From 1149b07ac54deb655346379e319d353d63d28f60 Mon Sep 17 00:00:00 2001 From: Emma Stensland Date: Mon, 13 Jul 2026 12:16:05 -0600 Subject: [PATCH] F-1293 F-1700 F-1709 F-1710 F-2095 F-2096 F-2098 F-2102 F-2103 F-2896 F-3226 F-4128 F-4129 F-4602: fix socket, buffer, and object leaks in BLE, custom-io, can-bus, certfields, and TLS examples --- btle/ecies/ecc-client.c | 9 +++++ btle/ecies/ecc-server.c | 9 +++++ can-bus/client.c | 5 +-- can-bus/common.c | 35 +++++++++++------- can-bus/common.h | 5 +-- can-bus/server.c | 5 +-- .../extract-pubkey-from-certfile/main.c | 20 ++++++++--- custom-io-callbacks/file-client/file-client.c | 23 ++++++------ custom-io-callbacks/file-server/file-server.c | 36 ++++++++++++------- tls/client-tls-resume.c | 2 ++ tls/server-tls-epoll-perf.c | 1 + tls/server-tls-epoll-threaded.c | 1 + tls/server-tls-poll-perf.c | 1 + tls/server-tls-threaded.c | 3 ++ 14 files changed, 109 insertions(+), 46 deletions(-) diff --git a/btle/ecies/ecc-client.c b/btle/ecies/ecc-client.c index c1cde09a..adce0948 100644 --- a/btle/ecies/ecc-client.c +++ b/btle/ecies/ecc-client.c @@ -43,6 +43,7 @@ int main(int argc, char** argv) word32 plainSz; ecc_key myKey, peerKey; int type; + int initRng = 0; wolfCrypt_Init(); @@ -70,6 +71,7 @@ int main(int argc, char** argv) printf("wc_InitRng failed! %d\n", ret); goto cleanup; } + initRng = 1; ret = wc_ecc_make_key(&rng, 32, &myKey); if (ret != 0) { @@ -216,6 +218,13 @@ int main(int argc, char** argv) cleanup: + wc_ecc_free(&myKey); + wc_ecc_free(&peerKey); + if (cliCtx != NULL) + wc_ecc_ctx_free(cliCtx); + if (initRng) + wc_FreeRng(&rng); + if (devCtx != NULL) btle_close(devCtx); diff --git a/btle/ecies/ecc-server.c b/btle/ecies/ecc-server.c index 54110b79..2c6025df 100644 --- a/btle/ecies/ecc-server.c +++ b/btle/ecies/ecc-server.c @@ -43,6 +43,7 @@ int main(int argc, char** argv) word32 plainSz; ecc_key myKey, peerKey; int type; + int initRng = 0; wolfCrypt_Init(); @@ -71,6 +72,7 @@ int main(int argc, char** argv) printf("wc_InitRng failed! %d\n", ret); goto cleanup; } + initRng = 1; ret = wc_ecc_make_key(&rng, 32, &myKey); if (ret != 0) { @@ -206,6 +208,13 @@ int main(int argc, char** argv) cleanup: + wc_ecc_free(&myKey); + wc_ecc_free(&peerKey); + if (srvCtx != NULL) + wc_ecc_ctx_free(srvCtx); + if (initRng) + wc_FreeRng(&rng); + if (devCtx != NULL) btle_close(devCtx); diff --git a/can-bus/client.c b/can-bus/client.c index 5f729189..46a21894 100644 --- a/can-bus/client.c +++ b/can-bus/client.c @@ -28,6 +28,7 @@ int main(int argc, char *argv[]) WOLFSSL_CTX *ctx = NULL; WOLFSSL_METHOD* method = NULL; WOLFSSL* ssl = NULL; + char *receive_buffer = NULL; int ret; if (argc != 2) { @@ -40,7 +41,7 @@ int main(int argc, char *argv[]) return ret; } - ret = setup_ssl(SERVICE_TYPE_CLIENT, &ctx, &method, &ssl); + ret = setup_ssl(SERVICE_TYPE_CLIENT, &ctx, &method, &ssl, &receive_buffer); if (ret) { return ret; } @@ -58,7 +59,7 @@ int main(int argc, char *argv[]) free(line); } - close_ssl(ctx, ssl); + close_ssl(ctx, ssl, receive_buffer); return 0; } diff --git a/can-bus/common.c b/can-bus/common.c index 1b89e257..9b5f1678 100644 --- a/can-bus/common.c +++ b/can-bus/common.c @@ -103,7 +103,8 @@ int can_connect(const char *address, uint16_t filter) /* Set the filter */ setsockopt(sock, SOL_CAN_RAW, CAN_RAW_FILTER, &rfilter, sizeof(rfilter)); - strcpy(ifr.ifr_name, address); + strncpy(ifr.ifr_name, address, IFNAMSIZ - 1); + ifr.ifr_name[IFNAMSIZ - 1] = '\0'; ioctl(sock, SIOCGIFINDEX, &ifr); memset(&addr, 0, sizeof(addr)); @@ -111,6 +112,7 @@ int can_connect(const char *address, uint16_t filter) addr.can_ifindex = ifr.ifr_ifindex; if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("Bind error\n"); + close(sock); return -1; } @@ -122,7 +124,7 @@ void can_close() close(can_con_info.sock); } -void close_ssl(WOLFSSL_CTX *ctx, WOLFSSL *ssl) +void close_ssl(WOLFSSL_CTX *ctx, WOLFSSL *ssl, char *receive_buffer) { if (ssl) { int ret = WOLFSSL_SHUTDOWN_NOT_DONE; @@ -134,11 +136,12 @@ void close_ssl(WOLFSSL_CTX *ctx, WOLFSSL *ssl) int err = wolfSSL_get_error(ssl, ret); fprintf(stderr, "Error shutting down TLS connection: %d, %s", err, wolfSSL_ERR_error_string(err, buffer)); - return; } } can_close(); + free(receive_buffer); + wolfSSL_free(ssl); wolfSSL_CTX_free(ctx); wolfSSL_Cleanup(); @@ -170,13 +173,19 @@ int setup_connection(const char *interface, int local_id, int remote_id) } int setup_ssl(enum service_type type, WOLFSSL_CTX **new_ctx, - WOLFSSL_METHOD **new_method, WOLFSSL **new_ssl) + WOLFSSL_METHOD **new_method, WOLFSSL **new_ssl, + char **new_receive_buffer) { int ret; WOLFSSL_CTX *ctx = NULL; WOLFSSL_METHOD* method = NULL; WOLFSSL* ssl = NULL; char *receive_buffer = malloc(ISOTP_DEFAULT_BUFFER_SIZE); + if (receive_buffer == NULL) { + fprintf(stderr, "Could not allocate receive buffer\n"); + close_ssl(NULL, NULL, NULL); + return -1; + } if (type == SERVICE_TYPE_CLIENT) { method = wolfTLSv1_3_client_method(); @@ -186,21 +195,22 @@ int setup_ssl(enum service_type type, WOLFSSL_CTX **new_ctx, if (!method) { fprintf(stderr, "Could not init wolfSSL method\n"); + close_ssl(NULL, NULL, receive_buffer); return -1; } ctx = wolfSSL_CTX_new(method); if (!ctx) { fprintf(stderr, "Could not init wolfSSL context\n"); - close_ssl(NULL, NULL); + close_ssl(NULL, NULL, receive_buffer); return -1; } - wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL); - if (type == SERVICE_TYPE_CLIENT) { - ret = wolfSSL_CTX_load_verify_locations(ctx, "client.pem", NULL); + wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL); + ret = wolfSSL_CTX_load_verify_locations(ctx, "ca.crt", NULL); } else { + wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL); ret = wolfSSL_CTX_use_certificate_file(ctx, "server.pem", WOLFSSL_FILETYPE_PEM); } @@ -208,7 +218,7 @@ int setup_ssl(enum service_type type, WOLFSSL_CTX **new_ctx, if (ret != