From owner-freebsd-bugs@freebsd.org Tue Dec 24 15:18:45 2019 Return-Path: Delivered-To: freebsd-bugs@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 7FED51EA936 for ; Tue, 24 Dec 2019 15:18:45 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mailman.nyi.freebsd.org (unknown [127.0.1.3]) by mx1.freebsd.org (Postfix) with ESMTP id 47j0H92tyfz3wnB for ; Tue, 24 Dec 2019 15:18:45 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: by mailman.nyi.freebsd.org (Postfix) id 613FD1EA935; Tue, 24 Dec 2019 15:18:45 +0000 (UTC) Delivered-To: bugs@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 5FDCB1EA934 for ; Tue, 24 Dec 2019 15:18:45 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 47j0H91nT9z3wn9 for ; Tue, 24 Dec 2019 15:18:45 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 348AF200E for ; Tue, 24 Dec 2019 15:18:45 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id xBOFIj3L014944 for ; Tue, 24 Dec 2019 15:18:45 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id xBOFIjIk014943 for bugs@FreeBSD.org; Tue, 24 Dec 2019 15:18:45 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 242861] Sendmail's STARTTLS broken for 12.1-RELEASE/12.0-RELEASE/12-STABLE/HEAD Date: Tue, 24 Dec 2019 15:18:44 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: bin X-Bugzilla-Version: 12.1-RELEASE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: dan+freebsd.org@obluda.cz X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Dec 2019 15:18:45 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D242861 Bug ID: 242861 Summary: Sendmail's STARTTLS broken for 12.1-RELEASE/12.0-RELEASE/12-STABLE/HEAD Product: Base System Version: 12.1-RELEASE Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: bin Assignee: bugs@FreeBSD.org Reporter: dan+freebsd.org@obluda.cz Created attachment 210201 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D210201&action= =3Dedit tls.c::sm_RSA_generate_key() patch, based on revision 463590 of patch-tls.c https://svnweb.freebsd.org/base?view=3Drevision&revision=3D339260 Revision 339260 update made sendmail compatibible with OpenSSL 1.1.1. The change has been based on patch-tls.c taken from mail/sendmail port. It introduces sm_RSA_generate_key() function used replacement of original RSA_generate_key/RSA_generate_key_ex function. It's code is broken badly. It may use NULL pointer and it returns NULL all = the times. Code fragment of sm_RSA_generate_key() starting with: ----- bn_rsa_r4 =3D BN_new(); rc =3D BN_set_word(bn_rsa_r4, RSA_F4); if ((bn_rsa_r4 !=3D NULL) && BN_set_word(bn_rsa_r4, RSA_F4) && (rsa =3D RSA= _new()) !=3D NULL) ----- ... is broken badly. It calls BN_set_word(bn_rsa_r4, RSA_F4) twice, first time before the bn_rsa= _r4 has been verified non-NULL causing possible NULL dereferrence.=20 The "if" body returns NULL if call to RSA_generate_key_ex() has succeeded. = It's main issue causing the sm_RSA_generate_key() is returning NULL all the time= s. But it's not the only issue - code here is just wrong. It doesn't free bn_rsa_r4 most of time causing memory leak. It doesn't honor function parameters using hardcoded constants instead. The bug has been introduced in revision 463887 of the patch-tls.c port's patch: https://svnweb.freebsd.org/ports?view=3Drevision&revision=3D463887 The patch I'm proposing here is based on correct version of port's patch-tl= s.c (e.g. 463887): https://svnweb.freebsd.org/ports?view=3Drevision&revision=3D463590 --=20 You are receiving this mail because: You are the assignee for the bug.=