Segmentation fault on macOS about opensc HOT 6 OPEN

Can you get a backtrace from the crash? It looks like some double-free or uninitialized value when freeing EVP_PKEY, but from this information, it is hard to guess what went wrong where. Most of the world is already on OpenSSL 3.0, can you check if #2930 will solve the problem for you?

from opensc.

Sure, here is the backtrace:

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xa9)
  * frame #0: 0x00000001008a2bd4 libcrypto.3.dylib`evp_pkey_free_legacy + 44
    frame #1: 0x00000001008a2c50 libcrypto.3.dylib`evp_pkey_free_it + 28
    frame #2: 0x00000001008a094c libcrypto.3.dylib`EVP_PKEY_free + 72
    frame #3: 0x000000010095171c libcrypto.3.dylib`x509_pubkey_ex_free + 56
    frame #4: 0x00000001007bb874 libcrypto.3.dylib`ossl_asn1_template_free + 184
    frame #5: 0x00000001007bb64c libcrypto.3.dylib`ossl_asn1_item_embed_free + 248
    frame #6: 0x00000001007bb874 libcrypto.3.dylib`ossl_asn1_template_free + 184
    frame #7: 0x00000001007bb64c libcrypto.3.dylib`ossl_asn1_item_embed_free + 248
    frame #8: 0x00000001007bb548 libcrypto.3.dylib`ASN1_item_free + 28
    frame #9: 0x00000001000316b4 openvpn`pkcs11_certificate_dn + 48
    frame #10: 0x00000001000311b4 openvpn`show_pkcs11_ids + 424
    frame #11: 0x0000000100041bf8 openvpn`add_option + 39528
    frame #12: 0x0000000100038058 openvpn`parse_argv + 532
    frame #13: 0x0000000100031da0 openvpn`main + 224
    frame #14: 0x00000001af113e50 dyld`start + 2544

I am not quite sure how I should check if #2930 solves my issue. The openvpn command is using OpenSSL 3:

➜  ~ openvpn --version
OpenVPN 2.6.8 aarch64-apple-darwin22.6.0 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD]
library versions: OpenSSL 3.2.0 23 Nov 2023, LZO 2.10

Not sure if the library uses something else, if so please let me know how I can see this.

from opensc.

I am not quite sure how I should check if #2930 solves my issue. The openvpn command is using OpenSSL 3:

You can go to checks and there should be OSX build for download as part of the test artifacts.

The problem is that the opensc is built against the openssl 1.1 (before #2930) and openvpn against 3 so it might theoretically cause some trouble. But technically, no openssl objects should be passed through the pkcs11 interface so I believe this would be some issue on the openvpn side.

I see that the openvpn is using pkcs11-helper to access opensc so I would also check the pkcs11-helper:

https://github.com/OpenSC/pkcs11-helper

from opensc.

I cannot reproduce this, the command is working as expected for me.

from opensc.

I cannot reproduce this, the command is working as expected for me.

Tested on Apple m1 Sonoma, OpenSC release 0.24.0, OpenVPN 3.2.1 from homebrew

from opensc.

Please try reading the OpenVPN debug files if there are any pkcs#11 related errors
https://openvpn.net/vpn-server-resources/logging-and-debug-flag-options-for-access-server/

from opensc.