[v10.x Backport] Backport crypto fix to v10 by evanlucas · Pull Request #37009 · nodejs/node

[v10.x Backport] Backport crypto fix to v10 by evanlucas · Pull Request #37009 · nodejs/node

added c++

Issues and PRs that require attention from people who are familiar with C++.

Issues and PRs related to the crypto subsystem.

v10.x labels

jasnell changed the title ~~Backport crypto fix to v10~~ [v10.x Backport] Backport crypto fix to v10

When piping data into an SHA3 hash, EVP_DigestFinal_ex is called in
hash._flush, bypassing safeguards in the JavaScript layer. Calling
hash.digest causes EVP_DigestFinal_ex to be called again, resulting
in a segmentation fault in the SHA3 implementation of OpenSSL.

A relatively easy solution is to cache the result of calling
EVP_DigestFinal_ex until the Hash object is garbage collected.

PR-URL: nodejs#28251
Fixes: nodejs#28245
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

This test fails prior to 990feaf being cherry-picked
due to stream.pipeline with a crypto.Hash not working properly.

That bug also seems to have affected md5.

richardlau pushed a commit that referenced this pull request

When piping data into an SHA3 hash, EVP_DigestFinal_ex is called in
hash._flush, bypassing safeguards in the JavaScript layer. Calling
hash.digest causes EVP_DigestFinal_ex to be called again, resulting
in a segmentation fault in the SHA3 implementation of OpenSSL.

A relatively easy solution is to cache the result of calling
EVP_DigestFinal_ex until the Hash object is garbage collected.

PR-URL: #28251
Fixes: #28245
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

PR-URL: #37009
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>

richardlau pushed a commit that referenced this pull request

This test fails prior to 990feaf being cherry-picked
due to stream.pipeline with a crypto.Hash not working properly.

That bug also seems to have affected md5.

PR-URL: #37009
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>

richardlau pushed a commit that referenced this pull request

When piping data into an SHA3 hash, EVP_DigestFinal_ex is called in
hash._flush, bypassing safeguards in the JavaScript layer. Calling
hash.digest causes EVP_DigestFinal_ex to be called again, resulting
in a segmentation fault in the SHA3 implementation of OpenSSL.

A relatively easy solution is to cache the result of calling
EVP_DigestFinal_ex until the Hash object is garbage collected.

PR-URL: #28251
Fixes: #28245
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Backport-PR-URL: #37009
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>

richardlau pushed a commit that referenced this pull request

This test fails prior to 990feaf being cherry-picked
due to stream.pipeline with a crypto.Hash not working properly.

That bug also seems to have affected md5.

PR-URL: #37009
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>

richardlau pushed a commit that referenced this pull request

When piping data into an SHA3 hash, EVP_DigestFinal_ex is called in
hash._flush, bypassing safeguards in the JavaScript layer. Calling
hash.digest causes EVP_DigestFinal_ex to be called again, resulting
in a segmentation fault in the SHA3 implementation of OpenSSL.

A relatively easy solution is to cache the result of calling
EVP_DigestFinal_ex until the Hash object is garbage collected.

PR-URL: #28251
Fixes: #28245
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Backport-PR-URL: #37009
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>

richardlau pushed a commit that referenced this pull request

This test fails prior to 990feaf being cherry-picked
due to stream.pipeline with a crypto.Hash not working properly.

That bug also seems to have affected md5.

PR-URL: #37009
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>