Skip to content

TLS: Fix EVP_PKEY leak in SSLPrivateKeyHandler #13464

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
moonchen merged 1 commit into from
Jul 31, 2026
Merged

TLS: Fix EVP_PKEY leak in SSLPrivateKeyHandler #13464

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions src/iocore/net/P_SSLUtils.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,14 @@ namespace detail
}
};

struct PKEYDeleter {
void
operator()(EVP_PKEY *p)
{
EVP_PKEY_free(p);
}
};

#ifdef OPENSSL_IS_OPENSSL3
struct PKEYCTXDeleter {
void
Expand Down Expand Up @@ -156,6 +164,7 @@ struct ats_wildcard_matcher {

using scoped_X509 = std::unique_ptr<X509, ssl::detail::X509Deleter>;
using scoped_BIO = std::unique_ptr<BIO, ssl::detail::BIODeleter>;
using scoped_PKEY = std::unique_ptr<EVP_PKEY, ssl::detail::PKEYDeleter>;
#ifdef OPENSSL_IS_OPENSSL3
using scoped_PKEY_CTX = std::unique_ptr<EVP_PKEY_CTX, ssl::detail::PKEYCTXDeleter>;
using scoped_Decoder_CTX = std::unique_ptr<OSSL_DECODER_CTX, ssl::detail::DecoderCTXDeleter>;
Expand Down
15 changes: 8 additions & 7 deletions src/iocore/net/SSLUtils.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -856,15 +856,16 @@ SSLMultiCertConfigLoader::default_server_ssl_ctx()
static bool
SSLPrivateKeyHandler(SSL_CTX *ctx, const char *keyPath, const char *secret_data, int secret_data_len)
{
EVP_PKEY *pkey = nullptr;
// SSL_CTX_use_PrivateKey() takes its own reference on the key, so this
// reference must be released on every exit.
scoped_PKEY pkey;
#if HAVE_ENGINE_GET_DEFAULT_RSA && HAVE_ENGINE_LOAD_PRIVATE_KEY
ENGINE *e = ENGINE_get_default_RSA();
if (e != nullptr) {
pkey = ENGINE_load_private_key(e, keyPath, nullptr, nullptr);
pkey.reset(ENGINE_load_private_key(e, keyPath, nullptr, nullptr));
if (pkey) {
if (!SSL_CTX_use_PrivateKey(ctx, pkey)) {
if (!SSL_CTX_use_PrivateKey(ctx, pkey.get())) {
Dbg(dbg_ctl_ssl_load, "failed to load server private key from engine");
EVP_PKEY_free(pkey);
return false;
}
}
Expand All @@ -877,16 +878,16 @@ SSLPrivateKeyHandler(SSL_CTX *ctx, const char *keyPath, const char *secret_data,

pem_password_cb *password_cb = SSL_CTX_get_default_passwd_cb(ctx);
void *u = SSL_CTX_get_default_passwd_cb_userdata(ctx);
pkey = PEM_read_bio_PrivateKey(bio.get(), nullptr, password_cb, u);

pkey.reset(PEM_read_bio_PrivateKey(bio.get(), nullptr, password_cb, u));
if (nullptr == pkey) {
Dbg(dbg_ctl_ssl_load, "failed to load server private key (%.*s) from %s", secret_data_len < 50 ? secret_data_len : 50,
secret_data, (!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath);
return false;
}
if (!SSL_CTX_use_PrivateKey(ctx, pkey)) {
if (!SSL_CTX_use_PrivateKey(ctx, pkey.get())) {
Dbg(dbg_ctl_ssl_load, "failed to attach server private key loaded from %s",
(!keyPath || keyPath[0] == '\0') ? "[empty key path]" : keyPath);
EVP_PKEY_free(pkey);
return false;
}
if (e == nullptr && !SSL_CTX_check_private_key(ctx)) {
Expand Down