Fix failure checking on thread_local storage assignment in rand_lib - #31442

Closed
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from
npajkovsky:rand-byte-leak
Closed

Fix failure checking on thread_local storage assignment in rand_lib#31442
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from
npajkovsky:rand-byte-leak

Conversation

@npajkovsky

@npajkovskynpajkovsky commented Jun 10, 2026

Copy link
Copy Markdown

The new malloc failure test caught an asan error in this code: Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)

It occurs because when rand_get0_public/rand_get0_private sets an EVP_RAND_CTX object in its thread local storage, it neglects to check the return code of the operation, which may fail when the associated sparse array is expanded.

fix it by checking the return code and failing the get0_[public|private] operation so the failure is graceful.

Fixes: #31375
Signed-off-by: Nikola Pajkovsky nikolap@openssl.org

(cherry picked from commit 7f780be)

@npajkovskynpajkovsky self-assigned this Jun 10, 2026
@npajkovskynpajkovsky added branch: 3.0 Applies to openssl-3.0 branch branch: 3.4 Applies to openssl-3.4 branch: 3.5 Applies to openssl-3.5 approval: review pending This pull request needs review by a committer labels Jun 10, 2026
@npajkovskynpajkovsky linked an issue Jun 10, 2026 that may be closed by this pull request
RAND_bytes occasionally leaks #31375
Closed
@mbroz

mbroz commented Jun 10, 2026

Copy link
Copy Markdown
Member

Test failures are apparently relevant here...

@github-actionsgithub-actionsBot added the severity: fips change The pull request changes FIPS provider sources label Jun 10, 2026
mbroz
mbroz previously approved these changes Jun 10, 2026
View reviewed changes

@mbrozmbroz left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

jogme
jogme previously approved these changes Jun 11, 2026
View reviewed changes

@jogmejogme left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!

@openssl-machineopenssl-machine added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels Jun 11, 2026
nhorman
nhorman previously approved these changes Jun 11, 2026
View reviewed changes
@t8mt8m added triaged: bug The issue/pr is/fixes a bug tests: exempted The PR is exempt from requirements for testing labels Jun 11, 2026
t8m
t8m previously approved these changes Jun 11, 2026
View reviewed changes
paulidale
paulidale previously approved these changes Jun 12, 2026
View reviewed changes
mattcaswell
mattcaswell previously approved these changes Jun 12, 2026
View reviewed changes
@openssl-machineopenssl-machine added approval: ready to merge The 24 hour grace period has passed, ready to merge and removed approval: done This pull request has the required number of approvals labels Jun 12, 2026
@openssl-machine

openssl-machine commented Jun 12, 2026

Copy link
Copy Markdown
Collaborator

This pull request is ready to merge

bukka
bukka reviewed Jun 12, 2026
View reviewed changes
Comment threadcrypto/rand/rand_lib.c
rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL,
SECONDARY_RESEED_TIME_INTERVAL);
CRYPTO_THREAD_set_local(&dgbl->public, rand);
if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {

@bukkabukkaJun 12, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might also make sense not to call it if rand allocation fails. Something like

Suggested change
if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
if (rand!=NULL&&!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {

@npajkovskynpajkovskyJun 15, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, I just pushed the version with rand != NULL, but then I realised that it would diverge from master.

If we want to have rand != NULL, then it should go from master down to 3.0.

@bukkabukkaJun 15, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I didn't realise that this a backport. Sure. It would be probably enough to do it only in master as it doesn't seem like a real bug - it just sets data to NULL and keeps used unchanged as 1 so it's like after init.

@openssl-machineopenssl-machine added approval: review pending This pull request needs review by a committer and removed approval: ready to merge The 24 hour grace period has passed, ready to merge labels Jun 15, 2026
@npajkovsky

npajkovsky commented Jun 15, 2026

Copy link
Copy Markdown
Author

Please re-approve.

t8m
t8m approved these changes Jun 15, 2026
View reviewed changes
@openssl-machineopenssl-machine added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels Jun 15, 2026
@openssl-machineopenssl-machine added approval: ready to merge The 24 hour grace period has passed, ready to merge and removed approval: done This pull request has the required number of approvals labels Jun 16, 2026
@openssl-machine

openssl-machine commented Jun 16, 2026

Copy link
Copy Markdown
Collaborator

This pull request is ready to merge

esyr
esyr requested changes Jun 16, 2026
View reviewed changes

@esyresyr left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please preserve the authorship of the original commit.

@nhorman@nikolapajkovsky
Fix failure checking on thread_local storage assignment in rand_lib
c2fa873
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z openssl#1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z openssl#2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z openssl#3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z openssl#4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z openssl#5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z openssl#6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z openssl#7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z openssl#8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z openssl#9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z openssl#10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z openssl#11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z openssl#12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z openssl#13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z openssl#14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z openssl#15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: openssl#31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
@npajkovsky

npajkovsky commented Jun 17, 2026

Copy link
Copy Markdown
Author

Please preserve the authorship of the original commit.

Ooops, that was not intentional.

esyr
esyr approved these changes Jun 17, 2026
View reviewed changes

@esyresyr left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now, thank you.

openssl-machine pushed a commit that referenced this pull request Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
316bb20
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
openssl-machine pushed a commit that referenced this pull request Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
48cd9e2
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8m

t8m commented Jun 18, 2026

Copy link
Copy Markdown
Member

Merged to the 3.5, 3.4 and 3.0 branches. Thank you.

@t8mt8m closed this Jun 18, 2026
openssl-machine pushed a commit that referenced this pull request Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
57c4d07
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8mt8m mentioned this pull request Jun 18, 2026
Closed
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bukkabukkabukka left review comments
@esyresyresyr approved these changes
@nhormannhormannhorman approved these changes
@t8mt8mt8m approved these changes
@jogmejogmejogme approved these changes
@mbrozmbrozAwaiting requested review from mbroz
@mattcaswellmattcaswellAwaiting requested review from mattcaswell
@paulidalepaulidaleAwaiting requested review from paulidale

Assignees

@npajkovskynpajkovsky

Labels

approval: ready to mergeThe 24 hour grace period has passed, ready to mergebranch: 3.0Applies to openssl-3.0 branchbranch: 3.4Applies to openssl-3.4branch: 3.5Applies to openssl-3.5severity: fips changeThe pull request changes FIPS provider sourcestests: exemptedThe PR is exempt from requirements for testingtriaged: bugThe issue/pr is/fixes a bug

