Code QL Fixes

[walterchris]

No description provided.

[Copilot]

Pull request overview

This PR addresses CodeQL/static-analysis findings in the OpenSSL provider plugin by tightening file-output handling for masked key material and cleaning up unused code/comments.

Changes:

• Write masked EC key blobs using open() with explicit owner-only permissions before fdopen()/fwrite().
• Remove unused variables/functions flagged by analysis.
• Add clarifying inline comments for key exchange and signing code paths.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
plugins/ossl_prov/src/azihsm_ossl_keymgmt_ec.c	Switch masked-key file writing to open() + fdopen() and improve parameter parsing comments.
plugins/ossl_prov/src/azihsm_ossl_keyexch.c	Add explanatory comments to EC point → DER SPKI encoding flow.
plugins/ossl_prov/src/azihsm_ossl_hsm.c	Simplify file-size validation comment/check; add explanatory comments in signing routine.
plugins/ossl_prov/src/azihsm_ossl_encoder_ec.c	Remove unused local buffers.
plugins/ossl_prov/src/azihsm_ossl_digest.c	Remove unused azihsm_ossl_newctx stub.

Comments suppressed due to low confidence (1)

plugins/ossl_prov/src/azihsm_ossl_keymgmt_ec.c:515

• On the error paths after creating/truncating the masked-key file (e.g., fdopen() failure or short write), the code returns without removing the file. This can leave an empty or partially written sensitive blob on disk. The provider already unlinks in similar cases (e.g., azihsm_ossl_hsm.c:136, azihsm_ossl_keyexch.c:574); consider unlinking genctx->masked_key_file on these failures as well.

            FILE *f = fdopen(fd, "wb");
            if (f == NULL)
            {
                close(fd);
                azihsm_key_delete(private);
                azihsm_key_delete(public);

                OPENSSL_cleanse(masked_key_buffer, masked_key_buffer_size);
                OPENSSL_free(masked_key_buffer);
                OPENSSL_free(ec_key);
                ERR_raise(ERR_LIB_PROV, ERR_R_OPERATION_FAIL);
                return NULL;
            }

            size_t written = fwrite(masked_key_buffer, 1, prop.len, f);
            fclose(f);

            if (written != prop.len)
            {
                azihsm_key_delete(private);
                azihsm_key_delete(public);

                OPENSSL_cleanse(masked_key_buffer, masked_key_buffer_size);
                OPENSSL_free(masked_key_buffer);
                OPENSSL_free(ec_key);
                ERR_raise(ERR_LIB_PROV, ERR_R_OPERATION_FAIL);
                return NULL;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jaygmsft]