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load cert, " "please check the file.\n"); - close_ssl(ctx, NULL); + close_ssl(ctx, NULL, receive_buffer); return -1; } @@ -217,7 +227,7 @@ int setup_ssl(enum service_type type, WOLFSSL_CTX **new_ctx, WOLFSSL_FILETYPE_PEM)) != WOLFSSL_SUCCESS) { fprintf(stderr, "ERROR: failed to load key file, " "please check the file.\n"); - close_ssl(ctx, NULL); + close_ssl(ctx, NULL, receive_buffer); return -1; } } @@ -225,7 +235,7 @@ int setup_ssl(enum service_type type, WOLFSSL_CTX **new_ctx, ssl = wolfSSL_new(ctx); if (!ssl) { fprintf(stderr, "Could not init wolfSSL\n"); - close_ssl(ctx, NULL); + close_ssl(ctx, NULL, receive_buffer); return -1; } @@ -245,12 +255,13 @@ int setup_ssl(enum service_type type, WOLFSSL_CTX **new_ctx, int err = wolfSSL_get_error(ssl, ret); fprintf(stderr, "ERROR: failed to connect using wolfSSL: %d, %s\n", err, wolfSSL_ERR_error_string(err, buffer)); - close_ssl(ctx, ssl); + close_ssl(ctx, ssl, receive_buffer); return -1; } *new_ctx = ctx; *new_method = method; *new_ssl = ssl; + *new_receive_buffer = receive_buffer; printf("SSL handshake done!\n"); diff --git a/can-bus/common.h b/can-bus/common.h index 314c785f..8c181245 100644 --- a/can-bus/common.h +++ b/can-bus/common.h @@ -57,8 +57,9 @@ int can_send(struct isotp_can_data *data, void *arg); int can_connect(const char *address, uint16_t filter); void can_close(void); -void close_ssl(WOLFSSL_CTX *ctx, WOLFSSL *ssl); +void close_ssl(WOLFSSL_CTX *ctx, WOLFSSL *ssl, char *receive_buffer); int setup_connection(const char *interface, int local_id, int remote_id); int setup_ssl(enum service_type type, WOLFSSL_CTX **new_ctx, - WOLFSSL_METHOD **new_method, WOLFSSL **new_ssl); + WOLFSSL_METHOD **new_method, WOLFSSL **new_ssl, + char **new_receive_buffer); #endif /* __CANCOMMON_H__ */ diff --git a/can-bus/server.c b/can-bus/server.c index 5ddb7bfe..f63967ec 100644 --- a/can-bus/server.c +++ b/can-bus/server.c @@ -30,6 +30,7 @@ int main(int argc, char *argv[]) WOLFSSL_CTX *ctx = NULL; WOLFSSL_METHOD* method = NULL; WOLFSSL* ssl = NULL; + char *receive_buffer = NULL; int ret; if (argc != 2) { @@ -42,7 +43,7 @@ int main(int argc, char *argv[]) return ret; } - ret = setup_ssl(SERVICE_TYPE_SERVER, &ctx, &method, &ssl); + ret = setup_ssl(SERVICE_TYPE_SERVER, &ctx, &method, &ssl, &receive_buffer); if (ret) { return ret; } @@ -58,7 +59,7 @@ int main(int argc, char *argv[]) } } - close_ssl(ctx, ssl); + close_ssl(ctx, ssl, receive_buffer); return 0; } diff --git a/certfields/extract-pubkey-from-certfile/main.c b/certfields/extract-pubkey-from-certfile/main.c index 9ca2c74a..b930aa2b 100644 --- a/certfields/extract-pubkey-from-certfile/main.c +++ b/certfields/extract-pubkey-from-certfile/main.c @@ -36,8 +36,8 @@ int main(void) { int ret = -1; #ifdef OPENSSL_EXTRA - WOLFSSL_X509* x509cert; - WOLFSSL_EVP_PKEY* pubKeyTmp; + WOLFSSL_X509* x509cert = NULL; + WOLFSSL_EVP_PKEY* pubKeyTmp = NULL; RsaKey pubKey; char* certFName = "../../certs/client-cert.pem"; word32 idx = 0; @@ -55,16 +55,27 @@ int main(void) pubKeyTmp = wolfSSL_X509_get_pubkey(x509cert); if (pubKeyTmp == NULL) { printf("Failed to extract public key, abort!