Fix use-after-free of error strings on BoringSSL/aws-lc#2572
Fix use-after-free of error strings on BoringSSL/aws-lc#2572alex merged 1 commit intorust-openssl:masterfrom
Conversation
The boringssl/awslc cfg gate unconditionally used Cow::Borrowed for error data, treating it as 'static. However, BoringSSL and aws-lc dynamically allocate error strings and may free them on the next error queue operation. Both libraries set ERR_TXT_MALLOCED as a workaround to signal that the string should be copied, but the cfg gate bypassed that check entirely. Remove the cfg gates and use the same ERR_TXT_MALLOCED check for all backends. Fixes rust-openssl#2470 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
a0d751e to
cc08b77
Compare
|
I am really confused about the evolution of this problem. The cfg and code this PR removes was added for BoringSSL support in It kind of feels like rust-openssl and boringssl/aws-lc are adding workarounds on top of workarounds for workarounds. |
|
Yeah, the chronology confuses me. I like this PR bcause it just deletes special cases :-) |
botovq
left a comment
There was a problem hiding this comment.
Be all that as it may, this seems correct to me.
The boringssl/awslc cfg gate unconditionally used Cow::Borrowed for error data, treating it as 'static. However, BoringSSL and aws-lc dynamically allocate error strings and may free them on the next error queue operation. Both libraries set ERR_TXT_MALLOCED as a workaround to signal that the string should be copied, but the cfg gate bypassed that check entirely.
Remove the cfg gates and use the same ERR_TXT_MALLOCED check for all backends.
Fixes #2470