lukechilds/node - node - Gitea: Git with a cup of tea

History

Ben Noordhuis 0dcbecd32b crypto: fix uninitialized memory access in openssl ASN1_STRING_to_UTF8() passes an ASN1_STRING to ASN1_STRING_set() but forgot to initialize the `length` field. Fixes the following valgrind error: $ valgrind -q --track-origins=yes --num-callers=19 \ out/Debug/node test/simple/test-tls-client-abort.js ==2690== Conditional jump or move depends on uninitialised value(s) ==2690== at 0x784B69: ASN1_STRING_set (asn1_lib.c:382) ==2690== by 0x809564: ASN1_mbstring_ncopy (a_mbstr.c:204) ==2690== by 0x8090F0: ASN1_mbstring_copy (a_mbstr.c:86) ==2690== by 0x782F1F: ASN1_STRING_to_UTF8 (a_strex.c:570) ==2690== by 0x78F090: asn1_string_canon (x_name.c:409) ==2690== by 0x78EF17: x509_name_canon (x_name.c:354) ==2690== by 0x78EA7D: x509_name_ex_d2i (x_name.c:210) ==2690== by 0x788058: ASN1_item_ex_d2i (tasn_dec.c:239) ==2690== by 0x7890D4: asn1_template_noexp_d2i (tasn_dec.c:746) ==2690== by 0x788CB6: asn1_template_ex_d2i (tasn_dec.c:607) ==2690== by 0x78877A: ASN1_item_ex_d2i (tasn_dec.c:448) ==2690== by 0x7890D4: asn1_template_noexp_d2i (tasn_dec.c:746) ==2690== by 0x788CB6: asn1_template_ex_d2i (tasn_dec.c:607) ==2690== by 0x78877A: ASN1_item_ex_d2i (tasn_dec.c:448) ==2690== by 0x787C93: ASN1_item_d2i (tasn_dec.c:136) ==2690== by 0x78F5E4: d2i_X509 (x_x509.c:141) ==2690== by 0x7C9B91: PEM_ASN1_read_bio (pem_oth.c:81) ==2690== by 0x7CA506: PEM_read_bio_X509 (pem_x509.c:67) ==2690== by 0x703C9A: node::crypto::SecureContext::AddRootCerts(v8::Arguments const&) (node_crypto.cc:497) ==2690== Uninitialised value was created by a stack allocation ==2690== at 0x782E89: ASN1_STRING_to_UTF8 (a_strex.c:560)		13 years ago
..
cares	deps: upgrade cares to 213f2b7	12 years ago
http_parser	deps: upgrade http_parser to ad3b631	13 years ago
npm	npm: Upgrade to 1.2.12	12 years ago
openssl	crypto: fix uninitialized memory access in openssl	12 years ago
uv	deps: upgrade libuv to 034ea31	12 years ago
v8	V8: Reapply floating patches	12 years ago
zlib	zlib: compile without -ansi	13 years ago