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

RAND_bytes occasionally leaks

10 participants

@npajkovsky@mbroz@openssl-machine@t8m@bukka@esyr@nhorman@mattcaswell@paulidale@jogme
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Fix failure checking on thread_local storage assignment in rand_lib - #31442
Closed
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Closed
Fix failure checking on thread_local storage assignment in rand_lib#31442
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Conversation
@npajkovsky
@npajkovskynpajkovsky
commented
Jun 10, 2026

Copy link


Copy Markdown

The new malloc failure test caught an asan error in this code: Direct leak of 40 byte(s) in 1 object(s) allocated from:

2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211

2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231

2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353

2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666

2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843

2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490

2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191

2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958

2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56

2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125

2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342

2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31

2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an EVP_RAND_CTX object in its thread local storage, it neglects to check the return code of the operation, which may fail when the associated sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private] operation so the failure is graceful.
Fixes: #31375

Signed-off-by: Nikola Pajkovsky nikolap@openssl.org
(cherry picked from commit 7f780be)
@npajkovskynpajkovsky
self-assigned this
Jun 10, 2026
@npajkovskynpajkovsky
added

branch: 3.0
Applies to openssl-3.0 branch
branch: 3.4
Applies to openssl-3.4
branch: 3.5
Applies to openssl-3.5
approval: review pending
This pull request needs review by a committer
labels
Jun 10, 2026
@npajkovskynpajkovsky
linked an issue
Jun 10, 2026
that may be
closed
by this pull request


RAND_bytes occasionally leaks
#31375

Closed

@mbroz
mbroz
commented
Jun 10, 2026

Copy link


Copy Markdown

Member
Test failures are apparently relevant here...
@github-actionsgithub-actionsBot
added
the 
severity: fips change
The pull request changes FIPS provider sources
label
Jun 10, 2026
mbroz
mbroz
previously approved these changes
Jun 10, 2026
View reviewed changes
@mbrozmbroz
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
jogme
jogme
previously approved these changes
Jun 11, 2026
View reviewed changes
@jogmejogme
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 11, 2026
nhorman
nhorman
previously approved these changes
Jun 11, 2026
View reviewed changes
@t8mt8m
added

triaged: bug
The issue/pr is/fixes a bug
tests: exempted
The PR is exempt from requirements for testing
labels
Jun 11, 2026
t8m
t8m
previously approved these changes
Jun 11, 2026
View reviewed changes
paulidale
paulidale
previously approved these changes
Jun 12, 2026
View reviewed changes
mattcaswell
mattcaswell
previously approved these changes
Jun 12, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 12, 2026
@openssl-machine
openssl-machine
commented
Jun 12, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
bukka
bukka
reviewed
Jun 12, 2026
View reviewed changes
Comment threadcrypto/rand/rand_lib.c
 rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL,
 SECONDARY_RESEED_TIME_INTERVAL);
 CRYPTO_THREAD_set_local(&dgbl->public, rand);
 if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@bukkabukkaJun 12, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might also make sense not to call it if rand allocation fails. Something like

Suggested change

if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
if (rand!=NULL&&!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@npajkovskynpajkovskyJun 15, 2026

Copy link


Copy Markdown

Author
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, I just pushed the version with rand != NULL, but then I realised that it would diverge from master.
If we want to have rand != NULL, then it should go from master down to 3.0.
@bukkabukkaJun 15, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I didn't realise that this a backport. Sure. It would be probably enough to do it only in master as it doesn't seem like a real bug - it just sets data to NULL and keeps used unchanged as 1 so it's like after init.
@openssl-machineopenssl-machine
added

approval: review pending
This pull request needs review by a committer
and removed

approval: ready to merge
The 24 hour grace period has passed, ready to merge
labels
Jun 15, 2026
@npajkovsky
npajkovsky
commented
Jun 15, 2026

Copy link


Copy Markdown

Author
Please re-approve.
t8m
t8m
approved these changes
Jun 15, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 15, 2026
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 16, 2026
@openssl-machine
openssl-machine
commented
Jun 16, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
esyr
esyr
requested changes
Jun 16, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please preserve the authorship of the original commit.
@nhorman@nikolapajkovsky
Fix failure checking on thread_local storage assignment in rand_lib
c2fa873
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z openssl#1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z openssl#2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z openssl#3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z openssl#4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z openssl#5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z openssl#6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z openssl#7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z openssl#8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z openssl#9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z openssl#10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z openssl#11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z openssl#12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z openssl#13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z openssl#14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z openssl#15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: openssl#31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
@npajkovsky
npajkovsky
commented
Jun 17, 2026

Copy link


Copy Markdown

Author
Please preserve the authorship of the original commit.
Ooops, that was not intentional.
esyr
esyr
approved these changes
Jun 17, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now, thank you.
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
316bb20
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
48cd9e2
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8m
t8m
commented
Jun 18, 2026

Copy link


Copy Markdown

Member
Merged to the 3.5, 3.4 and 3.0 branches. Thank you.
@t8mt8m
closed this
Jun 18, 2026
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
57c4d07
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8mt8m
mentioned this pull request
Jun 18, 2026

Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bukkabukkabukka left review comments
@esyresyresyr approved these changes
@nhormannhormannhorman approved these changes
@t8mt8mt8m approved these changes
@jogmejogmejogme approved these changes
@mbrozmbrozAwaiting requested review from mbroz
@mattcaswellmattcaswellAwaiting requested review from mattcaswell
@paulidalepaulidaleAwaiting requested review from paulidale

Assignees

@npajkovskynpajkovsky

Labels

approval: ready to mergeThe 24 hour grace period has passed, ready to mergebranch: 3.0Applies to openssl-3.0 branchbranch: 3.4Applies to openssl-3.4branch: 3.5Applies to openssl-3.5severity: fips changeThe pull request changes FIPS provider sourcestests: exemptedThe PR is exempt from requirements for testingtriaged: bugThe issue/pr is/fixes a bug

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

RAND_bytes occasionally leaks


10 participants

@npajkovsky@mbroz@openssl-machine@t8m@bukka@esyr@nhorman@mattcaswell@paulidale@jogme

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Fix failure checking on thread_local storage assignment in rand_lib - #31442
Closed
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Closed
Fix failure checking on thread_local storage assignment in rand_lib#31442
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Conversation
@npajkovsky
@npajkovskynpajkovsky
commented
Jun 10, 2026

Copy link


Copy Markdown

The new malloc failure test caught an asan error in this code: Direct leak of 40 byte(s) in 1 object(s) allocated from:

