Re: Use of HMAC (stand-alone)

What version of openssl are you using, and do you have a reproducer program
you can share that illustrates the problem (or a backtracke of the
segfault)?
Neil


On Mon, Mar 2, 2026 at 9:39 AM Tickerguy <[email protected]> wrote:

> I am using the "allegedly currently valid to use" HMAC function in a
> stand-alone program -- no other OpenSSL functions.  It correctly computes
> the HMACs that I need to validate an incoming data stream (from Stripe, if
> it matters.)
>
> The documentation SAYS I do not need to clean up or initialize the engine
> when using this -- and only this -- function.   I am NOT passing it NULL
> for the output buffer (that is, I'm handing it an existing and known good
> buffer for the MAC); the call is:
>
> sigptr = HMAC(EVP_sha256(), sec_it, strlen(sec_it), (unsigned char *) in,
> strlen(in), signature, &siglen);
>
> "signature" is defined as:
> static  unsigned char   signature[EVP_MAX_MD_SIZE];
>
> So there should be no issue with any possible overflow nor am I requesting
> a dynamic allocation for the signature from the library.
>
> However, sometimes (not in every case) on exit (normal termination,
> exit(0)) I am getting a core dump with a SEGV in some part of the OpenSSL
> cleanup code which appears to have hooked _atexit.
>
> Do I need to issue OPENSSL_init() and OPENSSL_cleanup() calls to avoid
> this?  It doesn't impact the function of the executable itself since it
> occurs after all internal cleanup is complete, but the log entries for the
> SEGV are more than a bit annoying.  They do not occur in *every* instance
> either.
>
> --
> You received this message because you are subscribed to the Google Groups
> "openssl-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
> To view this discussion visit
> https://groups.google.com/a/openssl.org/d/msgid/openssl-users/0547ec2e-d326-4945-9ee8-594fbd38a939n%40openssl.org
> <https://groups.google.com/a/openssl.org/d/msgid/openssl-users/0547ec2e-d326-4945-9ee8-594fbd38a939n%40openssl.org?utm_medium=email&utm_source=footer>
> .
>

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/CAJbOq14Ub2ZapSS5yNQvHcuJ71ej5%3DOL4yNfxqyO_qs%3D%3DCJa7w%40mail.gmail.com.