Fix bug where freed OIDs could be accessed in EVP_cleanup() by

[openssl.git] / crypto / evp / names.c

diff --git a/crypto/evp/names.c b/crypto/evp/names.c
index 3e8f4603285124091032daec2496ac8307a00c3f..348df71cba23f1bfee15b147c200ebe6ea3e7a74 100644 (file)
--- a/crypto/evp/names.c
+++ b/crypto/evp/names.c
@@ -62,25 +62,30 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 
-int EVP_add_cipher(EVP_CIPHER *c)
+extern int obj_cleanup_defer;
+extern void check_defer(int nid);
+
+int EVP_add_cipher(const EVP_CIPHER *c)
        {
        int r;
 
-       r=OBJ_NAME_add(OBJ_nid2sn(c->nid),OBJ_NAME_TYPE_CIPHER_METH,(char *)c);
+       r=OBJ_NAME_add(OBJ_nid2sn(c->nid),OBJ_NAME_TYPE_CIPHER_METH,(const char *)c);
        if (r == 0) return(0);
-       r=OBJ_NAME_add(OBJ_nid2ln(c->nid),OBJ_NAME_TYPE_CIPHER_METH,(char *)c);
+       check_defer(c->nid);
+       r=OBJ_NAME_add(OBJ_nid2ln(c->nid),OBJ_NAME_TYPE_CIPHER_METH,(const char *)c);
        return(r);
        }
 
-int EVP_add_digest(EVP_MD *md)
+int EVP_add_digest(const EVP_MD *md)
        {
        int r;
        const char *name;
 
        name=OBJ_nid2sn(md->type);
-       r=OBJ_NAME_add(name,OBJ_NAME_TYPE_MD_METH,(char *)md);
+       r=OBJ_NAME_add(name,OBJ_NAME_TYPE_MD_METH,(const char *)md);
        if (r == 0) return(0);
-       r=OBJ_NAME_add(OBJ_nid2ln(md->type),OBJ_NAME_TYPE_MD_METH,(char *)md);
+       check_defer(md->type);
+       r=OBJ_NAME_add(OBJ_nid2ln(md->type),OBJ_NAME_TYPE_MD_METH,(const char *)md);
        if (r == 0) return(0);
 
        if (md->type != md->pkey_type)
@@ -88,6 +93,7 @@ int EVP_add_digest(EVP_MD *md)
                r=OBJ_NAME_add(OBJ_nid2sn(md->pkey_type),
                        OBJ_NAME_TYPE_MD_METH|OBJ_NAME_ALIAS,name);
                if (r == 0) return(0);
+               check_defer(md->pkey_type);
                r=OBJ_NAME_add(OBJ_nid2ln(md->pkey_type),
                        OBJ_NAME_TYPE_MD_METH|OBJ_NAME_ALIAS,name);
                }
@@ -114,5 +120,15 @@ void EVP_cleanup(void)
        {
        OBJ_NAME_cleanup(OBJ_NAME_TYPE_CIPHER_METH);
        OBJ_NAME_cleanup(OBJ_NAME_TYPE_MD_METH);
+       /* The above calls will only clean out the contents of the name
+          hash table, but not the hash table itself.  The following line
+          does that part.  -- Richard Levitte */
+       OBJ_NAME_cleanup(-1);
+
        EVP_PBE_cleanup();
+       if (obj_cleanup_defer == 2)
+               {
+               obj_cleanup_defer = 0;
+               OBJ_cleanup();
+               }
        }