2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211

2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231

2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353

2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666

2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843

2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490

2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191

2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958

2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56

2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125

2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342

2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31

2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an EVP_RAND_CTX object in its thread local storage, it neglects to check the return code of the operation, which may fail when the associated sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private] operation so the failure is graceful.
Fixes: #31375

Signed-off-by: Nikola Pajkovsky nikolap@openssl.org
(cherry picked from commit 7f780be)
@npajkovskynpajkovsky
self-assigned this
Jun 10, 2026
@npajkovskynpajkovsky
added

branch: 3.0
Applies to openssl-3.0 branch
branch: 3.4
Applies to openssl-3.4
branch: 3.5
Applies to openssl-3.5
approval: review pending
This pull request needs review by a committer
labels
Jun 10, 2026
@npajkovskynpajkovsky
linked an issue
Jun 10, 2026
that may be
closed
by this pull request


RAND_bytes occasionally leaks
#31375

Closed

@mbroz
mbroz
commented
Jun 10, 2026

Copy link


Copy Markdown

Member
Test failures are apparently relevant here...
@github-actionsgithub-actionsBot
added
the 
severity: fips change
The pull request changes FIPS provider sources
label
Jun 10, 2026
mbroz
mbroz
previously approved these changes
Jun 10, 2026
View reviewed changes
@mbrozmbroz
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
jogme
jogme
previously approved these changes
Jun 11, 2026
View reviewed changes
@jogmejogme
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 11, 2026
nhorman
nhorman
previously approved these changes
Jun 11, 2026
View reviewed changes
@t8mt8m
added

triaged: bug
The issue/pr is/fixes a bug
tests: exempted
The PR is exempt from requirements for testing
labels
Jun 11, 2026
t8m
t8m
previously approved these changes
Jun 11, 2026
View reviewed changes
paulidale
paulidale
previously approved these changes
Jun 12, 2026
View reviewed changes
mattcaswell
mattcaswell
previously approved these changes
Jun 12, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 12, 2026
@openssl-machine
openssl-machine
commented
Jun 12, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
bukka
bukka
reviewed
Jun 12, 2026
View reviewed changes
Comment threadcrypto/rand/rand_lib.c
 rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL,
 SECONDARY_RESEED_TIME_INTERVAL);
 CRYPTO_THREAD_set_local(&dgbl->public, rand);
 if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@bukkabukkaJun 12, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might also make sense not to call it if rand allocation fails. Something like

Suggested change

if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
if (rand!=NULL&&!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@npajkovskynpajkovskyJun 15, 2026

Copy link


Copy Markdown

Author
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, I just pushed the version with rand != NULL, but then I realised that it would diverge from master.
If we want to have rand != NULL, then it should go from master down to 3.0.
@bukkabukkaJun 15, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I didn't realise that this a backport. Sure. It would be probably enough to do it only in master as it doesn't seem like a real bug - it just sets data to NULL and keeps used unchanged as 1 so it's like after init.
@openssl-machineopenssl-machine
added

approval: review pending
This pull request needs review by a committer
and removed

approval: ready to merge
The 24 hour grace period has passed, ready to merge
labels
Jun 15, 2026
@npajkovsky
npajkovsky
commented
Jun 15, 2026

Copy link


Copy Markdown

Author
Please re-approve.
t8m
t8m
approved these changes
Jun 15, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 15, 2026
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 16, 2026
@openssl-machine
openssl-machine
commented
Jun 16, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
esyr
esyr
requested changes
Jun 16, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please preserve the authorship of the original commit.
@nhorman@nikolapajkovsky
Fix failure checking on thread_local storage assignment in rand_lib
c2fa873
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z openssl#1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z openssl#2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z openssl#3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z openssl#4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z openssl#5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z openssl#6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z openssl#7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z openssl#8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z openssl#9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z openssl#10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z openssl#11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z openssl#12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z openssl#13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z openssl#14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z openssl#15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: openssl#31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
@npajkovsky
npajkovsky
commented
Jun 17, 2026

Copy link


Copy Markdown

Author
Please preserve the authorship of the original commit.
Ooops, that was not intentional.
esyr
esyr
approved these changes
Jun 17, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now, thank you.
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
316bb20
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
48cd9e2
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8m
t8m
commented
Jun 18, 2026

Copy link


Copy Markdown

Member
Merged to the 3.5, 3.4 and 3.0 branches. Thank you.
@t8mt8m
closed this
Jun 18, 2026
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
57c4d07
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8mt8m
mentioned this pull request
Jun 18, 2026

Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bukkabukkabukka left review comments
@esyresyresyr approved these changes
@nhormannhormannhorman approved these changes
@t8mt8mt8m approved these changes
@jogmejogmejogme approved these changes
@mbrozmbrozAwaiting requested review from mbroz
@mattcaswellmattcaswellAwaiting requested review from mattcaswell
@paulidalepaulidaleAwaiting requested review from paulidale

Assignees

@npajkovskynpajkovsky

Labels

approval: ready to mergeThe 24 hour grace period has passed, ready to mergebranch: 3.0Applies to openssl-3.0 branchbranch: 3.4Applies to openssl-3.4branch: 3.5Applies to openssl-3.5severity: fips changeThe pull request changes FIPS provider sourcestests: exemptedThe PR is exempt from requirements for testingtriaged: bugThe issue/pr is/fixes a bug

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

RAND_bytes occasionally leaks


10 participants

@npajkovsky@mbroz@openssl-machine@t8m@bukka@esyr@nhorman@mattcaswell@paulidale@jogme

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Fix failure checking on thread_local storage assignment in rand_lib - #31442
Closed
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Closed
Fix failure checking on thread_local storage assignment in rand_lib#31442
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Conversation
@npajkovsky
@npajkovskynpajkovsky
commented
Jun 10, 2026

Copy link


Copy Markdown

The new malloc failure test caught an asan error in this code: Direct leak of 40 byte(s) in 1 object(s) allocated from:

2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211

2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231

2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353

2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666

2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843

2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490

2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191

2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958

2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56

2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125

2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342

2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31

2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an EVP_RAND_CTX object in its thread local storage, it neglects to check the return code of the operation, which may fail when the associated sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private] operation so the failure is graceful.
Fixes: #31375

