Closed nefigtut closed 1 month ago
Hi @nefigtut , thank you for raising the issue. We will look into this.
Can you give the reproduction steps with openscanhub security scanner ?
hi, unfortunately, not. i have used our internal corporate osh instance which is not accessible from the outside. i'm not sure here, osh home page (https://openscanhub.dev/) says:
How to use it? It is running as a Fedora service (you would need Fedora's infrastructure access credentials). Alternatively, you can use it on your local system by following the developer documentation.
alternatively, i believe, if you provide me a fixed package, i can scan it in our internal instance.
The mem leak issues had been fixed based on the details you provided. We could not reproduce the issues with the security scanner though. We will release the package in the mid September.
thank you, Venkatesh, most appreciated.
hi, openscanhub code security scanner reports a number of resource leaks in the qatengine code:
Defect type: RESOURCE_LEAK QAT_Engine-1.6.0/qat_hw_ecx.c:557:13: leaked_storage: Freeing "key" without freeing its pointer field "lock" leaks the storage that "lock" points to. QAT_Engine-1.6.0/qat_hw_ecx.c:315:9: leaked_storage: Freeing "key" without freeing its pointer field "lock" leaks the storage that "lock" points to. QAT_Engine-1.6.0/qat_hw_ecx.c:249:9: leaked_storage: Freeing "key" without freeing its pointer field "lock" leaks the storage that "lock" points to.
indeed,
ECX_KEY *key
is allocated and in certain cases its.lock
field is initiated and a lock structure is allocated. later, whenkey
is freed byOPENSSL_free(key)
thenkey->lock
is not freed but leaked:It looks like
CRYPTO_THREAD_lock_free()
(?? not sure here) should be added to all instances ofOPENSSL_free(key)
.