Question

(Sorry this is verbose) I am experimenting with adding OpenSSL support to a Cocoa application written in Objective C for OS X 10.6 (Snow Leopard). To simplify matters, I have a small wrapper class which holds the various BIO and cipher context structures, AETOpenSSLWrapper. It looks like the following

.h

@interface AETOpenSSLWrapper: public NSObject
{
   BIO *writeBIO,encBIO;
   EVP_CIPHER_CTX *ctx;
   unsigned char *readWriteBuff;
}

@property (readwrite,assign) BIO *writeBIO,*encBIO;
@property (readwrite,assign) EVP_CIPHER_CTX *ctx;
@property (readwrite,assign) unsigned char *readWriteBuff;

-(id)init;
...
-(void)dealloc;
@end

.m

@implementation AETOpenSSLWrapper

@synthesize writeBIO,encBIO,ctx,readWriteBuff;

-(id)init
{
   self=[super init];
   if(self)
      {
      writeBIO=BIO_new(BIO_s_file());
      encBIO=...
      ctx=...
      buff=...
      (error handling omitted)
      }

   return self;
}
@end

Then various utility methods to chain BIOs, write to the output BIO, flush etc, in particular, one -(void)pushEncryptingBIO to chain the enciphering filter BIO (which has been initialised with key, salt and initial vector)

-(void)pushEncryptingBIO
{
   writeBIO=BIO_push(encBIO,writeBIO);
}

Finally there is my dealloc routine. This is lifted directly from the enc program supplied with the openssl-1.0.1c distribution

-(void)dealloc
{
   if(readWriteBuff!=NULL)
      OPENSSL_free(readWriteBuff);
   if(writeBIO!=NULL)
      BIO_free_all(writeBIO);
   if(encBIO!=NULL) <----------- this looks wrong
      BIO_free(encBIO); <---+

   [super dealloc];
}

The equivalent code is prior to the loop that encrypts the input buffer and at the end of the MAIN() routine in apps/enc.c in the openssl source tree:

lines 657 – 658

if (benc != NULL)
   wbio=BIO_push(benc,wbio);

and lines 682 – 688

end:
   ERR_print_errors(bio_err);
   if (strbuf != NULL) OPENSSL_free(strbuf);
   if (buff != NULL) OPENSSL_free(buff);
   if (in != NULL) BIO_free(in);
   if (out != NULL) BIO_free_all(out);
   if (benc != NULL) BIO_free(benc); <--- are we sure about this?

The question is (finally): should that call to BIO_free(benc) (or BIO_free(encBIO) in my code) be there since the BIO is pushed onto the writeBIO/out chain, which is freed with BIO_free_all? Looking at the implementation of BIO_free_all, it just runs down the BIO chain, decrementing ref counts and freeing as it goes and does not NULL out the pointers. This looks like it must be a bug, but obviously I am reluctant to assume the SSL maintainers have missed this and I haven’t. I get occasional crashes (1 in 10) if I leave the BIO_free(encBIO) call in and not if I don’t, but I don’t want a leak. This is in an Apple Event Handler, so debugging is complicated further. Any suggestions?

Answer 1

I’ve had the opportunity to work with BIOs some time ago and I think you are correct. From OpenSSL man pages:

BIO_free_all() frees up an entire BIO chain, it does not halt if an error occurs freeing up an individual BIO in the chain.

Also, since OpenSSL cleanup functions take a pointer to the structure, they can’t change the value of the pointer (i.e it would require the address of the pointer to do so). Even if OpenSSL set the pointer parameter to NULL, only the copy would be NULL, turning out to be an useless behavior. Thus it’s up to you to set it to NULL.

To give you a concrete example, the following C++ code is used to encrypt a plain text using PKCS#5 standard. It receives a password as parameter, which will be used to derive an AES key. The following code does not leak (checked with valgrind).

static int ENCRYPTION_FAILED = 1;
static const EVP_MD *MD = EVP_sha256();
static const EVP_CIPHER *CIPHER = EVP_aes_256_cbc();

static int base64Encrypt(const string& toEncrypt, const string& password, string& base64Encrypted)
{
    static const char magic[]="Salted__";
    int ret = 0;
    EVP_CIPHER_CTX *ctx = NULL;
    BUF_MEM *bptr = NULL;
    unsigned char key[EVP_MAX_KEY_LENGTH], iv[EVP_MAX_IV_LENGTH];
    unsigned char salt[PKCS5_SALT_LEN];
    char *encrypted = NULL;
    /* Allow enough space in output buffer for additional block */
    BIO *bMem = NULL;
    BIO *b64 = NULL;
    BIO *benc = NULL;

    // setting bio context
    if ( (bMem = BIO_new(BIO_s_mem())) == NULL ){
        ret = ENCRYPTION_FAILED; goto err0;
    }
    if ( (b64 = BIO_new(BIO_f_base64())) == NULL ){
        ret = ENCRYPTION_FAILED; goto err0;
    }
    BIO_push(b64,bMem);

    // Generating salt
    if (RAND_pseudo_bytes(salt, sizeof(salt) ) < 0){
        ret = ENCRYPTION_FAILED; goto err0;
    }

    if ((password.size() == 0) && EVP_CIPHER_iv_length(CIPHER) != 0) {
        ret = ENCRYPTION_FAILED; goto err0; 
    }

    // writing salt to bio, base 64 encoded
    if (BIO_write(b64, magic, sizeof magic-1) != sizeof magic-1 || BIO_write(b64, (char *)salt, sizeof salt) != sizeof salt) {
        ret = ENCRYPTION_FAILED; goto err0;
    }   

    // deriving key
    if (!EVP_BytesToKey(CIPHER, MD, salt, (unsigned char *)password.c_str(), password.size(), PKCS5_DEFAULT_ITER, key, iv)){
        ret = ENCRYPTION_FAILED; goto err0;
    }

    if ( (benc=BIO_new(BIO_f_cipher())) == NULL ){
        ret = ENCRYPTION_FAILED; goto err0;
    }
    BIO_get_cipher_ctx(benc, &ctx);

    if (!EVP_CipherInit_ex(ctx, CIPHER, NULL, NULL, NULL, 1)){
        ret = ENCRYPTION_FAILED; goto err0;
    }

    if (!EVP_CipherInit_ex(ctx, NULL, NULL, key, iv, 1)){
        ret = ENCRYPTION_FAILED; goto err0;
    }
    BIO_push(benc, b64);

        // writing to mem bio
    if (BIO_write(benc, (char *)toEncrypt.c_str(), toEncrypt.size()) != (int)toEncrypt.size()){
        ret = ENCRYPTION_FAILED; goto err0;
    }   

    if (!BIO_flush(benc)){

        ret = ENCRYPTION_FAILED; goto err0;
    }

    BIO_get_mem_ptr(benc, &bptr);
    if (bptr->length <= 0){
        ret = ENCRYPTION_FAILED; goto err0;
    }
    encrypted = new char[bptr->length + 1];
    memcpy(encrypted, bptr->data, bptr->length);
    encrypted[bptr->length] = '\0';
    base64Encrypted = encrypted;
    delete[] encrypted;

    if (benc != NULL) BIO_free_all(benc);
    return 0;

    err0:
    if (benc != NULL) BIO_free_all(benc);
    return ret;
}

As you can see, I’ve chained three BIOs, and the single call to BIO_free_all(benc) cleans up all BIOs.

Regards.