Signed-off-by: Nikola Pajkovsky nikolap@openssl.org
(cherry picked from commit 7f780be)
@npajkovskynpajkovsky
self-assigned this
Jun 10, 2026
@npajkovskynpajkovsky
added

branch: 3.0
Applies to openssl-3.0 branch
branch: 3.4
Applies to openssl-3.4
branch: 3.5
Applies to openssl-3.5
approval: review pending
This pull request needs review by a committer
labels
Jun 10, 2026
@npajkovskynpajkovsky
linked an issue
Jun 10, 2026
that may be
closed
by this pull request


RAND_bytes occasionally leaks
#31375

Closed

@mbroz
mbroz
commented
Jun 10, 2026

Copy link


Copy Markdown

Member
Test failures are apparently relevant here...
@github-actionsgithub-actionsBot
added
the 
severity: fips change
The pull request changes FIPS provider sources
label
Jun 10, 2026
mbroz
mbroz
previously approved these changes
Jun 10, 2026
View reviewed changes
@mbrozmbroz
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
jogme
jogme
previously approved these changes
Jun 11, 2026
View reviewed changes
@jogmejogme
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 11, 2026
nhorman
nhorman
previously approved these changes
Jun 11, 2026
View reviewed changes
@t8mt8m
added

triaged: bug
The issue/pr is/fixes a bug
tests: exempted
The PR is exempt from requirements for testing
labels
Jun 11, 2026
t8m
t8m
previously approved these changes
Jun 11, 2026
View reviewed changes
paulidale
paulidale
previously approved these changes
Jun 12, 2026
View reviewed changes
mattcaswell
mattcaswell
previously approved these changes
Jun 12, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 12, 2026
@openssl-machine
openssl-machine
commented
Jun 12, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
bukka
bukka
reviewed
Jun 12, 2026
View reviewed changes
Comment threadcrypto/rand/rand_lib.c
 rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL,
 SECONDARY_RESEED_TIME_INTERVAL);
 CRYPTO_THREAD_set_local(&dgbl->public, rand);
 if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@bukkabukkaJun 12, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might also make sense not to call it if rand allocation fails. Something like

Suggested change

if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
if (rand!=NULL&&!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@npajkovskynpajkovskyJun 15, 2026

Copy link


Copy Markdown

Author
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, I just pushed the version with rand != NULL, but then I realised that it would diverge from master.
If we want to have rand != NULL, then it should go from master down to 3.0.
@bukkabukkaJun 15, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I didn't realise that this a backport. Sure. It would be probably enough to do it only in master as it doesn't seem like a real bug - it just sets data to NULL and keeps used unchanged as 1 so it's like after init.
@openssl-machineopenssl-machine
added

approval: review pending
This pull request needs review by a committer
and removed

approval: ready to merge
The 24 hour grace period has passed, ready to merge
labels
Jun 15, 2026
@npajkovsky
npajkovsky
commented
Jun 15, 2026

Copy link


Copy Markdown

Author
Please re-approve.
t8m
t8m
approved these changes
Jun 15, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 15, 2026
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 16, 2026
@openssl-machine
openssl-machine
commented
Jun 16, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
esyr
esyr
requested changes
Jun 16, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please preserve the authorship of the original commit.
@nhorman@nikolapajkovsky
Fix failure checking on thread_local storage assignment in rand_lib
c2fa873
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z openssl#1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z openssl#2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z openssl#3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z openssl#4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z openssl#5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z openssl#6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z openssl#7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z openssl#8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z openssl#9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z openssl#10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z openssl#11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z openssl#12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z openssl#13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z openssl#14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z openssl#15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: openssl#31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
@npajkovsky
npajkovsky
commented
Jun 17, 2026

Copy link


Copy Markdown

Author
Please preserve the authorship of the original commit.
Ooops, that was not intentional.
esyr
esyr
approved these changes
Jun 17, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now, thank you.
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
316bb20
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
48cd9e2
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8m
t8m
commented
Jun 18, 2026

Copy link


Copy Markdown

Member
Merged to the 3.5, 3.4 and 3.0 branches. Thank you.
@t8mt8m
closed this
Jun 18, 2026
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
57c4d07
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8mt8m
mentioned this pull request
Jun 18, 2026

Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bukkabukkabukka left review comments
@esyresyresyr approved these changes
@nhormannhormannhorman approved these changes
@t8mt8mt8m approved these changes
@jogmejogmejogme approved these changes
@mbrozmbrozAwaiting requested review from mbroz
@mattcaswellmattcaswellAwaiting requested review from mattcaswell
@paulidalepaulidaleAwaiting requested review from paulidale

Assignees

@npajkovskynpajkovsky

Labels

approval: ready to mergeThe 24 hour grace period has passed, ready to mergebranch: 3.0Applies to openssl-3.0 branchbranch: 3.4Applies to openssl-3.4branch: 3.5Applies to openssl-3.5severity: fips changeThe pull request changes FIPS provider sourcestests: exemptedThe PR is exempt from requirements for testingtriaged: bugThe issue/pr is/fixes a bug

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

RAND_bytes occasionally leaks


10 participants

@npajkovsky@mbroz@openssl-machine@t8m@bukka@esyr@nhorman@mattcaswell@paulidale@jogme

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Fix failure checking on thread_local storage assignment in rand_lib - #31442
Closed
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Closed
Fix failure checking on thread_local storage assignment in rand_lib#31442
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Conversation
@npajkovsky
@npajkovskynpajkovsky
commented
Jun 10, 2026

Copy link


Copy Markdown

The new malloc failure test caught an asan error in this code: Direct leak of 40 byte(s) in 1 object(s) allocated from:

2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211

2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231

2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353

2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666

2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843

2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490

2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191

2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958

2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56

2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125

2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342

2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31

2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an EVP_RAND_CTX object in its thread local storage, it neglects to check the return code of the operation, which may fail when the associated sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private] operation so the failure is graceful.
Fixes: #31375

Signed-off-by: Nikola Pajkovsky nikolap@openssl.org
(cherry picked from commit 7f780be)
@npajkovskynpajkovsky
self-assigned this
Jun 10, 2026
@npajkovskynpajkovsky
added

branch: 3.0
Applies to openssl-3.0 branch
branch: 3.4
Applies to openssl-3.4
branch: 3.5
Applies to openssl-3.5
approval: review pending
This pull request needs review by a committer
labels
Jun 10, 2026
@npajkovskynpajkovsky
linked an issue
Jun 10, 2026
that may be
closed
by this pull request


