Skip to content

fix: plug sign() memory leak and normalize check_key() return #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
timlegge merged 1 commit into from
Mar 20, 2026
Merged

fix: plug sign() memory leak and normalize check_key() return #128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions RSA.xs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -956,10 +956,10 @@ check_key(p_rsa)
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_from_pkey(NULL, p_rsa->rsa, NULL);
CHECK_OPEN_SSL(pctx);
RETVAL = EVP_PKEY_private_check(pctx);
RETVAL = (EVP_PKEY_private_check(pctx) == 1);
EVP_PKEY_CTX_free(pctx);
#else
RETVAL = RSA_check_key(p_rsa->rsa);
RETVAL = (RSA_check_key(p_rsa->rsa) == 1);
#endif
OUTPUT:
RETVAL
Expand Down Expand Up @@ -1086,7 +1086,7 @@ sign(p_rsa, text_SV)
rsaData* p_rsa;
SV* text_SV;
PREINIT:
UNSIGNED_CHAR *signature;
UNSIGNED_CHAR *signature = NULL;
unsigned char* digest;
SIZE_T_UNSIGNED_INT signature_length;
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
Expand Down Expand Up @@ -1133,6 +1133,7 @@ sign(p_rsa, text_SV)

goto sign_done;
err:
Safefree(signature);
if (md) EVP_MD_free(md);
if (ctx) EVP_PKEY_CTX_free(ctx);
CHECK_OPEN_SSL(0);
Expand Down
12 changes: 11 additions & 1 deletion t/check_param.t
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Crypt::OpenSSL::RSA->import_random_seed();
my $HAS_BIGNUM = $INC{'Crypt/OpenSSL/Bignum.pm'} ? 1 : 0;

$HAS_BIGNUM
? plan( tests => 7 )
? plan( tests => 9 )
: plan( skip_all => "Crypt::OpenSSL::Bignum required for check_param tests" );

my $rsa = Crypt::OpenSSL::RSA->generate_key(2048);
Expand Down Expand Up @@ -60,3 +60,13 @@ my ( $n, $e, $d, $p, $q ) = $rsa->get_key_parameters();
};
ok( !$@, "without check option, valid params succeed as before" );
}

# 5. check_key() returns exactly 1, not just truthy
# OpenSSL's RSA_check_key/EVP_PKEY_private_check can return -1 on error,
# which is truthy in Perl. The XS code must normalize to 0/1.
{
cmp_ok( $rsa->check_key(), '==', 1,
"check_key returns exactly 1 for valid key (not raw OpenSSL int)" );
ok( ref(\($rsa->check_key())) ne 'GLOB',
"check_key returns a plain scalar" );
}
Loading