bug in PKCS7_free ?

[Alexandre Belloni]

Hi,

I'm trying to build a PKCS7 envelopped data (encrypted) but when I'm 
done withe the PKCS7 structure and I try to free it (calling PKCS7_free) 
I keep getting an "access violation accessing 0xfeeefef6".

I'm using openssl 0.9.8 under windows XP (win32).

Code is attached.

--
Alexandre Belloni
#include <stdio.h>
#include <windows.h>
#include <string.h>
#include <time.h>

#include <openssl/err.h>
#include <openssl/objects.h>
#include <openssl/evp.h>
#include <openssl/x509.h>
#include <openssl/pkcs7.h>
#include <openssl/pem.h>

int main(void)
{
        PKCS7                           *p7             = NULL;
        PKCS7_SIGNER_INFO       *si             = NULL;
        X509                            *cert           = NULL;

        PKCS7                           *p7c            = NULL;
        BIO                                     *p7bio          = NULL;
        BIO                                     *in                     = NULL;
        BIO                                     *out            = NULL;
        int     ret;
        int             len = 0;

        unsigned char *p7_der = NULL;

        char data[] = "123456789";

        STACK_OF(PKCS7_SIGNER_INFO) *sk;

        in = BIO_new(BIO_s_file());
        if (in == NULL) 
        {
                ret = -1;
        goto err;
    }

        if (BIO_read_filename(in,"p7pem") <= 0)
        {
                ret = -1;
                goto err;
        }

        p7 = PEM_read_bio_PKCS7(in,NULL,NULL,NULL);
        if (p7 == NULL)
        {
                ret = -1;
                goto err;
        }

        sk = PKCS7_get_signer_info(p7);
        if (sk == NULL)
        {
                ret = -1;
                goto err;
        }

        si = sk_PKCS7_SIGNER_INFO_value(sk, 0);
        if (si == NULL)
        {
                ret = -1;
                goto err;
        }

    cert = PKCS7_cert_from_signer_info(p7, si);
        if (cert == NULL)
        {
                ret = -1;
                goto err;
        }

        p7c = PKCS7_new();
        if(p7c == NULL) {
                ret = -1;
                goto err;
        }

        PKCS7_set_type(p7c, NID_pkcs7_enveloped);

        if(!PKCS7_set_cipher(p7c, EVP_des_ede3_cbc())) {
                ret = -1;
                goto err;
        }

        if(!PKCS7_add_recipient(p7c, cert)) {
                ret = -1;
                goto err;
        }

        p7bio = PKCS7_dataInit(p7c, NULL);
        if(p7bio == NULL) {
                ret = -1;
                goto err;
        }

        BIO_write(p7bio, data, sizeof(data));

        BIO_flush(p7bio);

        if (!PKCS7_dataFinal(p7c, p7bio)) {
                ret = -1;
                goto err;
        }

        out = BIO_new(BIO_s_file());
        if (out == NULL) 
        {
                ret = -1;
        goto err;
    }

        if (BIO_write_filename(out, "p7enc") <= 0)
        {
                ret = -1;
                goto err;
        }

        PEM_write_bio_PKCS7(out,p7c);

        ret = 0;

err:

        if (in != NULL)
                BIO_free_all(in);

        if (out != NULL)
                BIO_free_all(out);

        if (p7bio != NULL)
                BIO_free_all(p7bio);

        if (cert != NULL)
                X509_free(cert);

        if (p7 != NULL)
                PKCS7_free(p7);

        if (p7c != NULL)
                PKCS7_free(p7c);

        return ret;
}