RAND_bytes occasionally leaks
#31375

Closed

@mbroz
mbroz
commented
Jun 10, 2026

Copy link


Copy Markdown

Member
Test failures are apparently relevant here...
@github-actionsgithub-actionsBot
added
the 
severity: fips change
The pull request changes FIPS provider sources
label
Jun 10, 2026
mbroz
mbroz
previously approved these changes
Jun 10, 2026
View reviewed changes
@mbrozmbroz
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
jogme
jogme
previously approved these changes
Jun 11, 2026
View reviewed changes
@jogmejogme
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 11, 2026
nhorman
nhorman
previously approved these changes
Jun 11, 2026
View reviewed changes
@t8mt8m
added

triaged: bug
The issue/pr is/fixes a bug
tests: exempted
The PR is exempt from requirements for testing
labels
Jun 11, 2026
t8m
t8m
previously approved these changes
Jun 11, 2026
View reviewed changes
paulidale
paulidale
previously approved these changes
Jun 12, 2026
View reviewed changes
mattcaswell
mattcaswell
previously approved these changes
Jun 12, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 12, 2026
@openssl-machine
openssl-machine
commented
Jun 12, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
bukka
bukka
reviewed
Jun 12, 2026
View reviewed changes
Comment threadcrypto/rand/rand_lib.c
 rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL,
 SECONDARY_RESEED_TIME_INTERVAL);
 CRYPTO_THREAD_set_local(&dgbl->public, rand);
 if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@bukkabukkaJun 12, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might also make sense not to call it if rand allocation fails. Something like

Suggested change

if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
if (rand!=NULL&&!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@npajkovskynpajkovskyJun 15, 2026

Copy link


Copy Markdown

Author
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, I just pushed the version with rand != NULL, but then I realised that it would diverge from master.
If we want to have rand != NULL, then it should go from master down to 3.0.
@bukkabukkaJun 15, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I didn't realise that this a backport. Sure. It would be probably enough to do it only in master as it doesn't seem like a real bug - it just sets data to NULL and keeps used unchanged as 1 so it's like after init.
@openssl-machineopenssl-machine
added

approval: review pending
This pull request needs review by a committer
and removed

approval: ready to merge
The 24 hour grace period has passed, ready to merge
labels
Jun 15, 2026
@npajkovsky
npajkovsky
commented
Jun 15, 2026

Copy link


Copy Markdown

Author
Please re-approve.
t8m
t8m
approved these changes
Jun 15, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 15, 2026
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 16, 2026
@openssl-machine
openssl-machine
commented
Jun 16, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
esyr
esyr
requested changes
Jun 16, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please preserve the authorship of the original commit.
@nhorman@nikolapajkovsky
Fix failure checking on thread_local storage assignment in rand_lib
c2fa873
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z openssl#1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z openssl#2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z openssl#3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z openssl#4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z openssl#5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z openssl#6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z openssl#7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z openssl#8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z openssl#9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z openssl#10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z openssl#11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z openssl#12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z openssl#13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z openssl#14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z openssl#15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: openssl#31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
@npajkovsky
npajkovsky
commented
Jun 17, 2026

Copy link


Copy Markdown

Author
Please preserve the authorship of the original commit.
Ooops, that was not intentional.
esyr
esyr
approved these changes
Jun 17, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now, thank you.
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
316bb20
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
48cd9e2
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8m
t8m
commented
Jun 18, 2026

Copy link


Copy Markdown

Member
Merged to the 3.5, 3.4 and 3.0 branches. Thank you.
@t8mt8m
closed this
Jun 18, 2026
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
57c4d07
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8mt8m
mentioned this pull request
Jun 18, 2026

Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bukkabukkabukka left review comments
@esyresyresyr approved these changes
@nhormannhormannhorman approved these changes
@t8mt8mt8m approved these changes
@jogmejogmejogme approved these changes
@mbrozmbrozAwaiting requested review from mbroz
@mattcaswellmattcaswellAwaiting requested review from mattcaswell
@paulidalepaulidaleAwaiting requested review from paulidale

Assignees

@npajkovskynpajkovsky

Labels

approval: ready to mergeThe 24 hour grace period has passed, ready to mergebranch: 3.0Applies to openssl-3.0 branchbranch: 3.4Applies to openssl-3.4branch: 3.5Applies to openssl-3.5severity: fips changeThe pull request changes FIPS provider sourcestests: exemptedThe PR is exempt from requirements for testingtriaged: bugThe issue/pr is/fixes a bug

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

RAND_bytes occasionally leaks


10 participants

@npajkovsky@mbroz@openssl-machine@t8m@bukka@esyr@nhorman@mattcaswell@paulidale@jogme

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Fix failure checking on thread_local storage assignment in rand_lib - #31442
Closed
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Closed
Fix failure checking on thread_local storage assignment in rand_lib#31442
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Conversation
@npajkovsky
@npajkovskynpajkovsky
commented
Jun 10, 2026

Copy link


Copy Markdown

The new malloc failure test caught an asan error in this code: Direct leak of 40 byte(s) in 1 object(s) allocated from:

2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211

2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231

2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353

2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666

2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843

2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490

2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191

2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958

2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56

2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125

2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342

2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31

2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an EVP_RAND_CTX object in its thread local storage, it neglects to check the return code of the operation, which may fail when the associated sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private] operation so the failure is graceful.
Fixes: #31375

Signed-off-by: Nikola Pajkovsky nikolap@openssl.org
(cherry picked from commit 7f780be)
@npajkovskynpajkovsky
self-assigned this
Jun 10, 2026
@npajkovskynpajkovsky
added

branch: 3.0
Applies to openssl-3.0 branch
branch: 3.4
Applies to openssl-3.4
branch: 3.5
Applies to openssl-3.5
approval: review pending
This pull request needs review by a committer
labels
Jun 10, 2026
@npajkovskynpajkovsky
linked an issue
Jun 10, 2026
that may be
closed
by this pull request


RAND_bytes occasionally leaks
#31375

Closed

@mbroz
mbroz
commented
Jun 10, 2026

Copy link


Copy Markdown

Member
Test failures are apparently relevant here...
@github-actionsgithub-actionsBot
added
the 
severity: fips change
The pull request changes FIPS provider sources
label
Jun 10, 2026
mbroz
mbroz
previously approved these changes
Jun 10, 2026
View reviewed changes
@mbrozmbroz
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
jogme
jogme
previously approved these changes
Jun 11, 2026
View reviewed changes
@jogmejogme
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 11, 2026
nhorman
nhorman
previously approved these changes
Jun 11, 2026
View reviewed changes
@t8mt8m
added

triaged: bug
The issue/pr is/fixes a bug
tests: exempted
The PR is exempt from requirements for testing
labels
Jun 11, 2026
t8m
t8m
previously approved these changes
Jun 11, 2026
View reviewed changes
paulidale
paulidale
previously approved these changes
Jun 12, 2026
View reviewed changes
mattcaswell
mattcaswell
previously approved these changes
Jun 12, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 12, 2026
@openssl-machine
openssl-machine
commented
Jun 12, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
bukka
bukka
reviewed
Jun 12, 2026
View reviewed changes
Comment threadcrypto/rand/rand_lib.c
 rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL,
 SECONDARY_RESEED_TIME_INTERVAL);
 CRYPTO_THREAD_set_local(&dgbl->public, rand);
 if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@bukkabukkaJun 12, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might also make sense not to call it if rand allocation fails. Something like

