mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-21 08:11:47 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/softhsm2: fix build with OpenSSL 4.0.0

Browse Source 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Bernd Kuhls
2026-10-06 18:20:29 +02:00
committed by Thomas Petazzoni
parent 08ac0bfaaa
commit 74437ca52b
2 changed files with 147 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
package/softhsm2/0001-Fix-the-memory-leak-in-OSSL-byteString2oid-863.patch Normal file
View File

@@ -0,0 +1,49 @@
From 1b72640ceccaa8fdd775f224c26a53fdaf189da6 Mon Sep 17 00:00:00 2001
From: Shawn C <citypw@hardenedlinux.org>
Date: Sat, 25 Apr 2026 20:05:34 +0800
Subject: [PATCH] Fix the memory leak in OSSL::byteString2oid (#863)
The function `OSSL::byteString2oid` in `SoftHSM2` (OpenSSL backend)
leaks memory when decoding PKCS#11 attribute values as ASN.1 objects
or strings. It calls `d2i_ASN1_OBJECT` and `d2i_ASN1_PRINTABLESTRING`
which allocate new OpenSSL objects, but these objects are never
freed after their NIDs are extracted.
Signed-off-by: Shawn C <citypw@hardenedlinux.org>
Upstream: https://github.com/softhsm/SoftHSMv2/commit/57e10cbbe75069be92c7e9720c180a05833481fc
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
src/lib/crypto/OSSLUtil.cpp | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/src/lib/crypto/OSSLUtil.cpp b/src/lib/crypto/OSSLUtil.cpp
index 794f80e..d238eca 100644
--- a/src/lib/crypto/OSSLUtil.cpp
+++ b/src/lib/crypto/OSSLUtil.cpp
@@ -177,8 +177,10 @@ int OSSL::byteString2oid(const ByteString& byteString)
{
return NID_undef;
}
-
- return OBJ_obj2nid(oid);
+
+ int nid = OBJ_obj2nid(oid);
+ ASN1_OBJECT_free(oid);
+ return nid;
}
else if (pclass == V_ASN1_UNIVERSAL && tag == V_ASN1_PRINTABLESTRING)
{
@@ -204,6 +206,8 @@ int OSSL::byteString2oid(const ByteString& byteString)
{
return EVP_PKEY_X448;
}
+
+ ASN1_STRING_free(curve_name);
}
return NID_undef;
--
2.47.3

98
package/softhsm2/0002-Fix-memory-leak-in-EdDSA-PrintableString-handling-85.patch Normal file
View File

@@ -0,0 +1,98 @@
From c7e930156054e901e27149117494d53e9945f734 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ma=C5=82gorzata=20Olsz=C3=B3wka?=
<Malgorzata.Olszowka@stunnel.org>
Date: Sun, 3 May 2026 13:00:07 +0200
Subject: [PATCH] Fix memory leak in EdDSA PrintableString handling (#858)
Upstream: https://github.com/softhsm/SoftHSMv2/commit/d23ea09d318c03c033420d065f1c64b019cc94ed
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
src/lib/crypto/OSSLUtil.cpp | 37 +++++++++++++++++++++++++------------
1 file changed, 25 insertions(+), 12 deletions(-)
diff --git a/src/lib/crypto/OSSLUtil.cpp b/src/lib/crypto/OSSLUtil.cpp
index d238eca..7763799 100644
--- a/src/lib/crypto/OSSLUtil.cpp
+++ b/src/lib/crypto/OSSLUtil.cpp
@@ -160,12 +160,14 @@ ByteString OSSL::oid2ByteString(int nid)
// Convert a ByteString to an OpenSSL EVP_PKEY id
int OSSL::byteString2oid(const ByteString& byteString)
{
- ASN1_OBJECT *oid = NULL;
- ASN1_PRINTABLESTRING *curve_name = NULL;
+ ASN1_OBJECT *oid;
+ ASN1_PRINTABLESTRING *curve_name;
const unsigned char *p = byteString.const_byte_str();
const unsigned char *pp = p;
+ const unsigned char *data;
long length;
- int tag, pclass;
+ int tag, pclass, data_len;
+ int nid = NID_undef;
ASN1_get_object(&pp, &length, &tag, &pclass, byteString.size());
if (pclass == V_ASN1_UNIVERSAL && tag == V_ASN1_OBJECT)
@@ -177,39 +179,50 @@ int OSSL::byteString2oid(const ByteString& byteString)
{
return NID_undef;
}
-
- int nid = OBJ_obj2nid(oid);
+
+ nid = OBJ_obj2nid(oid);
ASN1_OBJECT_free(oid);
- return nid;
}
else if (pclass == V_ASN1_UNIVERSAL && tag == V_ASN1_PRINTABLESTRING)
{
/* The final PKCS#11 3.0 expects curve name encoded as PrintableString */
curve_name = d2i_ASN1_PRINTABLESTRING(NULL, &p, byteString.size());
- if (strcmp((char *)curve_name->data, "edwards25519") == 0)
+ if (curve_name == NULL)
+ {
+ return NID_undef;
+ }
+
+ data = ASN1_STRING_get0_data(curve_name);
+ data_len = ASN1_STRING_length(curve_name);
+
+ if (data_len == 12 && memcmp(data, "edwards25519", data_len) == 0)
{
+ ASN1_PRINTABLESTRING_free(curve_name);
return EVP_PKEY_ED25519;
}
- if (strcmp((char *)curve_name->data, "curve25519") == 0)
+ if (data_len == 10 && memcmp(data, "curve25519", 10) == 0)
{
+ ASN1_PRINTABLESTRING_free(curve_name);
return EVP_PKEY_X25519;
}
- if (strcmp((char *)curve_name->data, "edwards448") == 0)
+ if (data_len == 10 && memcmp(data, "edwards448", 10) == 0)
{
+ ASN1_PRINTABLESTRING_free(curve_name);
return EVP_PKEY_ED448;
}
- if (strcmp((char *)curve_name->data, "curve448") == 0)
+ if (data_len == 8 && memcmp(data, "curve448", 8) == 0)
{
+ ASN1_PRINTABLESTRING_free(curve_name);
return EVP_PKEY_X448;
}
- ASN1_STRING_free(curve_name);
+ ASN1_PRINTABLESTRING_free(curve_name);
}
- return NID_undef;
+ return nid;
}
#endif
--
2.47.3