| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | wurongxin(at)xmu(dot)edu(dot)cn |
| Cc: | pgsql-bugs(at)lists(dot)postgresql(dot)org |
| Subject: | Re: BUG #16070: A double-free bug in interfaces/libpq/fe-secure-openssl.c |
| Date: | 2019-10-20 14:17:11 |
| Message-ID: | 13213.1571581031@sss.pgh.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
PG Bug reporting form <noreply(at)postgresql(dot)org> writes:
> In
> https://github.com/postgres/postgres/blob/REL_10_STABLE/src/interfaces/libpq/fe-secure-openssl.c,
> at Line 1206, it would call the function "ENGINE_finish" and free
> conn->engine. At Line 1207, it would call the function "ENGINE_free" and
> free conn->engine again. This would lead to a double free bug.
I don't really believe this; if there were a double-free problem here,
we'd surely have noticed it long since.
Taking a look at the OpenSSL source code, it looks like engine_free_util
decrements a reference count and doesn't actually delete anything until
that's gone to zero. So maybe the refcount is 2 at the beginning of
this sequence?
regards, tom lane
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2019-10-20 21:57:14 | Re: Re: BUG #16068: Collate of 'Norwegian Bokmål' is problematic |
| Previous Message | PG Bug reporting form | 2019-10-20 08:58:17 | BUG #16070: A double-free bug in interfaces/libpq/fe-secure-openssl.c |