Use of HMAC (stand-alone)

I am using the "allegedly currently valid to use" HMAC function in a 
stand-alone program -- no other OpenSSL functions.  It correctly computes 
the HMACs that I need to validate an incoming data stream (from Stripe, if 
it matters.)

The documentation SAYS I do not need to clean up or initialize the engine 
when using this -- and only this -- function.   I am NOT passing it NULL 
for the output buffer (that is, I'm handing it an existing and known good 
buffer for the MAC); the call is:

sigptr = HMAC(EVP_sha256(), sec_it, strlen(sec_it), (unsigned char *) in, 
strlen(in), signature, &siglen);

"signature" is defined as:
static  unsigned char   signature[EVP_MAX_MD_SIZE];

So there should be no issue with any possible overflow nor am I requesting 
a dynamic allocation for the signature from the library.

However, sometimes (not in every case) on exit (normal termination, 
exit(0)) I am getting a core dump with a SEGV in some part of the OpenSSL 
cleanup code which appears to have hooked _atexit.

Do I need to issue OPENSSL_init() and OPENSSL_cleanup() calls to avoid 
this?  It doesn't impact the function of the executable itself since it 
occurs after all internal cleanup is complete, but the log entries for the 
SEGV are more than a bit annoying.  They do not occur in *every* instance 
either.

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/0547ec2e-d326-4945-9ee8-594fbd38a939n%40openssl.org.