File openssl-CVE-2023-0215-4of4.patch of Package openssl-1_0_0.30169

commit 0cbc68d3107e2b54a64606a857e0044637b01255
Author: Matt Caswell <matt@openssl.org>
Date:   Tue Jan 31 11:54:18 2023 +0000

    fixup! Fix a UAF resulting from a bug in BIO_new_NDEF

---
 crypto/asn1/bio_ndef.c |   22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

--- a/crypto/asn1/bio_ndef.c
+++ b/crypto/asn1/bio_ndef.c
@@ -124,8 +124,10 @@ BIO *BIO_new_NDEF(BIO *out, ASN1_VALUE *
         goto err;
     pop_bio = asn_bio;
 
-    BIO_asn1_set_prefix(asn_bio, ndef_prefix, ndef_prefix_free);
-    BIO_asn1_set_suffix(asn_bio, ndef_suffix, ndef_suffix_free);
+    if (BIO_asn1_set_prefix(asn_bio, ndef_prefix, ndef_prefix_free) <= 0
+            || BIO_asn1_set_suffix(asn_bio, ndef_suffix, ndef_suffix_free) <= 0
+            || BIO_ctrl(asn_bio, BIO_C_SET_EX_ARG, 0, ndef_aux) <= 0)
+        goto err;
 
     /*
      * Now let the callback prepend any digest, cipher, etc., that the BIO's
@@ -140,8 +142,19 @@ BIO *BIO_new_NDEF(BIO *out, ASN1_VALUE *
      * The asn1_cb(), must not have mutated asn_bio on error, leaving it in the
      * middle of some partially built, but not returned BIO chain.
      */
-    if (aux->asn1_cb(ASN1_OP_STREAM_PRE, &val, it, &sarg) <= 0)
+    if (aux->asn1_cb(ASN1_OP_STREAM_PRE, &val, it, &sarg) <= 0) {
+        /*
+         * ndef_aux is now owned by asn_bio so we must not free it in the err
+         * clean up block
+         */
+        ndef_aux = NULL;
         goto err;
+    }
+
+    /*
+     * We must not fail now because the callback has prepended additional
+     * BIOs to the chain
+     */
 
     ndef_aux->val = val;
     ndef_aux->it = it;
@@ -150,9 +163,6 @@ BIO *BIO_new_NDEF(BIO *out, ASN1_VALUE *
     ndef_aux->out = out;
     ndef_aux->derbuf = NULL;
 
-    if (BIO_ctrl(asn_bio, BIO_C_SET_EX_ARG, 0, ndef_aux) <= 0)
-        goto err;
-
     return sarg.ndef_bio;
 
  err: