Inadeqate input validation and a reference leak in crypto.{load, dump}_privatekey

Bug #499628 reported by Ziga Seilnacht
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
pyOpenSSL
Fix Committed
Undecided
Unassigned

Bug Description

crpto.load_privatekey and crypto.dump_privatekey have a few bugs in uncommonly used paths:
 - they don't raise an error if a passphrase is specified with a serialization format that doesn't support encryption
 - they truncate long passphrases supplied via callback
 - they either overwrite the error raised by the passphrase (load_privatekey) callback or forget to cleanup OpenSSL's error stack in that case (dump_privatekey)
 - they forget to decref the passphrase returned by the callback
 - they are missing a few NULL checks

I'll submit a branch with the fixes.

Related branches

Revision history for this message
Jean-Paul Calderone (exarkun) wrote :

Thanks. Fixed in r161.

Changed in pyopenssl:
status: New → Fix Committed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.