Skip to content

[Crash] RAND_load_file() with specific file-sizes #7449

@gvanem

Description

@gvanem

Some file-sizes given to this command:

openssl.exe rand -rand rand-file -hex 10

crashes in some mysterious ways while freeing the associated RAND_POOL. The call-stack from WinDbg:

ntdll!RtlReportCriticalFailure+0x88
ntdll!RtlpReportHeapFailure+0x2f
ntdll!RtlpHpHeapHandleError+0x6e
ntdll!RtlpLogHeapFailure+0x41
ntdll!RtlFreeHeap+0x4cbbc
ucrtbase!_free_base+0x1b
ucrtbase!free+0x18
libcrypto_1_1!CRYPTO_free(void * str = 0x011d0000, char * file = 0x6b77f9c4 "crypto/rand/rand_lib.c", int line = 0n506)+0x45 [f:\mingw32\src\inet\crypto\openssl\crypto\mem.c @ 307] 
libcrypto_1_1!rand_pool_free(struct rand_pool_st * pool = 0x075a84b0)+0x36 [f:\mingw32\src\inet\crypto\openssl\crypto\rand\rand_lib.c @ 506] 
libcrypto_1_1!rand_drbg_restart(struct rand_drbg_st * drbg = 0x0804daf8, unsigned char * buffer = 0x010fe4f8 "", unsigned int len = 0x16, unsigned int entropy = 0xb0)+0x1cd [f:\mingw32\src\inet\crypto\openssl\crypto\rand\drbg_lib.c @ 632] 
libcrypto_1_1!drbg_add(void * buf = 0x010fe4f8, int num = 0n22, double randomness = 22)+0x8b [f:\mingw32\src\inet\crypto\openssl\crypto\rand\drbg_lib.c @ 1062] 
libcrypto_1_1!RAND_add(void * buf = 0x010fe4f8, int num = 0n22, double randomness = 22)+0x2b [f:\mingw32\src\inet\crypto\openssl\crypto\rand\rand_lib.c @ 783] 
libcrypto_1_1!RAND_load_file(char * file = 0x076233c1 "rand-file", long bytes = 0n-1)+0x186 [f:\mingw32\src\inet\crypto\openssl\crypto\rand\randfile.c @ 142] 
openssl!loadfiles+0x2b [f:\mingw32\src\inet\crypto\openssl\apps\app_rand.c @ 46] 
openssl!opt_rand(int opt = 0n1501)+0x7b [f:\mingw32\src\inet\crypto\openssl\apps\app_rand.c @ 85] 
openssl!rand_main(int argc = 0n5, char ** argv = 0x0762338c)+0xb3 [f:\mingw32\src\inet\crypto\openssl\apps\rand.c @ 68] 
openssl!do_cmd(struct lhash_st_FUNCTION * prog = 0x07624cc0, int argc = 0n5, char ** argv = 0x0762338c)+0x68 [f:\mingw32\src\inet\crypto\openssl\apps\openssl.c @ 620] 
openssl!main(int argc = 0n0, char ** argv = 0x011e45b8)+0x24d 

I created the rand-file using CygWin's truncate:

Command Result
truncate.exe -s 10000000 rand-file OKAY
truncate.exe -s 10000 rand-file OKAY
truncate.exe -s 1000 rand-file OKAY
truncate.exe -s 1046 rand-file not OKAY
truncate.exe -s 2048 rand-file OKAY

I'm on Windows-10 using MSVC-2017.
Some other discussion of this issue is here too:
3064b55#commitcomment-30980301

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions