Commit a857515a09 for openssl.org
commit a857515a0984d869d761a9db194b06e8e8be303f
Author: Greensi7 <adam.tabak04@gmail.com>
Date: Sun Aug 16 23:41:28 2026 +0200
Fix bugs in OSSL_STORE_attach
Unify error handling in OSSL_STORE_attach with OSSL_STORE_open_ex.
If setting loader params fails loader_ctx is closed but not set to NULL.
Which leads to successful return with invalid object.
Fixed by setting loader_ctx to NULL triggering error return path.
If allocation OSSL_STORE_CTX fails after the loader context creation
close the loader context and release the fetched loader.
This covers both OSSL_STORE_CTX allocation failure and UI method setup failure.
Found by : store fuzzer (MFAIL-test)
Assisted-by: ChatGPT:gpt-5.6
Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Sep 15 14:20:01 2026
(Merged from https://github.com/openssl/openssl/pull/32413)
diff --git a/crypto/store/store_lib.c b/crypto/store/store_lib.c
index 23d229b59e..902dd3cf6d 100644
--- a/crypto/store/store_lib.c
+++ b/crypto/store/store_lib.c
@@ -1092,6 +1092,7 @@ OSSL_STORE_CTX *OSSL_STORE_attach(BIO *bp, const char *scheme,
} else if (!loader_set_params(fetched_loader, loader_ctx,
params, propq)) {
(void)fetched_loader->p_close(loader_ctx);
+ loader_ctx = NULL;
OSSL_STORE_LOADER_free(fetched_loader);
fetched_loader = NULL;
}
@@ -1100,20 +1101,16 @@ OSSL_STORE_CTX *OSSL_STORE_attach(BIO *bp, const char *scheme,
}
if (loader_ctx == NULL) {
- ERR_clear_last_mark();
- return NULL;
+ goto err;
}
if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) {
- ERR_clear_last_mark();
- return NULL;
+ goto err;
}
if (ui_method != NULL
&& !ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data)) {
- ERR_clear_last_mark();
- OPENSSL_free(ctx);
- return NULL;
+ goto err;
}
ctx->fetched_loader = fetched_loader;
@@ -1130,4 +1127,28 @@ OSSL_STORE_CTX *OSSL_STORE_attach(BIO *bp, const char *scheme,
ERR_pop_to_mark();
return ctx;
+
+err:
+ ERR_clear_last_mark();
+ if (loader_ctx != NULL) {
+ /*
+ * Temporary structure so OSSL_STORE_close() can work even when
+ * |ctx| couldn't be allocated or initialized properly.
+ */
+ OSSL_STORE_CTX tmpctx = {
+ NULL,
+ };
+
+ tmpctx.fetched_loader = fetched_loader;
+ tmpctx.loader = loader;
+ tmpctx.loader_ctx = loader_ctx;
+
+ /* We return NULL regardless of an error while closing. */
+ (void)ossl_store_close_it(&tmpctx);
+ fetched_loader = NULL;
+ }
+
+ OSSL_STORE_LOADER_free(fetched_loader);
+ OPENSSL_free(ctx);
+ return NULL;
}