Blame SOURCES/openssl-fips-0.9.8e-cve-2009-4355.patch

c4366c
Modify compression code so it frees up structures without using the
c4366c
ex_data callbacks. This works around a problem where some applications
c4366c
call CRYPTO_free_all_ex_data() before application exit (e.g. when
c4366c
restarting) then use compression (e.g. SSL with compression) later.
c4366c
This results in significant per-connection memory leaks and
c4366c
has caused some security issues including CVE-2008-1678 and
c4366c
CVE-2009-4355. [Steve Henson]
c4366c
diff -up openssl-fips-0.9.8e/crypto/comp/c_zlib.c.compleak openssl-fips-0.9.8e/crypto/comp/c_zlib.c
c4366c
--- openssl-fips-0.9.8e/crypto/comp/c_zlib.c.compleak	2007-02-14 22:50:26.000000000 +0100
c4366c
+++ openssl-fips-0.9.8e/crypto/comp/c_zlib.c	2010-01-14 09:32:46.000000000 +0100
c4366c
@@ -133,15 +133,6 @@ struct zlib_state
c4366c
 
c4366c
 static int zlib_stateful_ex_idx = -1;
c4366c
 
c4366c
-static void zlib_stateful_free_ex_data(void *obj, void *item,
c4366c
-	CRYPTO_EX_DATA *ad, int ind,long argl, void *argp)
c4366c
-	{
c4366c
-	struct zlib_state *state = (struct zlib_state *)item;
c4366c
-	inflateEnd(&state->istream);
c4366c
-	deflateEnd(&state->ostream);
c4366c
-	OPENSSL_free(state);
c4366c
-	}
c4366c
-
c4366c
 static int zlib_stateful_init(COMP_CTX *ctx)
c4366c
 	{
c4366c
 	int err;
c4366c
@@ -185,6 +176,12 @@ static int zlib_stateful_init(COMP_CTX *
c4366c
 
c4366c
 static void zlib_stateful_finish(COMP_CTX *ctx)
c4366c
 	{
c4366c
+	struct zlib_state *state =
c4366c
+		(struct zlib_state *)CRYPTO_get_ex_data(&ctx->ex_data,
c4366c
+			zlib_stateful_ex_idx);
c4366c
+	inflateEnd(&state->istream);
c4366c
+	deflateEnd(&state->ostream);
c4366c
+	OPENSSL_free(state);
c4366c
 	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_COMP,ctx,&ctx->ex_data);
c4366c
 	}
c4366c
 
c4366c
@@ -396,7 +393,7 @@ COMP_METHOD *COMP_zlib(void)
c4366c
 			if (zlib_stateful_ex_idx == -1)
c4366c
 				zlib_stateful_ex_idx =
c4366c
 					CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_COMP,
c4366c
-						0,NULL,NULL,NULL,zlib_stateful_free_ex_data);
c4366c
+						0,NULL,NULL,NULL,NULL);
c4366c
 			CRYPTO_w_unlock(CRYPTO_LOCK_COMP);
c4366c
 			if (zlib_stateful_ex_idx == -1)
c4366c
 				goto err;