From 201ecd5618053d83565ba7bf0950e7a67cec6e20 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 6 Aug 2026 17:44:27 +0000 Subject: [PATCH] tls: JA3 buffer pointers on allocation failure Improper pointer handling would leave dangling pointers after allocation failure that could get freed again (double free). Ticket: #8857. --- src/app-layer-ssl.c | 36 ++++++++++++++++-------------------- 1 file changed, 16 insertions(+), 20 deletions(-) diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c index 5e9dd3b58f..5dc0a407fd 100644 --- a/src/app-layer-ssl.c +++ b/src/app-layer-ssl.c @@ -1044,9 +1044,8 @@ invalid_length: } static inline int TLSDecodeHSHelloExtensionEllipticCurves(SSLState *ssl_state, - const uint8_t * const initial_input, - const uint32_t input_len, - JA3Buffer *ja3_elliptic_curves) + const uint8_t *const initial_input, const uint32_t input_len, + JA3Buffer **ja3_elliptic_curves) { const uint8_t *input = initial_input; @@ -1063,7 +1062,8 @@ static inline int TLSDecodeHSHelloExtensionEllipticCurves(SSLState *ssl_state, if (!(HAS_SPACE(elliptic_curves_len))) goto invalid_length; - if ((ssl_state->current_flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) && ja3_elliptic_curves) { + if ((ssl_state->current_flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) && + *ja3_elliptic_curves != NULL) { uint16_t ec_processed_len = 0; /* coverity[tainted_data] */ while (ec_processed_len < elliptic_curves_len) @@ -1075,8 +1075,7 @@ static inline int TLSDecodeHSHelloExtensionEllipticCurves(SSLState *ssl_state, input += 2; if (TLSDecodeValueIsGREASE(elliptic_curve) != 1) { - int rc = Ja3BufferAddValue(&ja3_elliptic_curves, - elliptic_curve); + int rc = Ja3BufferAddValue(ja3_elliptic_curves, elliptic_curve); if (rc != 0) return -1; } @@ -1100,9 +1099,8 @@ invalid_length: } static inline int TLSDecodeHSHelloExtensionEllipticCurvePF(SSLState *ssl_state, - const uint8_t * const initial_input, - const uint32_t input_len, - JA3Buffer *ja3_elliptic_curves_pf) + const uint8_t *const initial_input, const uint32_t input_len, + JA3Buffer **ja3_elliptic_curves_pf) { const uint8_t *input = initial_input; @@ -1119,7 +1117,8 @@ static inline int TLSDecodeHSHelloExtensionEllipticCurvePF(SSLState *ssl_state, if (!(HAS_SPACE(ec_pf_len))) goto invalid_length; - if ((ssl_state->current_flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) && ja3_elliptic_curves_pf) { + if ((ssl_state->current_flags & SSL_AL_FLAG_STATE_CLIENT_HELLO) && + *ja3_elliptic_curves_pf != NULL) { uint8_t ec_pf_processed_len = 0; /* coverity[tainted_data] */ while (ec_pf_processed_len < ec_pf_len) @@ -1128,8 +1127,7 @@ static inline int TLSDecodeHSHelloExtensionEllipticCurvePF(SSLState *ssl_state, input += 1; if (TLSDecodeValueIsGREASE(elliptic_curve_pf) != 1) { - int rc = Ja3BufferAddValue(&ja3_elliptic_curves_pf, - elliptic_curve_pf); + int rc = Ja3BufferAddValue(ja3_elliptic_curves_pf, elliptic_curve_pf); if (rc != 0) return -1; } @@ -1328,11 +1326,10 @@ static inline int TLSDecodeHSHelloExtensions(SSLState *ssl_state, case SSL_EXTENSION_ELLIPTIC_CURVES: { /* coverity[tainted_data] */ - ret = TLSDecodeHSHelloExtensionEllipticCurves(ssl_state, input, - ext_len, - ja3_elliptic_curves); + ret = TLSDecodeHSHelloExtensionEllipticCurves( + ssl_state, input, ext_len, &ja3_elliptic_curves); if (ret < 0) - goto end; + goto error; input += ext_len; @@ -1342,11 +1339,10 @@ static inline int TLSDecodeHSHelloExtensions(SSLState *ssl_state, case SSL_EXTENSION_EC_POINT_FORMATS: { /* coverity[tainted_data] */ - ret = TLSDecodeHSHelloExtensionEllipticCurvePF(ssl_state, input, - ext_len, - ja3_elliptic_curves_pf); + ret = TLSDecodeHSHelloExtensionEllipticCurvePF( + ssl_state, input, ext_len, &ja3_elliptic_curves_pf); if (ret < 0) - goto end; + goto error; input += ext_len;