wahern / luaossl

Most comprehensive OpenSSL module in the Lua universe.
http://25thandclement.com/~william/projects/luaossl.html
Other
140 stars 49 forks source link

Fix use-after-free in error message construction #217

Open mwild1 opened 1 month ago

mwild1 commented 1 month ago

Calling ERR_clear_error() releases the buffers that hold the path/filename, so we need to push those to Lua (which will copy them) before they are released.

The problem can be verified with valgrind, or indeed just by running it on my machine which shows random memory contents prefixed to the error message string.