Bug 240230

Summary: openssl segfaults if RUN_ONCE fails
Product: Base System Reporter: andrew
Component: binAssignee: freebsd-bugs (Nobody) <bugs>
Status: New ---    
Severity: Affects Some People    
Priority: ---    
Version: CURRENT   
Hardware: Any   
OS: Any   

Description andrew 2019-08-31 12:03:31 UTC
RAND_get_rand_method returns NULL if RUN_ONCE fails, but none of its callers check for this condition, and so they immediately segfault from deferencing the NULL.

(RUN_ONCE fails if libthr is not in the process, for example because openssl was static-linked without it. This aspect of the issue is the subject of another bug report; but if RUN_ONCE can legitimately fail for any other reason, then this is an independent bug in openssl.)

Affects CURRENT and 12-STABLE, probably not 11 (not checked).