[asterisk-commits] res rtp asterisk: Don't leak temporary key when enabling PFS. (asterisk[master])

[SVN commits to the Asterisk project]

Mark Michelson has submitted this change and it was merged.

Change subject: res_rtp_asterisk: Don't leak temporary key when enabling PFS.
......................................................................


res_rtp_asterisk: Don't leak temporary key when enabling PFS.

A change recently went in which enabled perfect forward secrecy for
DTLS in res_rtp_asterisk. This was accomplished two different ways
depending on the availability of a feature in OpenSSL. The fallback
method created a temporary instance of a key but did not free it.
This change fixes that.

ASTERISK-25265

Change-Id: Iadc031b67a91410bbefb17ffb4218d615d051396
---
M res/res_rtp_asterisk.c
1 file changed, 8 insertions(+), 2 deletions(-)

Approvals:
  Mark Michelson: Looks good to me, approved
  Richard Mudgett: Looks good to me, but someone else must approve
  Anonymous Coward #1000019: Verified



diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index 7e507c9..5f21c14 100644
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -1268,6 +1268,9 @@
 {
 	struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
 	int res;
+#ifndef HAVE_OPENSSL_ECDH_AUTO
+	EC_KEY *ecdh;
+#endif
 
 	if (!dtls_cfg->enabled) {
 		return 0;
@@ -1291,8 +1294,11 @@
 #ifdef HAVE_OPENSSL_ECDH_AUTO
 	SSL_CTX_set_ecdh_auto(rtp->ssl_ctx, 1);
 #else
-	SSL_CTX_set_tmp_ecdh(rtp->ssl_ctx,
-		EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
+	ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+	if (ecdh) {
+		SSL_CTX_set_tmp_ecdh(rtp->ssl_ctx, ecdh);
+		EC_KEY_free(ecdh);
+	}
 #endif
 
 	rtp->dtls_verify = dtls_cfg->verify;

-- 
To view, visit https://gerrit.asterisk.org/1037
To unsubscribe, visit https://gerrit.asterisk.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: Iadc031b67a91410bbefb17ffb4218d615d051396
Gerrit-PatchSet: 2
Gerrit-Project: asterisk
Gerrit-Branch: master
Gerrit-Owner: Joshua Colp <jcolp at digium.com>
Gerrit-Reviewer: Anonymous Coward #1000019
Gerrit-Reviewer: Mark Michelson <mmichelson at digium.com>
Gerrit-Reviewer: Richard Mudgett <rmudgett at digium.com>