NotificationsYou must be signed in to change notification settings
Fork5k
Star17.9k

Commite835e89

committed

Fix memory leak when rejecting bogus DH parameters.

While back-patchinge0e569e, I noted that there were some otherplaces where we ought to be applying DH_free(); namely, where weload some DH parameters from a file and then reject them as notbeing sufficiently secure. While it seems really unlikely thatanybody would hit these code paths in production, let alone doso repeatedly, let's fix it for consistency.Back-patch to v10 where this code was introduced.Discussion:https://postgr.es/m/16160-18367e56e9a28264@postgresql.org

1 parentf0c2a5b commite835e89Copy full SHA for e835e89

File tree

1 file changed

-0

lines changed

src/backend/libpq
- be-secure-openssl.c

1 file changed

-0

lines changed

`‎src/backend/libpq/be-secure-openssl.c`

Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -922,13 +922,15 @@ load_dh_file(char *filename, bool isServerStart)`
`922`	`922`	`(errcode(ERRCODE_CONFIG_FILE_ERROR),`
`923`	`923`	`errmsg("invalid DH parameters: %s",`
`924`	`924`	`SSLerrmessage(ERR_get_error()))));`
	`925`	`+DH_free(dh);`
`925`	`926`	`returnNULL;`
`926`	`927`	`}`
`927`	`928`	`if (codes&DH_CHECK_P_NOT_PRIME)`
`928`	`929`	`{`
`929`	`930`	`ereport(isServerStart ?FATAL :LOG,`
`930`	`931`	`(errcode(ERRCODE_CONFIG_FILE_ERROR),`
`931`	`932`	`errmsg("invalid DH parameters: p is not prime")));`
	`933`	`+DH_free(dh);`
`932`	`934`	`returnNULL;`
`933`	`935`	`}`
`934`	`936`	`if ((codes&DH_NOT_SUITABLE_GENERATOR)&&`
`@@ -937,6 +939,7 @@ load_dh_file(char *filename, bool isServerStart)`
`937`	`939`	`ereport(isServerStart ?FATAL :LOG,`
`938`	`940`	`(errcode(ERRCODE_CONFIG_FILE_ERROR),`
`939`	`941`	`errmsg("invalid DH parameters: neither suitable generator or safe prime")));`
	`942`	`+DH_free(dh);`
`940`	`943`	`returnNULL;`
`941`	`944`	`}`
`942`	`945`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commite835e89

File tree

1 file changed

1 file changed

`‎src/backend/libpq/be-secure-openssl.c`

0 commit comments