Prepare for ubuntu-latest switching to 24.04 by bernd-edlinger · Pull Request #26269 · openssl/openssl

bernd-edlinger · 2024-12-26T14:19:41Z

ubuntu-latest pipelines will use ubuntu-24.04 soon. For more details, see actions/runner-images#10636

t8m · 2024-12-30T16:09:57Z

 unsigned char *ciphertext, *exp_plaintext, *tag;
 size_t numpipes, plaintextlen, i;

+ EVP_CIPHER_free(EVP_CIPHER_fetch(testctx, "AES-256-GCM", NULL));


Probably a better fix would be to use "provider!=fake-pipeline" instead of testpropq at line 5942.

Ok, that works as well, with all 3 reproducers from #26276

t8m · 2024-12-31T13:56:06Z

@bernd-edlinger what's remaining to take this out of WIP?

bernd-edlinger · 2024-12-31T15:00:10Z

At the moment everything looks good.
Maybe I should remove the -fsanitize-memory-track-origins again, I was only doing that to debug the issue #26277
and cleanup the commit messages a bit...

bernd-edlinger · 2024-12-31T15:10:34Z

Note: One thing I had to do is to make the memory sanitizer test run use the no-shared option,
that is because the clang sanitizer uses an external application called "llvm-symbolizer", which
crashed when a callstack is to be printed, because that utility gained a dependency
on libcrypto.so.3, but it crashes when LD_LIBRARY_PATH makes it pick up the locally built
library, for details see: llvm/llvm-project#120915
I hope that only the memory sanitizer build is affected, and the downside of my workaround
is that the test coverage is slightly reduced.

Here the undefined value "npa" passed to a function WPACKET_sub_memcpy_u16(pkt, npa, npalen). However the value is not really used, because "npalen" is zero, but the call statememt itself is considered an invalid operation by the new sanitizer. The original sanitizer error report was: ==49175==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x55a276b29d6f in tls_construct_stoc_next_proto_neg /home/runner/work/openssl/openssl/ssl/statem/extensions_srvr.c:1518:21 openssl#1 0x55a276b15d7d in tls_construct_extensions /home/runner/work/openssl/openssl/ssl/statem/extensions.c:909:15 openssl#2 0x55a276b513dc in tls_construct_server_hello /home/runner/work/openssl/openssl/ssl/statem/statem_srvr.c:2471:10 openssl#3 0x55a276b2e160 in write_state_machine /home/runner/work/openssl/openssl/ssl/statem/statem.c:896:26 openssl#4 0x55a276b2e160 in state_machine /home/runner/work/openssl/openssl/ssl/statem/statem.c:490:21 openssl#5 0x55a276b2f562 in ossl_statem_accept /home/runner/work/openssl/openssl/ssl/statem/statem.c:309:12 openssl#6 0x55a276a9f867 in SSL_do_handshake /home/runner/work/openssl/openssl/ssl/ssl_lib.c:4890:19 openssl#7 0x55a276a9f605 in SSL_accept /home/runner/work/openssl/openssl/ssl/ssl_lib.c:2169:12 openssl#8 0x55a276a3d4db in create_bare_ssl_connection /home/runner/work/openssl/openssl/test/helpers/ssltestlib.c:1281:24 openssl#9 0x55a276a3d7cb in create_ssl_connection /home/runner/work/openssl/openssl/test/helpers/ssltestlib.c:1350:10 openssl#10 0x55a276a64c0b in test_npn /home/runner/work/openssl/openssl/test/sslapitest.c:12266:14 openssl#11 0x55a276b9fc20 in run_tests /home/runner/work/openssl/openssl/test/testutil/driver.c:377:21 openssl#12 0x55a276ba0b10 in main /home/runner/work/openssl/openssl/test/testutil/main.c:31:15

Fixesopenssl#26277

recent gcc versions can optimize the memory leak away, avoid that by declaring the lost variable to be volatile.

Fix missing afl++-clang package Use clang-18 Configure ubsan with -fno-sanitize=function

Fixesopenssl#26276

bernd-edlinger · 2024-12-31T15:44:30Z

One thing I totally forgot, the new ubuntu-latest comes with exactly the gcc version that
emits a bogus warning which was fixed by #23898 so that one still needs to be back-ported.

in test/wpackettest.c:593:18: runtime error: load of misaligned address for type 'uint64_t', which requires 8 byte alignment. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #26269) (cherry picked from commit 94f95ef)

Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #26269) (cherry picked from commit 5f0dab5)

Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #26269) (cherry picked from commit ada0265)

Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #26269) (cherry picked from commit 01e657c)

Here the undefined value "npa" passed to a function WPACKET_sub_memcpy_u16(pkt, npa, npalen). However the value is not really used, because "npalen" is zero, but the call statememt itself is considered an invalid operation by the new sanitizer. The original sanitizer error report was: ==49175==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x55a276b29d6f in tls_construct_stoc_next_proto_neg /home/runner/work/openssl/openssl/ssl/statem/extensions_srvr.c:1518:21 #1 0x55a276b15d7d in tls_construct_extensions /home/runner/work/openssl/openssl/ssl/statem/extensions.c:909:15 #2 0x55a276b513dc in tls_construct_server_hello /home/runner/work/openssl/openssl/ssl/statem/statem_srvr.c:2471:10 #3 0x55a276b2e160 in write_state_machine /home/runner/work/openssl/openssl/ssl/statem/statem.c:896:26 #4 0x55a276b2e160 in state_machine /home/runner/work/openssl/openssl/ssl/statem/statem.c:490:21 #5 0x55a276b2f562 in ossl_statem_accept /home/runner/work/openssl/openssl/ssl/statem/statem.c:309:12 #6 0x55a276a9f867 in SSL_do_handshake /home/runner/work/openssl/openssl/ssl/ssl_lib.c:4890:19 #7 0x55a276a9f605 in SSL_accept /home/runner/work/openssl/openssl/ssl/ssl_lib.c:2169:12 #8 0x55a276a3d4db in create_bare_ssl_connection /home/runner/work/openssl/openssl/test/helpers/ssltestlib.c:1281:24 #9 0x55a276a3d7cb in create_ssl_connection /home/runner/work/openssl/openssl/test/helpers/ssltestlib.c:1350:10 #10 0x55a276a64c0b in test_npn /home/runner/work/openssl/openssl/test/sslapitest.c:12266:14 #11 0x55a276b9fc20 in run_tests /home/runner/work/openssl/openssl/test/testutil/driver.c:377:21 #12 0x55a276ba0b10 in main /home/runner/work/openssl/openssl/test/testutil/main.c:31:15 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #26269) (cherry picked from commit e63e889)

Fixes#26277 Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #26269) (cherry picked from commit 9861be4)

recent gcc versions can optimize the memory leak away, avoid that by declaring the lost variable to be volatile. Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #26269) (cherry picked from commit eeb3266)

Fix missing afl++-clang package Use clang-18 Configure ubsan with -fno-sanitize=function Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from #26269) (cherry picked from commit c45fddd)