Fix a use-after-free in the child provider code

If the child provider context data gets cleaned up before all usage of
providers has finished then a use-after-free can occur. We change the
priority of this data so that it gets freed later.

Fixes #15284

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15286)

diff --git a/crypto/provider_child.c b/crypto/provider_child.c
index 2487d43fd7a4215ce1c36b61b1eabe760c36c7be..14d005462419a1186f5229098d1c1161c0dedfe8 100644 (file)
--- a/crypto/provider_child.c
+++ b/crypto/provider_child.c
@@ -47,7 +47,7 @@ static void child_prov_ossl_ctx_free(void *vgbl)
 }
 
 static const OSSL_LIB_CTX_METHOD child_prov_ossl_ctx_method = {
-    OSSL_LIB_CTX_METHOD_DEFAULT_PRIORITY,
+    OSSL_LIB_CTX_METHOD_LOW_PRIORITY,
     child_prov_ossl_ctx_new,
     child_prov_ossl_ctx_free,
 };

diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h
index d943419a52da7e9612753b32e2489c38b46bfe36..966c8f26f18c8c780468cbed84824be666eb5b4e 100644 (file)
--- a/include/internal/cryptlib.h
+++ b/include/internal/cryptlib.h
@@ -168,6 +168,7 @@ typedef struct ossl_ex_data_global_st {
 # define OSSL_LIB_CTX_CHILD_PROVIDER_INDEX          18
 # define OSSL_LIB_CTX_MAX_INDEXES                   19
 
+# define OSSL_LIB_CTX_METHOD_LOW_PRIORITY          -1
 # define OSSL_LIB_CTX_METHOD_DEFAULT_PRIORITY       0
 # define OSSL_LIB_CTX_METHOD_PRIORITY_1             1
 # define OSSL_LIB_CTX_METHOD_PRIORITY_2             2