[openssl/openssl] ff542b: Fix EVP_CIPHER_CTX leak in BIO_f_cipher() on BIO_d...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: ff542b6de282b903d296e7a53c3bd3f495e3a7d3
      https://github.com/openssl/openssl/commit/ff542b6de282b903d296e7a53c3bd3f495e3a7d3
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-29 (Sat, 29 Aug 2026)

  Changed paths:
    M crypto/evp/bio_enc.c
    M test/bio_enc_test.c

  Log Message:
  -----------
  Fix EVP_CIPHER_CTX leak in BIO_f_cipher() on BIO_dup_chain()

BIO_dup_chain() builds each duplicate BIO via BIO_new(), which for a cipher
BIO runs enc_new() and allocates a fresh EVP_CIPHER_CTX. The BIO_CTRL_DUP
handler then allocated a second context and overwrote the pointer, orphaning
(and leaking) the enc_new() allocation, one leaked EVP_CIPHER_CTX per
duplicated cipher BIO.

Reuse the context that enc_new() already allocated by copying into it,
mirroring the digest filter (bio_md.c). This also removes the redundant
allocation and its failure path.

Add a regression test that dup is an initialized cipher BIO and frees it,
exercising the leak path so it is caught under a leak sanitizer.

Fixes #31803

Reviewed-by: Jakub Zelenka <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Sat Aug 29 12:47:08 2026
(Merged from https://github.com/openssl/openssl/pull/31854)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/052c9e-ff542b%40github.com.