commit e11cb70

fix: memory leak and oob read in "adduser"

 1@@ -38,7 +38,7 @@ xs_str *xs_base64_enc(const xs_val *data, int sz)
 2 {
 3     BIO *mem, *b64;
 4     BUF_MEM *bptr;
 5- 
 6+
 7     b64 = BIO_new(BIO_f_base64());
 8     mem = BIO_new(BIO_s_mem());
 9     b64 = BIO_push(b64, mem);
10@@ -118,7 +118,7 @@ xs_dict *xs_evp_genkey(int bits)
11 /* generates an RSA keypair using the EVP interface */
12 {
13     xs_dict *keypair = NULL;
14-    EVP_PKEY_CTX *ctx;
15+    EVP_PKEY_CTX *ctx = NULL;
16     EVP_PKEY *pkey = NULL;
17 
18     if ((ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL)) == NULL)
19@@ -142,12 +142,17 @@ xs_dict *xs_evp_genkey(int bits)
20 
21     keypair = xs_dict_new();
22 
23-    keypair = xs_dict_append(keypair, "secret", sptr->data);
24-    keypair = xs_dict_append(keypair, "public", pptr->data);
25+    xs *secret = xs_str_new_sz(sptr->data, sptr->length);
26+    xs *public = xs_str_new_sz(pptr->data, pptr->length);
27+    keypair = xs_dict_append(keypair, "secret", secret);
28+    keypair = xs_dict_append(keypair, "public", public);
29 
30     BIO_free(bs);
31     BIO_free(bp);
32 
33+    EVP_PKEY_free(pkey);
34+    EVP_PKEY_CTX_free(ctx);
35+
36 end:
37     return keypair;
38 }