BUG #16070: A double-free bug in interfaces/libpq/fe-secure-openssl.c
От | PG Bug reporting form |
---|---|
Тема | BUG #16070: A double-free bug in interfaces/libpq/fe-secure-openssl.c |
Дата | |
Msg-id | 16070-ffac944519a43c3f@postgresql.org обсуждение исходный текст |
Ответы |
Re: BUG #16070: A double-free bug in interfaces/libpq/fe-secure-openssl.c
|
Список | pgsql-bugs |
The following bug has been logged on the website: Bug reference: 16070 Logged by: rongxin wu Email address: wurongxin@xmu.edu.cn PostgreSQL version: 10.10 Operating system: ubuntu 18 Description: In https://github.com/postgres/postgres/blob/REL_10_STABLE/src/interfaces/libpq/fe-secure-openssl.c, at Line 1206, it would call the function "ENGINE_finish" and free conn->engine. At Line 1207, it would call the function "ENGINE_free" and free conn->engine again. This would lead to a double free bug. Please read the following code snippet. https://github.com/postgres/postgres/blob/REL_10_STABLE/src/interfaces/libpq/fe-secure-openssl.c 896. static int 897. initialize_SSL(PGconn *conn) 898. { ... 1206. ENGINE_finish(conn->engine); 1207. ENGINE_free(conn->engine); ... int ENGINE_finish(ENGINE *e) { ... to_return = engine_unlocked_finish(e, 1); ... return to_return; } int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers) { ... if (!engine_free_util(e, 0)) { ENGINEerr(ENGINE_F_ENGINE_UNLOCKED_FINISH, ENGINE_R_FINISH_FAILED); return 0; } return to_return; } int engine_free_util(ENGINE *e, int not_locked) { ... OPENSSL_free(e); // a free wrapper return 1; } int ENGINE_free(ENGINE *e) { return engine_free_util(e, 1); } Please help to check. Thanks.
В списке pgsql-bugs по дате отправления: