Seg fault from d2i_RSAPrivateKey_fp

[Nick]

Calling d2i_RSAPrivateKey_fp with the address of a non-NULL 2nd param
yields a seg fault for me.  It seems to work if I pass the address of a
NULL ptr instead (commented out in the repro code below).

I'm calling it in the same manner that I call d2i_X509_fp which also
works.


Environment:
OpenSSL 1.0.1c  and  1.0.1e
x86 Linux (Gentoo)
GCC 4.5.4  and  4.7.2

Following is a small repro (attached as well), command to gen key,
compile & run app, and get backtrace:

//----------------------------------------------------------------
#include <openssl/rsa.h>
#include <openssl/x509.h>

#include <iostream>
#include <stdio.h>

using namespace std;


int main(int argc, char **argv)
{
        if(argc != 2)
        {
                cout << "Usage: " << argv[0] << " <DER private key file>" << 
endl;
                return 0;
        }

        cout << "Opening private key file..." << flush;
        FILE *pFile(fopen("./Input/PrivateKey1.der", "rb") );
        if(!pFile)
        {
                cerr << "Failed to open private key file." << endl;
                return -1;
        }
        cout << "done." << endl;

        cout << "Decoding RSA private key..." << flush;

        RSA rsa;
        RSA *pTmpRsa(&rsa);                     // seg fault
//      RSA *pTmpRsa(NULL);                     // works
        RSA *pRSA = d2i_RSAPrivateKey_fp(pFile, &pTmpRsa);
        if(!pRSA)
        {
                cerr << "Failed to decode private key." << endl;
                return -1;
        }
        cout << "done." << endl;

        RSA_free(pRSA);

        return 0;
}
//----------------------------------------------------------------

Command to generate key, compile app, run it, and get the backtrace:

$ openssl genrsa -out ./PrivateKey1.pem 2048 && openssl rsa -inform PEM
-outform DER -in ./PrivateKey1.pem -out ./PrivateKey1.der && g++ -g
main.cpp -lcrypto && ./a.out ./PrivateKey1.der

Generating RSA private key, 2048 bit long modulus
........................+++
.....+++
e is 65537 (0x10001)
writing RSA key
Opening private key file...done.
Decoding RSA private key...Segmentation fault (core dumped)


$ gdb ./a.out ./core 
GNU gdb (Gentoo 7.5 p1) 7.5
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show
copying"
and "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.gentoo.org/>...
Reading symbols
from /home/nick/src/tools/LoadDerPrivateKeyFromFile/a.out...done.
[New LWP 2692]

warning: Could not load shared library symbols for linux-gate.so.1.
Do you need "set solib-search-path" or "set sysroot"?
Core was generated by `./a.out ./PrivateKey1.der'.
Program terminated with signal 11, Segmentation fault.
#0  0xb7646ded in BN_bin2bn ()
from ../../3rdParty/build/lib/libcrypto.so.1.0.0
(gdb) bt
#0  0xb7646ded in BN_bin2bn ()
from ../../3rdParty/build/lib/libcrypto.so.1.0.0
#1  0x00000041 in ?? ()
#2  0x00000101 in ?? ()
#3  0xb7646904 in BN_new ()
from ../../3rdParty/build/lib/libcrypto.so.1.0.0
#4  0x00000014 in ?? ()
#5  0xb772b544 in ?? () from ../../3rdParty/build/lib/libcrypto.so.1.0.0
Backtrace stopped: previous frame inner to this frame (corrupt stack?)


#include <openssl/rsa.h>
#include <openssl/x509.h>

#include <iostream>
#include <stdio.h>

using namespace std;


int main(int argc, char **argv)
{
	if(argc != 2)
	{
		cout << "Usage: " << argv[0] << " <DER private key file>" << endl;
		return 0;
	}

	cout << "Opening private key file..." << flush;
	FILE *pFile(fopen("./Input/PrivateKey1.der", "rb") );
	if(!pFile)
	{
		cerr << "Failed to open private key file." << endl;
		return -1;
	}
	cout << "done." << endl;

	cout << "Decoding RSA private key..." << flush;

	RSA rsa;
	RSA *pTmpRsa(&rsa);			// seg fault
//	RSA *pTmpRsa(NULL);			// works
	RSA *pRSA = d2i_RSAPrivateKey_fp(pFile, &pTmpRsa);
	if(!pRSA)
	{
		cerr << "Failed to decode private key." << endl;
		return -1;
	}
	cout << "done." << endl;

	RSA_free(pRSA);

	return 0;
}