| From: | Michael Paquier <michael(at)paquier(dot)xyz> |
|---|---|
| To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
| Cc: | wurongxin(at)xmu(dot)edu(dot)cn, pgsql-bugs(at)lists(dot)postgresql(dot)org |
| Subject: | Re: BUG #16070: A double-free bug in interfaces/libpq/fe-secure-openssl.c |
| Date: | 2019-10-21 03:25:37 |
| Message-ID: | 20191021032537.GG1542@paquier.xyz |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
On Sun, Oct 20, 2019 at 10:17:11AM -0400, Tom Lane wrote:
> I don't really believe this; if there were a double-free problem here,
> we'd surely have noticed it long since.
Yeah.
> Taking a look at the OpenSSL source code, it looks like engine_free_util
> decrements a reference count and doesn't actually delete anything until
> that's gone to zero. So maybe the refcount is 2 at the beginning of
> this sequence?
The docs of OpenSSL mention the use of both successively, where
ENGINE_free() does the cleanup after ENGINE_by_id(), and
ENGINE_finish() cleans up after ENGINE_init():
https://www.openssl.org/docs/man1.1.0/man3/ENGINE_finish.html
And an actual issue is that we have no coverage for it:
https://coverage.postgresql.org/src/interfaces/libpq/fe-secure-openssl.c.gcov.html
--
Michael
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2019-10-21 03:44:25 | Re: BUG #16070: A double-free bug in interfaces/libpq/fe-secure-openssl.c |
| Previous Message | Tom Lane | 2019-10-20 21:57:14 | Re: Re: BUG #16068: Collate of 'Norwegian Bokmål' is problematic |