\n"); + wolfSSL_X509_free(x509cert); return ret; } printf("Extracted public key successfully\n"); /* setup a key structure to receive the extracted key */ - wc_InitRsaKey(&pubKey, 0); + ret = wc_InitRsaKey(&pubKey, 0); + if (ret != 0) { + printf("Failed to init RSA key, abort!\n"); + wolfSSL_EVP_PKEY_free(pubKeyTmp); + wolfSSL_X509_free(x509cert); + return ret; + } + ret = wc_RsaPublicKeyDecode((byte*)pubKeyTmp->pkey.ptr, &idx, &pubKey, (word32) pubKeyTmp->pkey_sz); if (ret != 0) { printf("Failed to decode public key from pubKeyTmp, abort!\n"); + wc_FreeRsaKey(&pubKey); + wolfSSL_EVP_PKEY_free(pubKeyTmp); + wolfSSL_X509_free(x509cert); return ret; } printf("Successfully decoded public key\n"); @@ -74,10 +85,9 @@ int main(void) printf("%02X", pubKeyTmp->pkey.ptr[i] & 0xFF); } printf("\n"); - + wc_FreeRsaKey(&pubKey); wolfSSL_EVP_PKEY_free(pubKeyTmp); wolfSSL_X509_free(x509cert); - wc_FreeRsaKey(&pubKey); #else printf("Please configure wolfssl with --enable-opensslextra to try using\n" "this example\n"); diff --git a/custom-io-callbacks/file-client/file-client.c b/custom-io-callbacks/file-client/file-client.c index a61b5a7c..82e19dde 100644 --- a/custom-io-callbacks/file-client/file-client.c +++ b/custom-io-callbacks/file-client/file-client.c @@ -57,7 +57,7 @@ unsigned int my_psk_client_cb(WOLFSSL* ssl, const char* hint, int CbIOSend(WOLFSSL *ssl, char *buf, int sz, void *ctx); int CbIORecv(WOLFSSL *ssl, char *buf, int sz, void *ctx); -WOLFSSL* Client(WOLFSSL_CTX* ctx, char* suite, int setSuite, int doVerify); +WOLFSSL* Client(WOLFSSL_CTX** ctx_ptr, char* suite, int setSuite, int doVerify); WOLFSSL_METHOD* SetMethodClient(int i); @@ -118,8 +118,9 @@ int CbIOSend(WOLFSSL *ssl, char *buf, int sz, void *ctx) return ret; } -WOLFSSL* Client(WOLFSSL_CTX* ctx, char* suite, int setSuite, int doVerify) +WOLFSSL* Client(WOLFSSL_CTX** ctx_ptr, char* suite, int setSuite, int doVerify) { + WOLFSSL_CTX* ctx; WOLFSSL* ssl = NULL; int ret; @@ -132,6 +133,7 @@ WOLFSSL* Client(WOLFSSL_CTX* ctx, char* suite, int setSuite, int doVerify) if ((wolfSSL_CTX_load_verify_locations(ctx, peerAuthority, 0)) != SSL_SUCCESS) { printf("Failed to load CA (peer Authority) file\n"); + wolfSSL_CTX_free(ctx); return NULL; } } else { @@ -160,6 +162,7 @@ WOLFSSL* Client(WOLFSSL_CTX* ctx, char* suite, int setSuite, int doVerify) wolfSSL_set_fd(ssl, fpRecv); + if (ctx_ptr) *ctx_ptr = ctx; return ssl; } @@ -184,9 +187,7 @@ int main(int argc, char** argv) wolfSSL_Init(); - /* Example usage */ -// sslServ = Server(ctxServ, "ECDHE-RSA-AES128-SHA", 1); - sslCli = Client(ctxCli, "let-wolfssl-decide", 0, 1); + sslCli = Client(&ctxCli, "let-wolfssl-decide", 0, 1); if (sslCli == NULL) { printf("Failed to start client\n"); @@ -205,8 +206,6 @@ int main(int argc, char** argv) if (ret != SSL_SUCCESS) { if (error != SSL_ERROR_WANT_READ && error != SSL_ERROR_WANT_WRITE) { - wolfSSL_free(sslCli); - wolfSSL_CTX_free(ctxCli); printf("client ssl connect failed\n"); goto cleanup; } @@ -250,9 +249,13 @@ int main(int argc, char** argv) cleanup: - wolfSSL_shutdown(sslCli); - wolfSSL_free(sslCli); - wolfSSL_CTX_free(ctxCli); + if (sslCli) { + wolfSSL_shutdown(sslCli); + wolfSSL_free(sslCli); + } + if (ctxCli) { + wolfSSL_CTX_free(ctxCli); + } wolfSSL_Cleanup(); /* close the streams so client can reset file contents */ close(fpSend); diff --git a/custom-io-callbacks/file-server/file-server.c b/custom-io-callbacks/file-server/file-server.c index aad2f3bf..d9f8f8d9 100644 --- a/custom-io-callbacks/file-server/file-server.c +++ b/custom-io-callbacks/file-server/file-server.c @@ -57,7 +57,7 @@ unsigned int my_psk_server_cb(WOLFSSL* ssl, const char* identity, int CbIOSend(WOLFSSL *ssl, char *buf, int sz, void *ctx); int CbIORecv(WOLFSSL *ssl, char *buf, int sz, void *ctx); int ConvertHexToBin(const char* h1, byte* b1, word32* b1Sz); -WOLFSSL* Server(WOLFSSL_CTX* ctx, char* suite, int setSuite); +WOLFSSL* Server(WOLFSSL_CTX** ctx_ptr, char* suite, int setSuite); static int fpSend; static int fpRecv; @@ -102,8 +102,9 @@ int CbIOSend(WOLFSSL *ssl, char *buf, int sz, void *ctx) } -WOLFSSL* Server(WOLFSSL_CTX* ctx, char* suite, int setSuite) +WOLFSSL* Server(WOLFSSL_CTX** ctx_ptr, char* suite, int setSuite) { + WOLFSSL_CTX* ctx; WOLFSSL* ssl; int ret = -1; @@ -118,14 +119,16 @@ WOLFSSL* Server(WOLFSSL_CTX* ctx, char* suite, int setSuite) #endif if (wolfSSL_CTX_use_certificate_file(ctx, serverCert, SSL_FILETYPE_PEM) - != SSL_SUCCESS) { + != SSL_SUCCESS) { printf("trouble loading server cert file\n"); + wolfSSL_CTX_free(ctx); return NULL; } if (wolfSSL_CTX_use_PrivateKey_file(ctx, serverKey, SSL_FILETYPE_PEM) - != SSL_SUCCESS) { + != SSL_SUCCESS) { printf("trouble loading server key file\n"); + wolfSSL_CTX_free(ctx); return NULL; } @@ -150,6 +153,7 @@ WOLFSSL* Server(WOLFSSL_CTX* ctx, char* suite, int setSuite) } wolfSSL_set_fd(ssl, fpRecv); + if (ctx_ptr) *ctx_ptr = ctx; return ssl; } @@ -178,8 +182,8 @@ int main(int argc, char** argv) wolfSSL_Init(); /* Example usage */ -// sslServ = Server(ctxServ, "ECDHE-RSA-AES128-SHA", 1); - sslServ = Server(ctxServ, "let-wolfssl-choose", 0); +// sslServ = Server(&ctxServ, "ECDHE-RSA-AES128-SHA", 1); + sslServ = Server(&ctxServ, "let-wolfssl-choose", 0); if (sslServ == NULL) { printf("sslServ NULL\n"); return 0;} ret = SSL_FAILURE; @@ -191,8 +195,6 @@ int main(int argc, char** argv) if (ret != SSL_SUCCESS) { if (error != SSL_ERROR_WANT_READ && error != SSL_ERROR_WANT_WRITE) { - wolfSSL_free(sslServ); - wolfSSL_CTX_free(ctxServ); printf("server ssl accept failed ret = %d error = %d wr = %d\n", ret, error, SSL_ERROR_WANT_READ); goto cleanup; @@ -254,13 +256,21 @@ cleanup: close(open(CR, O_RDWR | O_NOCTTY | O_NDELAY)); close(open(SR, O_RDWR | O_NOCTTY | O_NDELAY)); - wolfSSL_shutdown(sslServ); - wolfSSL_free(sslServ); - wolfSSL_CTX_free(ctxServ); + if (sslServ) { + wolfSSL_shutdown(sslServ); + wolfSSL_free(sslServ); + } + if (ctxServ) { + wolfSSL_CTX_free(ctxServ); + } wolfSSL_Cleanup(); /* Reset the contents of the receive and send files for next run */ - fclose(fopen(SR, "wb")); - fclose(fopen(CR, "wb")); + { + FILE* f = fopen(SR, "wb"); + if (f != NULL) fclose(f); + f = fopen(CR, "wb"); + if (f != NULL) fclose(f); + } return -1; } diff --git a/tls/client-tls-resume.c b/tls/client-tls-resume.c index 4f1413de..81f866af 100644 --- a/tls/client-tls-resume.c +++ b/tls/client-tls-resume.c @@ -276,6 +276,8 @@ exit: /* Cleanup and return */ if (ssl) wolfSSL_free(ssl); /* Free the wolfSSL object */ + if (sslRes) + wolfSSL_free(sslRes); /* Free the resumed wolfSSL object */ if (session) wolfSSL_SESSION_free(session); if (sockfd != SOCKET_INVALID) diff --git a/tls/server-tls-epoll-perf.c b/tls/server-tls-epoll-perf.c index 6f98bbc0..ccae5059 100644 --- a/tls/server-tls-epoll-perf.c +++ b/tls/server-tls-epoll-perf.c @@ -475,6 +475,7 @@ static int SSLConn_Accept(SSLConn_CTX* ctx, WOLFSSL_CTX* sslCtx, /* Setup SSL/TLS connection. */ if ((conn->ssl = wolfSSL_new(sslCtx)) == NULL) { + close(conn->sockfd); free(conn); fprintf(stderr, "wolfSSL_new error.\n"); return EXIT_FAILURE; diff --git a/tls/server-tls-epoll-threaded.c b/tls/server-tls-epoll-threaded.c index 714471fc..945834e8 100644 --- a/tls/server-tls-epoll-threaded.c +++ b/tls/server-tls-epoll-threaded.c @@ -583,6 +583,7 @@ static int SSLConn_Accept(ThreadData* threadData, WOLFSSL_CTX* sslCtx, /* Setup SSL/TLS connection. */ if ((conn->ssl = wolfSSL_new(sslCtx)) == NULL) { + close(conn->sockfd); free(conn); fprintf(stderr, "wolfSSL_new error.\n"); return EXIT_FAILURE; diff --git a/tls/server-tls-poll-perf.c b/tls/server-tls-poll-perf.c index 3cd70237..9da6b913 100644 --- a/tls/server-tls-poll-perf.c +++ b/tls/server-tls-poll-perf.c @@ -471,6 +471,7 @@ static int SSLConn_Accept(SSLConn_CTX* ctx, WOLFSSL_CTX* sslCtx, /* Setup SSL/TLS connection. */ if ((conn->ssl = wolfSSL_new(sslCtx)) == NULL) { + close(conn->sockfd); free(conn); fprintf(stderr, "wolfSSL_new error.\n"); return EXIT_FAILURE; diff --git a/tls/server-tls-threaded.c b/tls/server-tls-threaded.c index 3a9df872..eebfd949 100644 --- a/tls/server-tls-threaded.c +++ b/tls/server-tls-threaded.c @@ -73,6 +73,7 @@ void* ClientHandler(void* args) /* Create a WOLFSSL object */ if ((ssl = wolfSSL_new(pkg->ctx)) == NULL) { fprintf(stderr, "ERROR: failed to create WOLFSSL object\n"); + close(pkg->connd); pkg->open = 1; pthread_exit(NULL); } @@ -90,6 +91,8 @@ void* ClientHandler(void* args) printf("ret = %d\n", ret); fprintf(stderr, "wolfSSL_accept error = %d\n", wolfSSL_get_error(ssl, ret)); + wolfSSL_free(ssl); + close(pkg->connd); pkg->open = 1; pthread_exit(NULL); }