Skip to content

A potential NPD bug #7950

@wurongxin1987

Description

@wurongxin1987

In openssl 1.1.0, in the source file engines/e_dasync.c, there is a potential NPD bug.
image

In Line 757, EVP_aes_128_cbc_hmac_sha1() function may return null, and then is passed to the function call to dasync_cipher_init_key_helper as the fifth parameter. Later, it will be dereferenced in the source file engines/e_dasync.c at Line 638.

image

image
image

Would you help to confirm whether this is a true bug? Thanks.

Metadata

Metadata

Assignees

No one assigned

    Labels

    branch: 1.1.1Applies to OpenSSL_1_1_1-stable branch (EOL)branch: 3.0Applies to openssl-3.0 branchbranch: 3.1Applies to openssl-3.1 (EOL)branch: 3.2Applies to openssl-3.2 (EOL)branch: masterApplies to master branchtriaged: bugThe issue/pr is/fixes a bug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions