Editorial question148.6K views800 votes0 answers4,569 following
AI-generatedEVP_PKEY_verify() heap leak during signature verification failure
Memory Exhaustion in EVP API When utilizing the OpenSSL EVP API for signature verification, the EVP_PKEY_verify() function can result in memory exhaustion under specific failure conditions. While CVE-2022-0778 addressed certain instances of NULL pointer handling, the deallocation logic for nested ASN.1 structures during early exit paths remains complex. The
openssl