dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-07-01 21:31:14 +02:00
Code Releases Activity

ima-evm-utils: Fix EVP_MD_CTX leak in ima_calc_hash

Browse Source 
When pctx is allocated using EVP_MD_CTX_new() it should be freed.
Found with ASan.

Fixes: 81010f0 ("ima-evm-utils: Add backward compatible support for openssl 1.1")
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Vitaly Chikunov
2019-07-08 02:48:33 +03:00
committed by Mimi Zohar
parent 30add9c2eb
commit faea7ca2b1
1 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/libimaevm.c
View File

@ -252,19 +252,21 @@ int ima_calc_hash(const char *file, uint8_t *hash)
err = lstat(file, &st); err = lstat(file, &st);
if (err < 0) { if (err < 0) {
log_err("Failed to stat: %s\n", file); log_err("Failed to stat: %s\n", file);
return err; goto err;
} }
md = EVP_get_digestbyname(params.hash_algo); md = EVP_get_digestbyname(params.hash_algo);
if (!md) { if (!md) {
log_err("EVP_get_digestbyname(%s) failed\n", params.hash_algo); log_err("EVP_get_digestbyname(%s) failed\n", params.hash_algo);
return 1; err = 1;
goto err;
} }
err = EVP_DigestInit(pctx, md); err = EVP_DigestInit(pctx, md);
if (!err) { if (!err) {
log_err("EVP_DigestInit() failed\n"); log_err("EVP_DigestInit() failed\n");
return 1; err = 1;
goto err;
} }
switch (st.st_mode & S_IFMT) { switch (st.st_mode & S_IFMT) {
@ -283,19 +285,25 @@ int ima_calc_hash(const char *file, uint8_t *hash)
break; break;
default: default:
log_errno("Unsupported file type"); log_errno("Unsupported file type");
return -1; err = -1;
goto err;
} }
if (err) if (err)
return err; goto err;
err = EVP_DigestFinal(pctx, hash, &mdlen); err = EVP_DigestFinal(pctx, hash, &mdlen);
if (!err) { if (!err) {
log_err("EVP_DigestFinal() failed\n"); log_err("EVP_DigestFinal() failed\n");
return 1; err = 1;
goto err;
} }
err = mdlen;
return mdlen; err:
#if OPENSSL_VERSION_NUMBER >= 0x10100000
EVP_MD_CTX_free(pctx);
#endif
return err;
} }
EVP_PKEY *read_pub_pkey(const char *keyfile, int x509) EVP_PKEY *read_pub_pkey(const char *keyfile, int x509)