1] ) ) != 0 ) { mbedtls_printf( " failed\n ! mbedtls_pk_parse_public_keyfile returned -0x%04x\n", -ret ); @@ -134,6 +133,7 @@ int main( int argc, char *argv[] ) { ret = 1; mbedtls_printf( " failed\n ! Could not create %s\n\n", "result-enc.txt" ); + ret = 1; goto exit; } @@ -146,8 +146,10 @@ int main( int argc, char *argv[] ) mbedtls_printf( "\n . Done (created \"%s\")\n\n", "result-enc.txt" ); exit: - mbedtls_ctr_drbg_free( &ctr_drbg ); + + mbedtls_pk_free( &pk ); mbedtls_entropy_free( &entropy ); + mbedtls_ctr_drbg_free( &ctr_drbg ); #if defined(MBEDTLS_ERROR_C) if( ret != 0 ) From 7cee15e9676d3045880e5fd902c0656a355d9b21 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Sun, 8 Oct 2017 16:44:10 +0100 Subject: [PATCH 2/5] Correct memory leak in pk_decrypt example program --- programs/pkey/pk_decrypt.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/programs/pkey/pk_decrypt.c b/programs/pkey/pk_decrypt.c index 32fbc7545..5aae59753 100644 --- a/programs/pkey/pk_decrypt.c +++ b/programs/pkey/pk_decrypt.c @@ -69,7 +69,10 @@ int main( int argc, char *argv[] ) const char *pers = "mbedtls_pk_decrypt"; ((void) argv); + mbedtls_pk_init( &pk ); + mbedtls_entropy_init( &entropy ); mbedtls_ctr_drbg_init( &ctr_drbg ); + memset(result, 0, sizeof( result ) ); ret = 1; @@ -87,7 +90,6 @@ int main( int argc, char *argv[] ) mbedtls_printf( "\n . Seeding the random number generator..." ); fflush( stdout ); - mbedtls_entropy_init( &entropy ); if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) @@ -99,8 +101,6 @@ int main( int argc, char *argv[] ) mbedtls_printf( "\n . Reading private key from '%s'", argv[1] ); fflush( stdout ); - mbedtls_pk_init( &pk ); - if( ( ret = mbedtls_pk_parse_keyfile( &pk, argv[1], "" ) ) != 0 ) { mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile returned -0x%04x\n", -ret ); @@ -115,6 +115,7 @@ int main( int argc, char *argv[] ) if( ( f = fopen( "result-enc.txt", "rb" ) ) == NULL ) { mbedtls_printf( "\n ! Could not open %s\n\n", "result-enc.txt" ); + ret = 1; goto exit; } @@ -146,8 +147,10 @@ int main( int argc, char *argv[] ) ret = 0; exit: - mbedtls_ctr_drbg_free( &ctr_drbg ); + + mbedtls_pk_free( &pk ); mbedtls_entropy_free( &entropy ); + mbedtls_ctr_drbg_free( &ctr_drbg ); #if defined(MBEDTLS_ERROR_C) if( ret != 0 ) From 47a34ff29e216c44c4d2bab594b093c038229d47 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Sun, 8 Oct 2017 16:13:03 +0100 Subject: [PATCH 3/5] Adapt ChangeLog --- ChangeLog | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ChangeLog b/ChangeLog index 8db46ee15..f60037082 100644 --- a/ChangeLog +++ b/ChangeLog @@ -12,6 +12,8 @@ Bugfix interoperability issues with BouncyCastle. Raised by milenamil in #1157. * Fix potential use-after-free in mbedtls_ssl_get_max_frag_len() and mbedtls_ssl_get_record_expansion() after a session reset. Fixes #1941. + * Fix memory leak and free without initialization in pk_encrypt + and pk_decrypt example programs. Reported by Brace Stout. Fixes #1128. = mbed TLS 2.1.14 branch released 2018-07-25 From b31e9dad60b9c4204009e1e00513885c51d3cbb4 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Thu, 23 Aug 2018 14:39:04 +0100 Subject: [PATCH 4/5] Minor formatting improvements in pk_encrypt and pk_decrypt examples --- programs/pkey/pk_decrypt.c | 17 ++++++++++------- programs/pkey/pk_encrypt.c | 20 ++++++++++++-------- 2 files changed, 22 insertions(+), 15 deletions(-) diff --git a/programs/pkey/pk_decrypt.c b/programs/pkey/pk_decrypt.c index 5aae59753..15ff99f4b 100644 --- a/programs/pkey/pk_decrypt.c +++ b/programs/pkey/pk_decrypt.c @@ -90,11 +90,12 @@ int main( int argc, char *argv[] ) mbedtls_printf( "\n . Seeding the