use-after-free on failing RSA_generate_key_ex()

Reported by Yuan Kang.

When we generate a key, if openssl fails to generate an RSA key, we currently retain a dangling pointer to the previous (uninitialized) key value. The impact here should be limited to a difficult-to-trigger crash, if OpenSSL is running an engine that makes key generation failures possible, or if OpenSSL runs out of memory.

changed milestone to %Tor: 0.2.4.x-final

added 027-backport component::core tor/tor milestone::Tor: 0.2.4.x-final owner::nickm priority::medium resolution::fixed reviewer::arma severity::normal status::closed type::defect labels

My branch bug19152_024 has a possible fix.

Trac:
Status: new to needs_review

Trac:
Keywords: 027-backport deleted, 027-backport must-fix-before-028-alpha added

s/failes/fails/

"exactly when to"...?

The commit log starts with "let me walk through my analysis" rather than explaining what the issue is or what the fix is. Re-using some of the text from the changes file would be helpful, to give context to the person who is reading (since you clearly are intending for people to read this commit log). Like, you start talking about a non-engine case before I knew engines were involved.

The patch itself looks good to me.

I've mailed the original bug reporter so he can look it over too if he wants.

Thanks!

Trac:
Reviewer: N/A to arma
Keywords: 027-backport must-fix-before-028-alpha deleted, 027-backport must-fix-before-028-alpha CoreTorTeam201606 added

Trac:
Status: needs_review to needs_revision

Ok: the bug reporter wants to be credited as "Yuan Jochen Kang, Suman Jana, and Baishakhi Ray".

The bug reporter also confirms that the patch looks good.

bug19152_024_v2 has the requested changes. Merging to 028 and forward, marking for possible 027 backport.

Trac:
Status: needs_revision to needs_review
Keywords: 027-backport must-fix-before-028-alpha CoreTorTeam201606 deleted, 027-backport added
Milestone: Tor: 0.2.8.x-final to Tor: 0.2.7.x-final

Trac:
Milestone: Tor: 0.2.7.x-final to Tor: 0.2.4.x-final

(backported to 0.2.4)

Trac:
Resolution: N/A to fixed
Status: needs_review to closed

closed

mentioned in issue #20512 (moved)

mentioned in issue #20512 (moved)

moved to tpo/core/tor#19152 (closed)