[openssl/openssl] 77f492: oqs noted a double free recently:

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 77f492f29f882e07d57e16920138d991dc9af018
      https://github.com/openssl/openssl/commit/77f492f29f882e07d57e1692013=
8d991dc9af018
  Author: Neil Horman <[email protected]>
  Date:   2026-08-01 (Sat, 01 Aug 2026)

  Changed paths:
    M crypto/evp/evp_fetch.c

  Log Message:
  -----------
  oqs noted a double free recently:

https://github.com/open-quantum-safe/oqs-provider/pull/805#issuecomment-503=
4437500

Its happening because, recently we made some fixes to account for
providers that request no-caching fetches, which all seems to work
reasonably well.

Except for the corner case oqs recently exposed, in which the provider
may request the caching of some algorithms, but not others.  When this
occurs, the core libcrypto creates a temporary store for those
requested, but stored the cachable ones in the libctx store.

inner_evp_generic_fetch treats the presence of an allocated tmp store as
implying that all algorithms fetched are non-cacheable, even if some
are.  The result is that, for those cacheable items, they also get
treated as non-cacheable, missing the extra ref count taken when they
are added to the method store cache.  As a result, they get freed while
still in use, and you get the issue referenced above.

Instead of assuming that a tmp_store means all algorithms are
non-cacheable, instead, try to look the method up in the tmp_store
cache, and cache it if its not found (i.e. its not in the temp store)

Fixes https://github.com/open-quantum-safe/oqs-provider/pull/805

Reviewed-by: Sa=C5=A1a Nedv=C4=9Bdick=C3=BD <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Sat Aug  1 14:30:49 2026
(Merged from https://github.com/openssl/openssl/pull/32077)



To unsubscribe from these emails, change your notification settings at http=
s://github.com/openssl/openssl/settings/notifications

--=20
You received this message because you are subscribed to the Google Groups "=
openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-commits/openssl/openssl/push/refs/heads/master/cdcb6a-77f492%40g=
ithub.com.