From mboxrd@z Thu Jan  1 00:00:00 1970
From: johny at neuromancer.sk (Jan Jancar)
Date: Mon, 22 May 2017 19:54:53 +0200
Subject: Bug: SIGSEGV in OPENSSL_cleanse
Message-ID: <2e8d90dd-1483-9e58-f2e9-51220d0c4a4d@neuromancer.sk>

Hi all.

I am, or rather was, running an instance of cgit on an ARM box:

> uname -srm
Linux 4.9.28-2-ARCH armv6l

I run ArchLinuxARM and they recently had an update to openssl:

openssl		1.1.0.e-1
openssl-1.0	1.0.2.k-3

So I currently have 2 versions of openssl on that box.

After running cgit for awhile I noticed it now SIGSEGVs on certain requests:

           PID: 12517 (cgit.cgi)
           UID: 33 (http)
           GID: 33 (http)
        Signal: 11 (SEGV)
     Timestamp: Sun 2017-05-21 13:26:35 CEST (1 day 6h ago)
  Command Line: /usr/lib/cgit/cgit.cgi
    Executable: /usr/lib/cgit/cgit.cgi
 Control Group: /system.slice/system-uwsgi.slice/uwsgi at cgit.service
          Unit: uwsgi at cgit.service
         Slice: system-uwsgi.slice
       Boot ID: 93dadbde0e144f3ab346f1e21ac7ee5d
    Machine ID: 4bd17fc498ad478094fa58c3a7782769
      Hostname: Neuromancer
       Storage:
/var/lib/systemd/coredump/core.cgit\x2ecgi.33.93dadbde0e144f3ab346f1e21ac7ee5d.12517.1495365995000000000000.lz4
       Message: Process 12517 (cgit.cgi) of user 33 dumped core.

                Stack trace of thread 12517:
                #0  0x000000007678e7d8 OPENSSL_cleanse
(/usr/lib/libcrypto.so.1.0.0)


A bit more of the stack is shown when running the dump through gdb:

#0  0x765c37d8 in OPENSSL_cleanse () from /usr/lib/libcrypto.so.1.0.0
#1  0x7664243c in EVP_MD_CTX_cleanup () from /usr/lib/libcrypto.so.1.0.0
#2  0x76642774 in EVP_MD_CTX_destroy () from /usr/lib/libcrypto.so.1.0.0
Backtrace stopped: previous frame identical to this frame (corrupt stack?)


Investigating more, some weird behavior is shown, while ldd says
cgit.cgi will run with /usr/lib/libcrypto.so.1.0.0 and even the coredump
confirms that, when actually debugging the coredump, `info sharedlib` says:

warning: Corrupted shared library list: 0x76ffa8b0 != 0x0