Suggested change

if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
if (rand!=NULL&&!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@npajkovskynpajkovskyJun 15, 2026

Copy link


Copy Markdown

Author
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, I just pushed the version with rand != NULL, but then I realised that it would diverge from master.
If we want to have rand != NULL, then it should go from master down to 3.0.
@bukkabukkaJun 15, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I didn't realise that this a backport. Sure. It would be probably enough to do it only in master as it doesn't seem like a real bug - it just sets data to NULL and keeps used unchanged as 1 so it's like after init.
@openssl-machineopenssl-machine
added

approval: review pending
This pull request needs review by a committer
and removed

approval: ready to merge
The 24 hour grace period has passed, ready to merge
labels
Jun 15, 2026
@npajkovsky
npajkovsky
commented
Jun 15, 2026

Copy link


Copy Markdown

Author
Please re-approve.
t8m
t8m
approved these changes
Jun 15, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 15, 2026
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 16, 2026
@openssl-machine
openssl-machine
commented
Jun 16, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
esyr
esyr
requested changes
Jun 16, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please preserve the authorship of the original commit.
@nhorman@nikolapajkovsky
Fix failure checking on thread_local storage assignment in rand_lib
c2fa873
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z openssl#1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z openssl#2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z openssl#3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z openssl#4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z openssl#5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z openssl#6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z openssl#7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z openssl#8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z openssl#9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z openssl#10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z openssl#11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z openssl#12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z openssl#13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z openssl#14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z openssl#15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: openssl#31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
@npajkovsky
npajkovsky
commented
Jun 17, 2026

Copy link


Copy Markdown

Author
Please preserve the authorship of the original commit.
Ooops, that was not intentional.
esyr
esyr
approved these changes
Jun 17, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now, thank you.
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
316bb20
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
48cd9e2
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8m
t8m
commented
Jun 18, 2026

Copy link


Copy Markdown

Member
Merged to the 3.5, 3.4 and 3.0 branches. Thank you.
@t8mt8m
closed this
Jun 18, 2026
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
57c4d07
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8mt8m
mentioned this pull request
Jun 18, 2026

Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bukkabukkabukka left review comments
@esyresyresyr approved these changes
@nhormannhormannhorman approved these changes
@t8mt8mt8m approved these changes
@jogmejogmejogme approved these changes
@mbrozmbrozAwaiting requested review from mbroz
@mattcaswellmattcaswellAwaiting requested review from mattcaswell
@paulidalepaulidaleAwaiting requested review from paulidale

Assignees

@npajkovskynpajkovsky

Labels

approval: ready to mergeThe 24 hour grace period has passed, ready to mergebranch: 3.0Applies to openssl-3.0 branchbranch: 3.4Applies to openssl-3.4branch: 3.5Applies to openssl-3.5severity: fips changeThe pull request changes FIPS provider sourcestests: exemptedThe PR is exempt from requirements for testingtriaged: bugThe issue/pr is/fixes a bug

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

RAND_bytes occasionally leaks


10 participants

@npajkovsky@mbroz@openssl-machine@t8m@bukka@esyr@nhorman@mattcaswell@paulidale@jogme

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Fix failure checking on thread_local storage assignment in rand_lib - #31442
Closed
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Closed
Fix failure checking on thread_local storage assignment in rand_lib#31442
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Conversation
@npajkovsky
@npajkovskynpajkovsky
commented
Jun 10, 2026

Copy link


Copy Markdown

The new malloc failure test caught an asan error in this code: Direct leak of 40 byte(s) in 1 object(s) allocated from:

2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211

2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231

2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353

2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666

2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843

2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490

2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191

2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958

2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56

2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125

2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342

2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31

2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an EVP_RAND_CTX object in its thread local storage, it neglects to check the return code of the operation, which may fail when the associated sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private] operation so the failure is graceful.
Fixes: #31375

Signed-off-by: Nikola Pajkovsky nikolap@openssl.org
(cherry picked from commit 7f780be)
@npajkovskynpajkovsky
self-assigned this
Jun 10, 2026
@npajkovskynpajkovsky
added

branch: 3.0
Applies to openssl-3.0 branch
branch: 3.4
Applies to openssl-3.4
branch: 3.5
Applies to openssl-3.5
approval: review pending
This pull request needs review by a committer
labels
Jun 10, 2026
@npajkovskynpajkovsky
linked an issue
Jun 10, 2026
that may be
closed
by this pull request


RAND_bytes occasionally leaks
#31375

Closed

@mbroz
mbroz
commented
Jun 10, 2026

Copy link


Copy Markdown

Member
Test failures are apparently relevant here...
@github-actionsgithub-actionsBot
added
the 
severity: fips change
The pull request changes FIPS provider sources
label
Jun 10, 2026
mbroz
mbroz
previously approved these changes
Jun 10, 2026
View reviewed changes
@mbrozmbroz
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
jogme
jogme
previously approved these changes
Jun 11, 2026
View reviewed changes
@jogmejogme
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 11, 2026
nhorman
nhorman
previously approved these changes
Jun 11, 2026
View reviewed changes
@t8mt8m
added

triaged: bug
The issue/pr is/fixes a bug
tests: exempted
The PR is exempt from requirements for testing
labels
Jun 11, 2026
t8m
t8m
previously approved these changes
Jun 11, 2026
View reviewed changes
paulidale
paulidale
previously approved these changes
Jun 12, 2026
View reviewed changes
mattcaswell
mattcaswell
previously approved these changes
Jun 12, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 12, 2026
@openssl-machine
openssl-machine
commented
Jun 12, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
bukka
bukka
reviewed
Jun 12, 2026
View reviewed changes
Comment threadcrypto/rand/rand_lib.c
 rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL,
 SECONDARY_RESEED_TIME_INTERVAL);
 CRYPTO_THREAD_set_local(&dgbl->public, rand);
 if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@bukkabukkaJun 12, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might also make sense not to call it if rand allocation fails. Something like

