# [PATCH] one more possible seg fault in openssl

- Thread: https://externals.io/message/13559
- Original archive: https://news-web.php.net/php.internals/13559
- Started by Kamesh Jayachandran on 2004-10-27T10:36:17+00:00
- Messages: 2
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #13559 — Kamesh Jayachandran — 2004-10-27T10:36:17+00:00

URL: https://externals.io/message/13559#13559

Hi Wez,
<?php
$dn = array(
   "countryName" => "UK",
   "stateOrProvinceName" => "Somerset",
   "localityName" => "Glastonbury",
   "organizationName" => "The Brain Room Limited",
   "organizationalUnitName" => "PHP Documentation Team",
   "commonName" => "Wez Furlong",
   "emailAddress" => "wez@example.com"
);
// Non-existent or null private key
$csr = openssl_csr_new($dn, $privkey1);
?>
will also cause the double free of privkey and hence potential seg
fault.
openssl_csr_new tries to create a fresh private key and adds to the
resource list and fails to req.priv_key to null so the dispose function
frees the private key generated. Later when the php_request_shutdown is
called it agains frees the EG(regular_list) this causes the seg fault.

Patch is available at,
http://puggy.symonds.net/~kameshj/openssl.c.patch

With regards
Kamesh Jayachandran

---

## #13560 — Wez Furlong — 2004-10-27T11:11:49+00:00

URL: https://externals.io/message/13559#13560 · In reply to: #13559

Committed; thanks!


On Wed, 27 Oct 2004 03:36:17 -0700, Kamesh Jayachandran
<kameshj@fastmail.fm> wrote:
> Hi Wez,
> <?php
> $dn = array(
>    "countryName" => "UK",
>    "stateOrProvinceName" => "Somerset",
>    "localityName" => "Glastonbury",
>    "organizationName" => "The Brain Room Limited",
>    "organizationalUnitName" => "PHP Documentation Team",
>    "commonName" => "Wez Furlong",
>    "emailAddress" => "wez@example.com"
> );
> // Non-existent or null private key
> $csr = openssl_csr_new($dn, $privkey1);
> ?>
> will also cause the double free of privkey and hence potential seg
> fault.
> openssl_csr_new tries to create a fresh private key and adds to the
> resource list and fails to req.priv_key to null so the dispose function
> frees the private key generated. Later when the php_request_shutdown is
> called it agains frees the EG(regular_list) this causes the seg fault.
> 
> Patch is available at,
> http://puggy.symonds.net/~kameshj/openssl.c.patch
> 
> With regards
> Kamesh Jayachandran