memory leak in function mbedtls_mpi_exp_mod about mbedtls

[sinbobo]

My bad, really thanks, god bless you and wish you code with no bugs for the rest of life ^_^

[gilles-peskine-arm]

mbedtls_mpi_exp_mod does not free RR because it's an output.

For the call stack you give, this output is cached in the RSA context and should be freed when you call mbedtls_rsa_free.

Can you please share a complete program that reproduces the memory leak?

[gilles-peskine-arm]

Here's the problem:

    mbedtls_rsa_context ctx_rsa = *((mbedtls_rsa_context *)(ctxPk.pk_ctx));

Here you're making a shallow copy of the mbedtls_rsa_context structure that's in ctxPk. At the end of your program, you call mbedtls_pk_free, which frees the RSA context in the PK context, but doesn't free the parts of the RSA context in the shallow copy.

The actual key material is in mbedtls_mpi objects for which there is a pointer in the shallow copy and a pointer in the PK context. Those are freed by the call to mbedtls_pk_free. After that call, the shallow copy has dangling pointers. The RR value that is cached in the context is only stored in the shallow copy, and that is never freed.

The fix is to not make a shallow copy. Mbed TLS does not support shallow copies of structures. Instead, directly access the RSA context that's in the PK context. Also, please use the API function instead of accessing fields in an unsafe way.

    mbedtls_rsa_context *ctx_rsa = mbedtls_pk_rsa(*ctxPk);

[gilles-peskine-arm]

I am closing this issue because it's an API misuse, not a bug in the library.