Suggested change

if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
if (rand!=NULL&&!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@npajkovskynpajkovskyJun 15, 2026

Copy link


Copy Markdown

Author
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, I just pushed the version with rand != NULL, but then I realised that it would diverge from master.
If we want to have rand != NULL, then it should go from master down to 3.0.
@bukkabukkaJun 15, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I didn't realise that this a backport. Sure. It would be probably enough to do it only in master as it doesn't seem like a real bug - it just sets data to NULL and keeps used unchanged as 1 so it's like after init.
@openssl-machineopenssl-machine
added

approval: review pending
This pull request needs review by a committer
and removed

approval: ready to merge
The 24 hour grace period has passed, ready to merge
labels
Jun 15, 2026
@npajkovsky
npajkovsky
commented
Jun 15, 2026

Copy link


Copy Markdown

Author
Please re-approve.
t8m
t8m
approved these changes
Jun 15, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 15, 2026
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 16, 2026
@openssl-machine
openssl-machine
commented
Jun 16, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
esyr
esyr
requested changes
Jun 16, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please preserve the authorship of the original commit.
@nhorman@nikolapajkovsky
Fix failure checking on thread_local storage assignment in rand_lib
c2fa873
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z openssl#1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z openssl#2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z openssl#3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z openssl#4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z openssl#5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z openssl#6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z openssl#7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z openssl#8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z openssl#9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z openssl#10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z openssl#11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z openssl#12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z openssl#13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z openssl#14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z openssl#15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: openssl#31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
@npajkovsky
npajkovsky
commented
Jun 17, 2026

Copy link


Copy Markdown

Author
Please preserve the authorship of the original commit.
Ooops, that was not intentional.
esyr
esyr
approved these changes
Jun 17, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now, thank you.
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
316bb20
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
48cd9e2
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8m
t8m
commented
Jun 18, 2026

Copy link


Copy Markdown

Member
Merged to the 3.5, 3.4 and 3.0 branches. Thank you.
@t8mt8m
closed this
Jun 18, 2026
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
57c4d07
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8mt8m
mentioned this pull request
Jun 18, 2026

Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bukkabukkabukka left review comments
@esyresyresyr approved these changes
@nhormannhormannhorman approved these changes
@t8mt8mt8m approved these changes
@jogmejogmejogme approved these changes
@mbrozmbrozAwaiting requested review from mbroz
@mattcaswellmattcaswellAwaiting requested review from mattcaswell
@paulidalepaulidaleAwaiting requested review from paulidale

Assignees

@npajkovskynpajkovsky

Labels

approval: ready to mergeThe 24 hour grace period has passed, ready to mergebranch: 3.0Applies to openssl-3.0 branchbranch: 3.4Applies to openssl-3.4branch: 3.5Applies to openssl-3.5severity: fips changeThe pull request changes FIPS provider sourcestests: exemptedThe PR is exempt from requirements for testingtriaged: bugThe issue/pr is/fixes a bug

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

RAND_bytes occasionally leaks


10 participants

@npajkovsky@mbroz@openssl-machine@t8m@bukka@esyr@nhorman@mattcaswell@paulidale@jogme

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Fix failure checking on thread_local storage assignment in rand_lib - #31442
Closed
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Closed
Fix failure checking on thread_local storage assignment in rand_lib#31442
npajkovsky wants to merge 1 commit into
openssl:openssl-3.5from 
npajkovsky:rand-byte-leak
Conversation
@npajkovsky
@npajkovskynpajkovsky
commented
Jun 10, 2026

Copy link


Copy Markdown

The new malloc failure test caught an asan error in this code: Direct leak of 40 byte(s) in 1 object(s) allocated from:

2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69

2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211

2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231

2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353

2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666

2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843

2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490

2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191

2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958

2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56

2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125

2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342

2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31

2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)

2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an EVP_RAND_CTX object in its thread local storage, it neglects to check the return code of the operation, which may fail when the associated sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private] operation so the failure is graceful.
Fixes: #31375

Signed-off-by: Nikola Pajkovsky nikolap@openssl.org
(cherry picked from commit 7f780be)
@npajkovskynpajkovsky
self-assigned this
Jun 10, 2026
@npajkovskynpajkovsky
added

branch: 3.0
Applies to openssl-3.0 branch
branch: 3.4
Applies to openssl-3.4
branch: 3.5
Applies to openssl-3.5
approval: review pending
This pull request needs review by a committer
labels
Jun 10, 2026
@npajkovskynpajkovsky
linked an issue
Jun 10, 2026
that may be
closed
by this pull request


RAND_bytes occasionally leaks
#31375

Closed

@mbroz
mbroz
commented
Jun 10, 2026

Copy link


Copy Markdown

Member
Test failures are apparently relevant here...
@github-actionsgithub-actionsBot
added
the 
severity: fips change
The pull request changes FIPS provider sources
label
Jun 10, 2026
mbroz
mbroz
previously approved these changes
Jun 10, 2026
View reviewed changes
@mbrozmbroz
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
jogme
jogme
previously approved these changes
Jun 11, 2026
View reviewed changes
@jogmejogme
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks!
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 11, 2026
nhorman
nhorman
previously approved these changes
Jun 11, 2026
View reviewed changes
@t8mt8m
added

triaged: bug
The issue/pr is/fixes a bug
tests: exempted
The PR is exempt from requirements for testing
labels
Jun 11, 2026
t8m
t8m
previously approved these changes
Jun 11, 2026
View reviewed changes
paulidale
paulidale
previously approved these changes
Jun 12, 2026
View reviewed changes
mattcaswell
mattcaswell
previously approved these changes
Jun 12, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 12, 2026
@openssl-machine
openssl-machine
commented
Jun 12, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
bukka
bukka
reviewed
Jun 12, 2026
View reviewed changes
Comment threadcrypto/rand/rand_lib.c
 rand = rand_new_drbg(ctx, primary, SECONDARY_RESEED_INTERVAL,
 SECONDARY_RESEED_TIME_INTERVAL);
 CRYPTO_THREAD_set_local(&dgbl->public, rand);
 if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@bukkabukkaJun 12, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might also make sense not to call it if rand allocation fails. Something like

Suggested change

if (!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
if (rand!=NULL&&!CRYPTO_THREAD_set_local(&dgbl->public, rand)) {
@npajkovskynpajkovskyJun 15, 2026

