search

microsoft / go-crypto-openssl

Go crypto backend for Linux using OpenSSL
MIT License
55 stars 14 forks source link

Fix use-after-free and double-free bugs on ECDH keys #46

Closed qmuntal closed 1 year ago

qmuntal commented 1 year ago

This PR fixes a couple of memory issues produced when calling PrivateKeyECDH.PublicKey().

The underlying problem is that this method creates a public key that shares the same OpenSSL EVP_PKEY instance with the private key. This EVP_KEY is freed when any of the keys is garbage collected, leaving the other key with an invalid EVP_PKEY that will probably crash the application when it is used.

I've also improved the test pipeline so it has more chances to detect this memory bugs.