On 11/24/2015 05:06 AM, Pascal Cuoq via RT wrote: > This issue is similar in nature to 4151 > (http://www.mail-archive.com/openssl-dev@openssl.org/msg40950.html ): it is > about a dangling pointer being used, but not used for dereferencing, so it's > not a memory error. The dangling pointer is used in a comparison. > > The function int_thread_del_item can reach the point were it calls > “lh_ERR_STATE_free(int_thread_hash);” with hash == int_thread_hash. That > attached patch prints a message like “hash == int_thread_hash == 0xb2a6d0” > when this happens. Just after the call to lh_ERR_STATE_free, both hash and > int_thread_hash contain dangling pointers. The variable int_thread_hash is > immediately set to NULL. > > The problem that I am reporting is that just afterwards, &hash is passed to > the function int_thread_release: > > https://github.com/openssl/openssl/blob/079a1a9014b89661f0a612a5a9724ad9c77f21a3/crypto/err/err.c#L412 > >
Note that per J.2 of C99 (n1256.pdf page 503, document-internal numbering), using the value of a pointer that refers to space deallocated by a call to free is undefined behavior, even for just comparison. (This is covered in passing at http://web.torek.net/torek/c/numbers2.html) -Ben _______________________________________________ openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