Copy link


Copy Markdown

Author
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, I just pushed the version with rand != NULL, but then I realised that it would diverge from master.
If we want to have rand != NULL, then it should go from master down to 3.0.
@bukkabukkaJun 15, 2026

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah I didn't realise that this a backport. Sure. It would be probably enough to do it only in master as it doesn't seem like a real bug - it just sets data to NULL and keeps used unchanged as 1 so it's like after init.
@openssl-machineopenssl-machine
added

approval: review pending
This pull request needs review by a committer
and removed

approval: ready to merge
The 24 hour grace period has passed, ready to merge
labels
Jun 15, 2026
@npajkovsky
npajkovsky
commented
Jun 15, 2026

Copy link


Copy Markdown

Author
Please re-approve.
t8m
t8m
approved these changes
Jun 15, 2026
View reviewed changes
@openssl-machineopenssl-machine
added

approval: done
This pull request has the required number of approvals
and removed

approval: review pending
This pull request needs review by a committer
labels
Jun 15, 2026
@openssl-machineopenssl-machine
added

approval: ready to merge
The 24 hour grace period has passed, ready to merge
and removed

approval: done
This pull request has the required number of approvals
labels
Jun 16, 2026
@openssl-machine
openssl-machine
commented
Jun 16, 2026

Copy link


Copy Markdown

Collaborator
This pull request is ready to merge
esyr
esyr
requested changes
Jun 16, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please preserve the authorship of the original commit.
@nhorman@nikolapajkovsky
Fix failure checking on thread_local storage assignment in rand_lib
c2fa873
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z openssl#1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z openssl#2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z openssl#3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z openssl#4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z openssl#5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z openssl#6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z openssl#7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z openssl#8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z openssl#9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z openssl#10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z openssl#11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z openssl#12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z openssl#13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z openssl#14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z openssl#15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: openssl#31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
@npajkovsky
npajkovsky
commented
Jun 17, 2026

Copy link


Copy Markdown

Author
Please preserve the authorship of the original commit.
Ooops, that was not intentional.
esyr
esyr
approved these changes
Jun 17, 2026
View reviewed changes
@esyresyr
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now, thank you.
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
316bb20
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
48cd9e2
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8m
t8m
commented
Jun 18, 2026

Copy link


Copy Markdown

Member
Merged to the 3.5, 3.4 and 3.0 branches. Thank you.
@t8mt8m
closed this
Jun 18, 2026
openssl-machine pushed a commit
that referenced
this pull request
Jun 18, 2026
@nhorman@t8m
Fix failure checking on thread_local storage assignment in rand_lib
57c4d07
The new malloc failure test caught an asan error in this code:
Direct leak of 40 byte(s) in 1 object(s) allocated from:
2025-08-07T03:22:20.3655117Z #0 0x7fb88d8fd9c7 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
2025-08-07T03:22:20.3655796Z #1 0x5584f0e4670a in CRYPTO_malloc crypto/mem.c:211
2025-08-07T03:22:20.3656291Z #2 0x5584f0e4679d in CRYPTO_zalloc crypto/mem.c:231
2025-08-07T03:22:20.3657040Z #3 0x5584f11c4c10 in EVP_RAND_CTX_new crypto/evp/evp_rand.c:353
2025-08-07T03:22:20.3657656Z #4 0x5584f0e93b27 in rand_new_drbg crypto/rand/rand_lib.c:666
2025-08-07T03:22:20.3658289Z #5 0x5584f0e949d0 in rand_get0_public crypto/rand/rand_lib.c:843
2025-08-07T03:22:20.3658914Z #6 0x5584f0e9305b in RAND_bytes_ex crypto/rand/rand_lib.c:490
2025-08-07T03:22:20.3659486Z #7 0x5584f0b2405f in SSL_CTX_new_ex ssl/ssl_lib.c:4191
2025-08-07T03:22:20.3660183Z #8 0x5584f0ae313c in create_ssl_ctx_pair test/helpers/ssltestlib.c:958
2025-08-07T03:22:20.3660871Z #9 0x5584f0adeaf6 in do_handshake test/handshake-memfail.c:56
2025-08-07T03:22:20.3661539Z #10 0x5584f0adee50 in test_alloc_failures test/handshake-memfail.c:125
2025-08-07T03:22:20.3662161Z #11 0x5584f0cd9da8 in run_tests test/testutil/driver.c:342
2025-08-07T03:22:20.3662664Z #12 0x5584f0cda9e5 in main test/testutil/main.c:31
2025-08-07T03:22:20.3663450Z #13 0x7fb88d42a1c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3664630Z #14 0x7fb88d42a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f)
2025-08-07T03:22:20.3666608Z #15 0x5584f0ade864 in _start (/home/runner/work/openssl/openssl/test/handshake-memfail+0x22a864) (BuildId: 19659a44d8bed2c082918d25425f77e3a98df534)
It occurs because when rand_get0_public/rand_get0_private sets an
EVP_RAND_CTX object in its thread local storage, it neglects to check
the return code of the operation, which may fail when the associated
sparse array is expanded.
fix it by checking the return code and failing the get0_[public|private]
operation so the failure is graceful.
Fixes: #31375
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
(cherry picked from commit 7f780be)
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 18 12:38:33 2026
(Merged from #31442)
(cherry picked from commit 316bb20)
@t8mt8m
mentioned this pull request
Jun 18, 2026

Closed

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bukkabukkabukka left review comments
@esyresyresyr approved these changes
@nhormannhormannhorman approved these changes
@t8mt8mt8m approved these changes
@jogmejogmejogme approved these changes
@mbrozmbrozAwaiting requested review from mbroz
@mattcaswellmattcaswellAwaiting requested review from mattcaswell
@paulidalepaulidaleAwaiting requested review from paulidale

Assignees

@npajkovskynpajkovsky

Labels

approval: ready to mergeThe 24 hour grace period has passed, ready to mergebranch: 3.0Applies to openssl-3.0 branchbranch: 3.4Applies to openssl-3.4branch: 3.5Applies to openssl-3.5severity: fips changeThe pull request changes FIPS provider sourcestests: exemptedThe PR is exempt from requirements for testingtriaged: bugThe issue/pr is/fixes a bug

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

RAND_bytes occasionally leaks


10 participants

@npajkovsky@mbroz@openssl-machine@t8m@bukka@esyr@nhorman@mattcaswell@paulidale@jogme