Re: [openssl-dev] Heap corruption in asn1_item_ex_combine_new()

2015-04-01 Thread Dr. Stephen Henson
On Tue, Mar 31, 2015, Julien Kauffmann wrote: if (!combine) *pval = NULL; I'd suggest deleting the two lines above. The structure should be cleared without this and the above line is wrong for non pointer fields anyway. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer.

Re: [openssl-dev] Heap corruption in asn1_item_ex_combine_new()

2015-04-01 Thread Dr. Stephen Henson
On Tue, Mar 31, 2015, Julien Kauffmann wrote: Basically what happens is that, somewhere inside the call to PEM_write_bio_ECPrivateKey(), an ASN1 sequence of 3 elements is allocated. The corresponding code is as follow (in crypto/asn1/tasn_new.c:181): if (!combine) { *pval =

Re: [openssl-dev] Heap corruption in asn1_item_ex_combine_new()

2015-04-01 Thread Julien Kauffmann
Hi, I can confirm that removing those two lines solves the problem. I actually already tried to add this: EC_GROUP_set_asn1_flag(group, OPENSSL_EC_NAMED_CURVE); but while it solved the problem for writing the key, the problem would still arise while parsing a key generated without the flag

[openssl-dev] Heap corruption in asn1_item_ex_combine_new()

2015-03-31 Thread Julien Kauffmann
Hi, I've been hunting down a heap corruption bug in OpenSSL for the past few days and I found the guilty instruction. At this point, I know what causes the problem but I am unsure how to solve it nicely. Here is the minimal sample I used to reproduce the issue on the latest 1.0.2a (happens