crypto: Fix potential null pointer dereference when BIO_meth_new() fails #61788
+2
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
|
Review requested:
|
nodejs-github-bot
added
c++
addaleax
reviewed
Feb 12, 2026
| @@ -226,13 +226,15 @@ const BIO_METHOD* NodeBIO::GetMethod() { | |||
| // Static initialization ensures that this is safe to use concurrently. | |||
| static const BIO_METHOD* method = [&]() { | |||
| BIO_METHOD* method = BIO_meth_new(BIO_TYPE_MEM, "node.js SSL buffer"); | |||
Member
There was a problem hiding this comment.
Probably better to just CHECK_NOT_NULL(method); here, no?
Author
There was a problem hiding this comment.
Perhaps, some places seem to try to gracefully handle nulls, others don't, so I wasn't too sure. I'll change it.
jasnell
reviewed
Feb 12, 2026
This function can return null, which will make the calls to BIO_meth_set_* trigger a null deref. Even after fixing this, there is an issue with the `BIOPointer::New(GetMethod())` call in `NodeBIO::New` because the `New` method cannot handle a null pointer despite other code already guarding for this (e.g. the `NodeBIO::New` function already checks `bio`). This patch solves the issues by adding more null checks.
ndossche
added a commit
to ndossche/ncrypto
that referenced
this pull request
Feb 12, 2026
This function calls BIO_new() which mustn't receive a null pointer argument. Yet it is able to handle null BIOs gracefully. To solve this, add a null check. Ref: nodejs/node#61788
jasnell
approved these changes
Feb 12, 2026
ndossche
added a commit
to ndossche/ncrypto
that referenced
this pull request
Feb 12, 2026
This function calls BIO_new() which mustn't receive a null pointer argument. Yet it is able to handle null BIOs gracefully. To solve this, add a null check. Ref: nodejs/node#61788
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #61788 +/- ##
==========================================
- Coverage 89.76% 89.73% -0.03%
==========================================
Files 675 675
Lines 204674 204675 +1
Branches 39330 39340 +10
==========================================
- Hits 183716 183656 -60
- Misses 13235 13293 +58
- Partials 7723 7726 +3
🚀 New features to boost your workflow:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This function can return null, which will make the calls to BIO_meth_set_* trigger a null deref.
Even after fixing this, there is an issue with the
BIOPointer::New(GetMethod())call inNodeBIO::Newbecause theNewmethod cannot handle a null pointer despite other code already guarding for this(e.g. the
NodeBIO::Newfunction already checksbio). This patch solves the issues by adding more null checks.Note: this was found by a static-dynamic analyser I'm developing.