random number generator..." ); fflush( stdout ); - if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy, - (const unsigned char *) pers, - strlen( pers ) ) ) != 0 ) + if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, + &entropy, (const unsigned char *) pers, + strlen( pers ) ) ) != 0 ) { - mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned %d\n", ret ); + mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned %d\n", + ret ); goto exit; } @@ -120,10 +121,11 @@ int main( int argc, char *argv[] ) } i = 0; - while( fscanf( f, "%02X", &c ) > 0 && i < (int) sizeof( buf ) ) + { buf[i++] = (unsigned char) c; + } fclose( f ); @@ -136,7 +138,8 @@ int main( int argc, char *argv[] ) if( ( ret = mbedtls_pk_decrypt( &pk, buf, i, result, &olen, sizeof(result), mbedtls_ctr_drbg_random, &ctr_drbg ) ) != 0 ) { - mbedtls_printf( " failed\n ! mbedtls_pk_decrypt returned -0x%04x\n", -ret ); + mbedtls_printf( " failed\n ! mbedtls_pk_decrypt returned -0x%04x\n", + -ret ); goto exit; } @@ -155,7 +158,7 @@ exit: #if defined(MBEDTLS_ERROR_C) if( ret != 0 ) { - mbedtls_strerror( ret, (char *) buf, sizeof(buf) ); + mbedtls_strerror( ret, (char *) buf, sizeof( buf ) ); mbedtls_printf( " ! Last error was: %s\n", buf ); } #endif diff --git a/programs/pkey/pk_encrypt.c b/programs/pkey/pk_encrypt.c index e27acbeaa..2b6ad52e6 100644 --- a/programs/pkey/pk_encrypt.c +++ b/programs/pkey/pk_encrypt.c @@ -87,11 +87,12 @@ int main( int argc, char *argv[] ) mbedtls_printf( "\n . Seeding the random number generator..." ); fflush( stdout ); - if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy, - (const unsigned char *) pers, - strlen( pers ) ) ) != 0 ) + if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, + &entropy, (const unsigned char *) pers, + strlen( pers ) ) ) != 0 ) { - mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned -0x%04x\n", -ret ); + mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned -0x%04x\n", + -ret ); goto exit; } @@ -122,7 +123,8 @@ int main( int argc, char *argv[] ) buf, &olen, sizeof(buf), mbedtls_ctr_drbg_random, &ctr_drbg ) ) != 0 ) { - mbedtls_printf( " failed\n ! mbedtls_pk_encrypt returned -0x%04x\n", -ret ); + mbedtls_printf( " failed\n ! mbedtls_pk_encrypt returned -0x%04x\n", + -ret ); goto exit; } @@ -131,15 +133,17 @@ int main( int argc, char *argv[] ) */ if( ( f = fopen( "result-enc.txt", "wb+" ) ) == NULL ) { - ret = 1; - mbedtls_printf( " failed\n ! Could not create %s\n\n", "result-enc.txt" ); + mbedtls_printf( " failed\n ! Could not create %s\n\n", + "result-enc.txt" ); ret = 1; goto exit; } for( i = 0; i < olen; i++ ) + { mbedtls_fprintf( f, "%02X%s", buf[i], ( i + 1 ) % 16 == 0 ? "\r\n" : " " ); + } fclose( f ); @@ -154,7 +158,7 @@ exit: #if defined(MBEDTLS_ERROR_C) if( ret != 0 ) { - mbedtls_strerror( ret, (char *) buf, sizeof(buf) ); + mbedtls_strerror( ret, (char *) buf, sizeof( buf ) ); mbedtls_printf( " ! Last error was: %s\n", buf ); } #endif From badbe80c7f0a2f65ab497c8dbeca5f6a9d55ce56 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Thu, 23 Aug 2018 15:56:03 +0100 Subject: [PATCH 5/5] pk_encrypt: Uniformize debugging output --- programs/pkey/pk_decrypt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/programs/pkey/pk_decrypt.c b/programs/pkey/pk_decrypt.c index 15ff99f4b..84ed4e918 100644 --- a/programs/pkey/pk_decrypt.c +++ b/programs/pkey/pk_decrypt.c @@ -94,8 +94,8 @@ int main( int argc, char *argv[] ) &entropy, (const unsigned char *) pers, strlen( pers ) ) ) != 0 ) { - mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned %d\n", - ret ); + mbedtls_printf( " failed\n ! mbedtls_ctr_drbg_seed returned -0x%04x\n", + -ret ); goto exit; }