c - Why RSA_generate_key uses uninitialized values (according to valgrind) -


i have been working on involves cryptography. must admit knowledge in cryptography basic. decided see rsa structure contains after rsa key generated rsa_generate_key openssl library. got segmentation fault:

const unsigned long e = 3; const int num = 3072;    ... rsa *rsa_key = rsa_generate_key(num, e, null, null); if (!rsa_key) {     printf("failed generate rsa key!\n");     return rsa_error_code; }  printf("rsa->pad=0x%x\n", rsa_key->pad); printf("rsa->version=0x%lx\n", rsa_key->version); if (rsa_key->n) {     printf("rsa->n->top=0x%x\n", rsa_key->n->top); // here got seg fault     ....

it looked strange me wrote minimal code test valgrind tool. here code in c:

#include "openssl/rsa.h" #include <stdio.h>  int main() {            const unsigned long e = 3;   // exponent, 3 in qvrsa     const int num = 3072;         rsa *rsa_key = rsa_generate_key(num, e, null, null);      if (rsa_key == null)     {         printf("rsa invalid!\n");         return 1;     }      printf("rsa->pad=0x%x\n", rsa_key->pad);     printf("rsa->version=0x%lx\n", rsa_key->version);     if (rsa_key->n)     {         printf("rsa->n->top=0x%x\n", rsa_key->n->top);     }      rsa_free(rsa_key);     rsa_key = null;     return 0; }

the compilation line: gcc rsa.c -lcrypto -g -o0 -o rsa

this time there no segmentation fault , output was:

rsa->pad=0x0  rsa->version=0x0  rsa->n->top=0x30

but valgrind fired plenty of error messages: 

==6916== conditional jump or move depends on uninitialised value(s) ==6916==    @ 0x4daeb37: bn_bin2bn (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4db1b62: ??? (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4db4471: bn_generate_prime_ex (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4dc8763: rsa_generate_key_ex (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4dcb763: rsa_generate_key (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x40072e: main (rsa.c:9) ==6916==  uninitialised value created heap allocation ==6916==    @ 0x4b23d6d: malloc (vg_replace_malloc.c:270) ==6916==    0x4d8936a: crypto_malloc (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4db1ad1: ??? (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4db4471: bn_generate_prime_ex (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4dc8763: rsa_generate_key_ex (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4dcb763: rsa_generate_key (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x40072e: main (rsa.c:9)  ==6916== conditional jump or move depends on uninitialised value(s) ==6916==    @ 0x4db44d0: bn_generate_prime_ex (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4dc8763: rsa_generate_key_ex (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4dcb763: rsa_generate_key (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x40072e: main (rsa.c:9) ==6916==  uninitialised value created heap allocation ==6916==    @ 0x4b23d6d: malloc (vg_replace_malloc.c:270) ==6916==    0x4d8936a: crypto_malloc (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4db1ad1: ??? (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4db4471: bn_generate_prime_ex (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4dc8763: rsa_generate_key_ex (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x4dcb763: rsa_generate_key (in /usr/lib64/libcrypto.so.0.9.8) ==6916==    0x40072e: main (rsa.c:9)

and many others conditional jump or move depends on uninitialised value(s) title.

why? there known bug in openssl or false alarm , original segmentation fault related hidden bugs in original code?

i used:

  • gcc v4.5.2

  • valgrind v3.8.1

  • openssl 0.9.8a

openssl using uninitialized variables generate random data genearate key. valgrind complain, not false positive.

according openssl faq, rid of it, compile -dpurify. however, can debate whether idea test differently compiled binary production binary.


Comments

Post a Comment

Popular posts from this blog

html - Outlook 2010 Anchor (url/address/link) -

i'm trying link specific pdf page msoutlook'10 or msword'10, #page=... anchor particularly useful , works fine elsewhere. unfortunately when click [ctr-k] in outlook or winword, links re-formatted assuming unc path. pdf file located on shared drive. using "file:" prefix links open pdf in adobe reader (outside of browser), , "http:" open inside browser. issue seem need open in browser "file:" prefix in order anchor work. know anchors work inside browser. outlook uses windows/explorer default program (based on file extension) seems open in adobe reader neglecting anchor. is aware of solution, link specific page or bookmark of shared-pdf ms outlook and/or winword link? common references: mailermailer.com/...anchor-tags-html-emails campaignmonitor.com/...anchor-links-in-email-newsletters/ stackoverflow.com/...anchor-in-pdf-document
Read more

javascript - Why does running this loop 9 times take 100x longer than running it 8 times? -

consider code: test = function() { } t = new test(); (var = 0; < 8; i++) { result = t instanceof test; } if change number of iterations 8 9 , loop take 100 times longer complete in latest version of firefox (41.0.1). tested on 2 different pcs , magic limit 8. here jsperf test used: http://jsperf.com/instanceof-8-times-vs-9-times does have idea why might happen? seems specific instanceof . not happen if else object, example check property. note: filed bugzilla bug this. jan de mooij mozilla team has posted details in bugzilla thread . here's simplistic interpretation of highly technical answers: in i < 8 case, firefox smart enough hoist result = t instanceof test; statement out of loop (according tests, doesn't seem omit altogether). in i < 9 case, apparently doesn't optimization . why? reason not clear, related fact 9 iterations threshold above function considered "hot" enough run through jit compiler. i < 8 cas...
Read more

Getting gateway time-out Rails app with Nginx + Puma running on Digital Ocean -

following this guide setup app on digital ocean droplet, not working. site not loading , it's throwing: "gateway time-out". the puma server works, since ps aux | grep puma prints: root 15878 0.0 0.4 376832 2168 ? sl 12:50 0:00 puma 2.13.4 (unix:///var/www/myapp/shared/tmp/sockets/myapp-puma.sock) [20150930164940] root 15881 0.0 0.7 903676 3692 ? sl 12:50 0:06 puma: cluster worker 0: 15878 [20150930164940] root 24654 0.0 0.1 11748 916 pts/2 s+ 18:00 0:00 grep --color=auto puma my nginx config: user root; worker_processes 1; events { worker_connections 1024; } http { upstream puma { server unix:///var/www/myapp/shared/tmp/sockets/myapp-puma.sock; } server { listen 80; server_name myapp.com; root /var/www/myapp/current/public; access_log /var/www/myapp/current/log/access.log; error_log /...
Read more