{"action":"created","issue":{"url":"https://api.github.com/repos/bagder/curl/issues/509","labels_url":"https://api.github.com/repos/bagder/curl/issues/509/labels{/name}","comments_url":"https://api.github.com/repos/bagder/curl/issues/509/comments","events_url":"https://api.github.com/repos/bagder/curl/issues/509/events","html_url":"https://github.com/bagder/curl/issues/509","id":113567980,"number":509,"title":"Dangling pointer to private key causes crash at Curl_ossl_close()","user":{"login":"nased0","id":13164219,"avatar_url":"https://avatars.githubusercontent.com/u/13164219?v=3","gravatar_id":"","url":"https://api.github.com/users/nased0","html_url":"https://github.com/nased0","followers_url":"https://api.github.com/users/nased0/followers","following_url":"https://api.github.com/users/nased0/following{/other_user}","gists_url":"https://api.github.com/users/nased0/gists{/gist_id}","starred_url":"https://api.github.com/users/nased0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nased0/subscriptions","organizations_url":"https://api.github.com/users/nased0/orgs","repos_url":"https://api.github.com/users/nased0/repos","events_url":"https://api.github.com/users/nased0/events{/privacy}","received_events_url":"https://api.github.com/users/nased0/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/bagder/curl/labels/SSL/TLS","name":"SSL/TLS","color":"bfdadc"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":19,"created_at":"2015-10-27T12:05:56Z","updated_at":"2015-10-27T16:56:52Z","closed_at":"2015-10-27T12:47:17Z","body":"I use the engine_pkcs11.dll and enigmap11.dll module for communication with the Encard pkcs11 card to download data from the protected polish government server. \r\nUnfortunately the libcurl library v. 7.45.0  (and curl.exe) crashes every time at Curl_ossl_close function (on Windows 7), because of the wrong reference count in the private key, which causes freeing memory too early, resulting in dangling pointer in connssl->ctx->cert->pkeys->privatekey, access to deallocated memory and crash (it does not crash on Windows XP, because of weaker memory protection).\r\nPrivate key is allocated in cert_stuff function, case SSL_FILETYPE_ENGINE: \r\nby ENGINE_load_private_key function, its pointer is then sent to OpenSSL by SSL_CTX_use_PrivateKey function and then erroneously called EVP_PKEY_free (which decreases reference count) despite SSL_CTX_use_PrivateKey success. After commenting line 595 in openssl.c file libcurl works correctly.\r\n```\r\n--- openssl.c   2015-10-05 00:43:48.000000000 +0200\r\n+++ my/openssl.c        2015-10-27 12:10:46.066604700 +0100\r\n@@ -592,7 +592,6 @@ int cert_stuff(struct connectdata *conn,\r\n             EVP_PKEY_free(priv_key);\r\n             return 0;\r\n           }\r\n-          EVP_PKEY_free(priv_key);  /* we don't need the handle any more... */\r\n         }\r\n         else {\r\n           failf(data, \"crypto engine not set, can't load private key\");\r\n\r\n```"},"comment":{"url":"https://api.github.com/repos/bagder/curl/issues/comments/151568217","html_url":"https://github.com/bagder/curl/issues/509#issuecomment-151568217","issue_url":"https://api.github.com/repos/bagder/curl/issues/509","id":151568217,"user":{"login":"nased0","id":13164219,"avatar_url":"https://avatars.githubusercontent.com/u/13164219?v=3","gravatar_id":"","url":"https://api.github.com/users/nased0","html_url":"https://github.com/nased0","followers_url":"https://api.github.com/users/nased0/followers","following_url":"https://api.github.com/users/nased0/following{/other_user}","gists_url":"https://api.github.com/users/nased0/gists{/gist_id}","starred_url":"https://api.github.com/users/nased0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nased0/subscriptions","organizations_url":"https://api.github.com/users/nased0/orgs","repos_url":"https://api.github.com/users/nased0/repos","events_url":"https://api.github.com/users/nased0/events{/privacy}","received_events_url":"https://api.github.com/users/nased0/received_events","type":"User","site_admin":false},"created_at":"2015-10-27T16:56:52Z","updated_at":"2015-10-27T16:56:52Z","body":"'''\r\nYes, but it's only a wrapper around the load_privkey() engine callback, which is what actually allocates the EVP_PKEY:\r\n'''\r\n@ghedo So one module (engine_pkcs11.dll) allocates private key on its private heap, and another module (libcurl.dll) attempts to deallocate this private key from the private heap of another module!\r\nThis may be the true cause of this crash on Windows 7 and the reason why it works on Windows XP (and presumably also in Linux) - stricter heap protection.\r\nSo according to this hypothesis this patch causes memory leak in engine_pkcs11.dll module, libcurl.dll does not crash because it doesn't deallocate the private key at all. To correctly free it you may need private key deallocating callback to the engine module from the OpenSSL.\r\n\r\n@bagder Sorry, but my patch does not solve this problem correctly, only replaces it by memory leak.\r\nI couldn't detect it using VS2012, because it is in engine_pkcs11.dll module. So please revert it for now."}}