From 74437ca52b90408e93b26f00d262641a6145cfd6 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Tue, 6 Oct 2026 18:20:29 +0200 Subject: [PATCH] package/softhsm2: fix build with OpenSSL 4.0.0 Signed-off-by: Bernd Kuhls Signed-off-by: Thomas Petazzoni --- ...mory-leak-in-OSSL-byteString2oid-863.patch | 49 ++++++++++ ...in-EdDSA-PrintableString-handling-85.patch | 98 +++++++++++++++++++ 2 files changed, 147 insertions(+) create mode 100644 package/softhsm2/0001-Fix-the-memory-leak-in-OSSL-byteString2oid-863.patch create mode 100644 package/softhsm2/0002-Fix-memory-leak-in-EdDSA-PrintableString-handling-85.patch diff --git a/package/softhsm2/0001-Fix-the-memory-leak-in-OSSL-byteString2oid-863.patch b/package/softhsm2/0001-Fix-the-memory-leak-in-OSSL-byteString2oid-863.patch new file mode 100644 index 0000000000..2defeda775 --- /dev/null +++ b/package/softhsm2/0001-Fix-the-memory-leak-in-OSSL-byteString2oid-863.patch @@ -0,0 +1,49 @@ +From 1b72640ceccaa8fdd775f224c26a53fdaf189da6 Mon Sep 17 00:00:00 2001 +From: Shawn C +Date: Sat, 25 Apr 2026 20:05:34 +0800 +Subject: [PATCH] Fix the memory leak in OSSL::byteString2oid (#863) + +The function `OSSL::byteString2oid` in `SoftHSM2` (OpenSSL backend) +leaks memory when decoding PKCS#11 attribute values as ASN.1 objects +or strings. It calls `d2i_ASN1_OBJECT` and `d2i_ASN1_PRINTABLESTRING` +which allocate new OpenSSL objects, but these objects are never +freed after their NIDs are extracted. + +Signed-off-by: Shawn C + +Upstream: https://github.com/softhsm/SoftHSMv2/commit/57e10cbbe75069be92c7e9720c180a05833481fc + +Signed-off-by: Bernd Kuhls +--- + src/lib/crypto/OSSLUtil.cpp | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/src/lib/crypto/OSSLUtil.cpp b/src/lib/crypto/OSSLUtil.cpp +index 794f80e..d238eca 100644 +--- a/src/lib/crypto/OSSLUtil.cpp ++++ b/src/lib/crypto/OSSLUtil.cpp +@@ -177,8 +177,10 @@ int OSSL::byteString2oid(const ByteString& byteString) + { + return NID_undef; + } +- +- return OBJ_obj2nid(oid); ++ ++ int nid = OBJ_obj2nid(oid); ++ ASN1_OBJECT_free(oid); ++ return nid; + } + else if (pclass == V_ASN1_UNIVERSAL && tag == V_ASN1_PRINTABLESTRING) + { +@@ -204,6 +206,8 @@ int OSSL::byteString2oid(const ByteString& byteString) + { + return EVP_PKEY_X448; + } ++ ++ ASN1_STRING_free(curve_name); + } + + return NID_undef; +-- +2.47.3 + diff --git a/package/softhsm2/0002-Fix-memory-leak-in-EdDSA-PrintableString-handling-85.patch b/package/softhsm2/0002-Fix-memory-leak-in-EdDSA-PrintableString-handling-85.patch new file mode 100644 index 0000000000..f6b9000b13 --- /dev/null +++ b/package/softhsm2/0002-Fix-memory-leak-in-EdDSA-PrintableString-handling-85.patch @@ -0,0 +1,98 @@ +From c7e930156054e901e27149117494d53e9945f734 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ma=C5=82gorzata=20Olsz=C3=B3wka?= + +Date: Sun, 3 May 2026 13:00:07 +0200 +Subject: [PATCH] Fix memory leak in EdDSA PrintableString handling (#858) + +Upstream: https://github.com/softhsm/SoftHSMv2/commit/d23ea09d318c03c033420d065f1c64b019cc94ed + +Signed-off-by: Bernd Kuhls +--- + src/lib/crypto/OSSLUtil.cpp | 37 +++++++++++++++++++++++++------------ + 1 file changed, 25 insertions(+), 12 deletions(-) + +diff --git a/src/lib/crypto/OSSLUtil.cpp b/src/lib/crypto/OSSLUtil.cpp +index d238eca..7763799 100644 +--- a/src/lib/crypto/OSSLUtil.cpp ++++ b/src/lib/crypto/OSSLUtil.cpp +@@ -160,12 +160,14 @@ ByteString OSSL::oid2ByteString(int nid) + // Convert a ByteString to an OpenSSL EVP_PKEY id + int OSSL::byteString2oid(const ByteString& byteString) + { +- ASN1_OBJECT *oid = NULL; +- ASN1_PRINTABLESTRING *curve_name = NULL; ++ ASN1_OBJECT *oid; ++ ASN1_PRINTABLESTRING *curve_name; + const unsigned char *p = byteString.const_byte_str(); + const unsigned char *pp = p; ++ const unsigned char *data; + long length; +- int tag, pclass; ++ int tag, pclass, data_len; ++ int nid = NID_undef; + + ASN1_get_object(&pp, &length, &tag, &pclass, byteString.size()); + if (pclass == V_ASN1_UNIVERSAL && tag == V_ASN1_OBJECT) +@@ -177,39 +179,50 @@ int OSSL::byteString2oid(const ByteString& byteString) + { + return NID_undef; + } +- +- int nid = OBJ_obj2nid(oid); ++ ++ nid = OBJ_obj2nid(oid); + ASN1_OBJECT_free(oid); +- return nid; + } + else if (pclass == V_ASN1_UNIVERSAL && tag == V_ASN1_PRINTABLESTRING) + { + /* The final PKCS#11 3.0 expects curve name encoded as PrintableString */ + curve_name = d2i_ASN1_PRINTABLESTRING(NULL, &p, byteString.size()); + +- if (strcmp((char *)curve_name->data, "edwards25519") == 0) ++ if (curve_name == NULL) ++ { ++ return NID_undef; ++ } ++ ++ data = ASN1_STRING_get0_data(curve_name); ++ data_len = ASN1_STRING_length(curve_name); ++ ++ if (data_len == 12 && memcmp(data, "edwards25519", data_len) == 0) + { ++ ASN1_PRINTABLESTRING_free(curve_name); + return EVP_PKEY_ED25519; + } + +- if (strcmp((char *)curve_name->data, "curve25519") == 0) ++ if (data_len == 10 && memcmp(data, "curve25519", 10) == 0) + { ++ ASN1_PRINTABLESTRING_free(curve_name); + return EVP_PKEY_X25519; + } + +- if (strcmp((char *)curve_name->data, "edwards448") == 0) ++ if (data_len == 10 && memcmp(data, "edwards448", 10) == 0) + { ++ ASN1_PRINTABLESTRING_free(curve_name); + return EVP_PKEY_ED448; + } + +- if (strcmp((char *)curve_name->data, "curve448") == 0) ++ if (data_len == 8 && memcmp(data, "curve448", 8) == 0) + { ++ ASN1_PRINTABLESTRING_free(curve_name); + return EVP_PKEY_X448; + } + +- ASN1_STRING_free(curve_name); ++ ASN1_PRINTABLESTRING_free(curve_name); + } + +- return NID_undef; ++ return nid; + } + #endif +-- +2.47.3 +