[openssl/openssl] 86a635: Fix double-free of tlsmac in cipher dupctx impleme...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 86a6357d1d3accc3278cdf21590759ae861d694a
      https://github.com/openssl/openssl/commit/86a6357d1d3accc3278cdf21590759ae861d694a
  Author: Acture <[email protected]>
  Date:   2026-08-08 (Sat, 08 Aug 2026)

  Changed paths:
    M providers/implementations/ciphers/cipher_aes.c
    M providers/implementations/ciphers/cipher_aes_cbc_hmac_sha.c
    M providers/implementations/ciphers/cipher_aes_cbc_hmac_sha_etm.c
    M providers/implementations/ciphers/cipher_aes_wrp.c
    M providers/implementations/ciphers/cipher_chacha20.c
    M providers/implementations/ciphers/cipher_chacha20_poly1305.c
    M providers/implementations/ciphers/cipher_rc4_hmac_md5.c
    M providers/implementations/ciphers/ciphercommon.c
    M providers/implementations/include/prov/ciphercommon.h
    M test/build.info
    A test/cipher_dupctx_test.c
    A test/recipes/30-test_cipher_dupctx.t

  Log Message:
  -----------
  Fix double-free of tlsmac in cipher dupctx implementations

Multiple cipher dupctx functions perform shallow copies (via
OPENSSL_memdup or *dctx = *sctx through IMPLEMENT_CIPHER_HW_COPYCTX)
without deep-copying the heap-allocated tlsmac buffer. When both the
original and duplicated contexts are freed, ossl_cipher_generic_reset_ctx
calls OPENSSL_free(ctx->tlsmac) twice on the same address.

Add ossl_cipher_generic_dupctx_tlsmac() as a centralized helper that
deep-copies tlsmac after any shallow dupctx copy. Apply it to all
affected implementations listed in #30548, plus cipher_aes_wrp and
cipher_chacha20 which had hand-rolled fixes that are now unified.

Fixes #30548

Reviewed-by: Frederik Wedel-Heinen <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Reviewed-by: Tom Cosgrove <[email protected]>
MergeDate: Sat Aug  8 15:12:21 2026
(Merged from https://github.com/openssl/openssl/pull/30603)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/2fd42c-86a635%40github.com.