From patchwork Sun Nov 1 21:46:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5539 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp4694461laa; Sun, 1 Nov 2026 13:46:57 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBw/sHzh6MYUm44nuybEP0MtH+Ln0obNnZNtx28NY6yc7tpky89+SyVwbYbtjwUbA1q5vi7Di4o72Rw=@openvpn.net X-Received: by 2002:a05:7300:fe41:b0:34c:fb30:3e30 with SMTP id 5a478bee46e88-36a42401960mr12925514eec.7.1793569616879; Sun, 01 Nov 2026 13:46:56 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793569616; cv=none; d=google.com; s=arc-20260327; b=WKpPgbbZAhhPf3fkZ9ggT3ObrkjNCdsxu1K6G7yC2FvIAebUGkipzJJsQMygzMDOW7 7Kt7jTkG4T0h+RNOMJJIb0V4BBNw7NkSon8URLkBtLGxRAipOugRgHirZjKxy+De/4Gy AcNAZjwOCA+169YTEkkQnaLJr6BsVgVu1jBU8GCijktTyGV2kukWkREFbKOzl3tqQ4fz eDyEqztP8hSQSaZKciuCmGQkyHePM5g3wznUYvppvx4uC3lRqBEts76yNk4Ispho6v7s hOMKcK02E2+OsZgpbsdCpfn84PV0wTOO8cYPa4UpAy0IAOjOAAauOzWRk5Zkd8aFVlc4 TNKQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=htifoprLngVM26+4nIinxd8LsrL+uOcibJ9FoUncDQw=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=gCgTeueG3S7XMfPg7nC+NiNLwMhhkZPlS/nAzB/GtpfWzbFlZ6s5D0NpdQ6zpQAU6p dT8sIWLMOSGsqa+is+O1wEJX9uo7a900QRr0DnKS9v0W6TP9lkb5bqfeHoe0qI0uYvAS wQknAuFgRigeMc4uanP7Z6lZ79G4AiE+rUDPqqqIwA1hGB8q1ZMk3dnRy0FbhvgoxFYk z3QL70zgif/KXHFNBwLhTqKuQP37s1ye54uiOzdl6Ij7xw5jddUw+fyTAhGZHgK2uu/v Jh1pkRgVv9/J8DiH53gZEKAmWxUf7AC7ZwGhjblUaiWtUW2cUahn2cO2fO+D5078ujQc dyjw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=KAIiUgRt; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=KUX9gDcT; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=VHuR71wW; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5a478bee46e88-36a42b0718csi34129662eec.51.2026.11.01.13.46.56 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sun, 01 Nov 2026 13:46:56 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=KAIiUgRt; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=KUX9gDcT; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=VHuR71wW; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=htifoprLngVM26+4nIinxd8LsrL+uOcibJ9FoUncDQw=; b=KAIiUgRt30Jht0 E7zSFvGvA+qMFDl+Tow9kflbJG76hpPD621K313LGG6qq/ui0brsIBTJlvQYWlpgBXuhcLzlnYwfj v+hNMt9nvj9MgOUEHCDKE3hvS5mb7ZNsJvKLlg5l+idfbUFiXbfOUboMhU35U4dqiROHq7LokvZ2T 0mw=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xNdOB-000000001Aj-17R2; Sun, 01 Nov 2026 21:46:55 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xNdO9-000000001Ac-3xO2 for openvpn-devel@lists.sourceforge.net; Sun, 01 Nov 2026 21:46:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=y2dw5RbSd3j60/WF8sZqkT4Es72rbw/AMxUzw0+etMI=; b=KUX9gDcTbilM5MW44/hCz5tL7c MY/5yTa053yya1KkDz7s1H77bNJdUuDL9HT6YZu3SI/6J8MsiIiqnK7I/nEkI68f94itSDrYnnihM 8Z/CDXFxNt8TZqmsQ9fDR2dvumZdHIKk3LzmPqOwdi3HpGwAhZqwcTMfNIXzaIqlEdzI=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=y2dw5RbSd3j60/WF8sZqkT4Es72rbw/AMxUzw0+etMI=; b=VHuR71wWlPwb8LSlotsyzgM1iz m4AO8HQiw6J5gKLfYEr91gDBb2FQ6NnT57vQfyvqf859jR1N3t2gPcf1le4/AeT9etCglKOfJ3dLG O69Mb63FL3WGRXpzijWvlXBdn5eYvGcooRT50DIIVLvqmuTBxgmsZzDJtJo+z6l6LKyc=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xNdO8-0000000030i-3Ghq for openvpn-devel@lists.sourceforge.net; Sun, 01 Nov 2026 21:46:53 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6A1Lkjll022376 for ; Sun, 1 Nov 2026 22:46:45 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6A1Lkjb2022375 for openvpn-devel@lists.sourceforge.net; Sun, 1 Nov 2026 22:46:45 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Sun, 1 Nov 2026 22:46:40 +0100 Message-ID: <20261101214645.22350-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Hansaem Wi crypto_pem_decode() decodes the tls-crypt-v2 client and server keys and the auth-token key, and frees the decoded key bytes it got from PEM_read_bio() with OPENSSL_free(). Use OPENSSL_clear_free() ins [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xNdO8-0000000030i-3Ghq Subject: [Openvpn-devel] [PATCH v1] crypto_openssl: Clear PEM decoded key data before freeing it X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880694054126384604 X-GMAIL-MSGID: 1880694054126384604 From: Hansaem Wi crypto_pem_decode() decodes the tls-crypt-v2 client and server keys and the auth-token key, and frees the decoded key bytes it got from PEM_read_bio() with OPENSSL_free(). Use OPENSSL_clear_free() instead. Assisted-by: Claude Code:claude-opus-5-5 Change-Id: I6b42785de99ee1e6b555d8c5e61ebe2ae784510e Signed-off-by: Hansaem Wi Acked-by: Steffan Karger Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2077 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2077 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Steffan Karger diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c index e6abd8f..e6873bb 100644 --- a/src/openvpn/crypto_openssl.c +++ b/src/openvpn/crypto_openssl.c @@ -528,7 +528,7 @@ cleanup: OPENSSL_free(name_read); OPENSSL_free(header_read); - OPENSSL_free(data_read); + OPENSSL_clear_free(data_read, data_read_len); if (!BIO_free(bio)) { ret = false;