From 6060e3fea526bd9ffc31c89def365ec76ba4348f Mon Sep 17 00:00:00 2001
From: Quim Muntal <qmuntaldiaz@microsoft.com>
Date: Mar 14 2022 17:16:28 +0000
Subject: [PATCH 1/2] Fix use-after-free bug in VerifyECDSA


Because of the PublicKeyECDSA (pub) finalizer, any time pub.key is passed to cgo, that call must be followed by a call to runtime.KeepAlive, to make sure pub is not collected (and finalized) before the call returns.

VerifyECDSA does call runtime.KeepAlive, but that call will be deleted if the compiler can prove that h is always 0, leaving _goboringcrypto_internal_ECDSA_verify call vulnerable at garbage collector mercy.

The fix is easy, just add a runtime.KeepAlice call to the h == crypto.Hash(0) branch.
---

diff --git a/src/crypto/internal/boring/ecdsa.go b/src/crypto/internal/boring/ecdsa.go
index 14a62b0..c4f07a8 100644
--- a/src/crypto/internal/boring/ecdsa.go
+++ b/src/crypto/internal/boring/ecdsa.go
@@ -176,7 +176,8 @@ func VerifyECDSA(pub *PublicKeyECDSA, msg []byte, r, s *big.Int, h crypto.Hash) 
 	}
 	if h == crypto.Hash(0) {
 		ok := C._goboringcrypto_internal_ECDSA_verify(0, base(msg), C.size_t(len(msg)), (*C.uint8_t)(unsafe.Pointer(&sig[0])), C.uint(len(sig)), pub.key) > 0
-		return ok
+		runtime.KeepAlive(pub)
+        return ok
 	}
 	md := cryptoHashToMD(h)
 	if md == nil {

From 3ee880e40b892854305f674099a4c0558184fa78 Mon Sep 17 00:00:00 2001
From: Quim Muntal <qmuntaldiaz@microsoft.com>
Date: Mar 14 2022 17:28:34 +0000
Subject: [PATCH 2/2] Fix indentation


---

diff --git a/src/crypto/internal/boring/ecdsa.go b/src/crypto/internal/boring/ecdsa.go
index c4f07a8..c3e4520 100644
--- a/src/crypto/internal/boring/ecdsa.go
+++ b/src/crypto/internal/boring/ecdsa.go
@@ -177,7 +177,7 @@ func VerifyECDSA(pub *PublicKeyECDSA, msg []byte, r, s *big.Int, h crypto.Hash) 
 	if h == crypto.Hash(0) {
 		ok := C._goboringcrypto_internal_ECDSA_verify(0, base(msg), C.size_t(len(msg)), (*C.uint8_t)(unsafe.Pointer(&sig[0])), C.uint(len(sig)), pub.key) > 0
 		runtime.KeepAlive(pub)
-        return ok
+		return ok
 	}
 	md := cryptoHashToMD(h)
 	if md == nil {