search

microsoft / go-crypto-winnative

Go crypto backend for Windows using CNG
MIT License
28 stars 3 forks source link

Fix use-after-free and double-free bugs on ECDH keys #35

Closed qmuntal closed 1 year ago

qmuntal commented 1 year ago

This PR fixes a couple of memory issues produced when calling PrivateKeyECDH.PublicKey().

The underlying problem is that this method creates a public key that shares the same bcrypt.KEY_HANDLE instance with the private key. This KEY_HANDLE is freed when any of the keys is garbage collected, leaving the other key with an invalid KEY_HANDLE that will probably crash the application when it is used.

I've also improved the test pipeline so it has more chances to detect this memory bugs.

Thanks @dagood for finding and investigating this issue.