Hello!

On Mon, Jun 19, 2017 at 04:09:43PM +0200, Bart Warmerdam wrote:

> According to the man-page of i2d_SSL_SESSION the result can be NULL or
> 0, but case the actual result can also be -1 in case of a failed
> CRYPTO_malloc. The call trace for this function is:
>
> Call chain:
> i2d_SSL_SESSION
> i2d_SSL_SESSION_ASN1
> ASN1_item_i2d
> asn1_item_flags_i2d
>
>
> The preprocessor output generates the following code:
>
> static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,
> const ASN1_ITEM *it, int flags)
> {
> if (out && !*out) {

This condition cannot be true, as nginx uses preallocated buffer
for i2d_SSL_SESSION().

(Moreover, using a preallocated buffer is this is the only
approach documented in the i2d_SSL_SESSION() manual page, and the
only one actually available before OpenSSL 1.1.0.)

[...]

--
Maxim Dounin
http://nginx.org/
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel