[tor-bugs] #19152 [Core Tor/Tor]: use-after-free on failing RSA_generate_key_ex()

[Tor Bug Tracker & Wiki]

#19152: use-after-free on failing RSA_generate_key_ex()
------------------------------+--------------------------------
     Reporter:  nickm         |      Owner:  nickm
         Type:  defect        |     Status:  new
     Priority:  Medium        |  Milestone:  Tor: 0.2.8.x-final
    Component:  Core Tor/Tor  |    Version:
     Severity:  Normal        |   Keywords:  027-backport
Actual Points:                |  Parent ID:
       Points:                |   Reviewer:
      Sponsor:                |
------------------------------+--------------------------------
 Reported by Yuan Kang.

 When we generate a key, if openssl fails to generate an RSA key, we
 currently retain a dangling pointer to the previous (uninitialized) key
 value. The impact here should be limited to a difficult-to-trigger crash,
 if OpenSSL is running an engine that makes key generation failures
 possible, or if OpenSSL runs out of memory.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19152>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online