4 files changed, 51 insertions, 13 deletions

diff --git a/src/common/Cryptography/CryptoHash.h b/src/common/Cryptography/CryptoHash.h
index d36d345b88c..a2cd393745e 100644
--- a/src/common/Cryptography/CryptoHash.h
+++ b/src/common/Cryptography/CryptoHash.h
@@ -96,7 +96,7 @@ namespace Trinity::Impl
                 if (this == &right)
                     return *this;
 
-                int result = EVP_MD_CTX_copy(_ctx, right._ctx);
+                int result = EVP_MD_CTX_copy_ex(_ctx, right._ctx);
                 ASSERT(result == 1);
                 _digest = right._digest;
                 return *this;
diff --git a/src/common/Cryptography/HMAC.h b/src/common/Cryptography/HMAC.h
index 6ed86de4bab..d07ba19216d 100644
--- a/src/common/Cryptography/HMAC.h
+++ b/src/common/Cryptography/HMAC.h
@@ -86,9 +86,10 @@ namespace Trinity::Impl
                 if (this == &right)
                     return *this;
 
-                int result = EVP_MD_CTX_copy(_ctx, right._ctx);
+                int result = EVP_MD_CTX_copy_ex(_ctx, right._ctx);
                 ASSERT(result == 1);
-                _key = right._key; // EVP_PKEY uses reference counting internally, just copy the pointer
+                _key = right._key;      // EVP_PKEY uses reference counting internally, just copy the pointer
+                EVP_PKEY_up_ref(_key);  // Bump reference count for PKEY, as every instance of this class holds two references to PKEY and destructor decrements it twice
                 _digest = right._digest;
                 return *this;
             }
diff --git a/src/common/Cryptography/RSA.cpp b/src/common/Cryptography/RSA.cpp
index e8f8b4966ac..69f2916b343 100644
--- a/src/common/Cryptography/RSA.cpp
+++ b/src/common/Cryptography/RSA.cpp
@@ -160,30 +160,60 @@ EVP_MD const* RsaSignature::HMAC_SHA256::GetGenerator() const
 void RsaSignature::HMAC_SHA256::PostInitCustomizeContext(EVP_MD_CTX* ctx)
 {
     HMAC_SHA256_MD::CTX_DATA* ctxData = reinterpret_cast<HMAC_SHA256_MD::CTX_DATA*>(EVP_MD_CTX_md_data(ctx));
-    if (ctxData->hmac)
-        delete ctxData->hmac;
 
+    delete ctxData->hmac;
     ctxData->hmac = new Crypto::HMAC_SHA256(_key, _keyLength);
 }
 
-RsaSignature::RsaSignature()
+RsaSignature::RsaSignature() : _ctx(Impl::GenericHashImpl::MakeCTX())
 {
-    _ctx = Impl::GenericHashImpl::MakeCTX();
 }
 
-RsaSignature::RsaSignature(RsaSignature&& rsa) noexcept
+RsaSignature::RsaSignature(RsaSignature const& other) : _ctx(Impl::GenericHashImpl::MakeCTX())
 {
-    _ctx = rsa._ctx;
-    rsa._ctx = Impl::GenericHashImpl::MakeCTX();
+    *this = other;
+}
+
+RsaSignature::RsaSignature(RsaSignature&& other) noexcept
+{
+    *this = std::move(other);
 }
 
 RsaSignature::~RsaSignature()
 {
     EVP_MD_CTX_free(_ctx);
+    EVP_PKEY_free(_key);
+}
+
+RsaSignature& RsaSignature::operator=(RsaSignature const& right)
+{
+    if (this == &right)
+        return *this;
+
+    EVP_MD_CTX_copy_ex(_ctx, right._ctx);   // Allowed to fail if not yet initialized
+    _key = right._key;                      // EVP_PKEY uses reference counting internally, just copy the pointer
+    EVP_PKEY_up_ref(_key);                  // Bump reference count for PKEY, as every instance of this class holds two references to PKEY and destructor decrements it twice
+    return *this;
+}
+
+RsaSignature& RsaSignature::operator=(RsaSignature&& right) noexcept
+{
+    if (this == &right)
+        return *this;
+
+    _ctx = std::exchange(right._ctx, Impl::GenericHashImpl::MakeCTX());
+    _key = std::exchange(right._key, EVP_PKEY_new());
+    return *this;
 }
 
 bool RsaSignature::LoadKeyFromFile(std::string const& fileName)
 {
+    if (_key)
+    {
+        EVP_PKEY_free(_key);
+        _key = nullptr;
+    }
+
     std::unique_ptr<BIO, BIODeleter> keyBIO(BIO_new_file(fileName.c_str(), "r"));
     if (!keyBIO)
         return false;
@@ -197,6 +227,12 @@ bool RsaSignature::LoadKeyFromFile(std::string const& fileName)
 
 bool RsaSignature::LoadKeyFromString(std::string const& keyPem)
 {
+    if (_key)
+    {
+        EVP_PKEY_free(_key);
+        _key = nullptr;
+    }
+
     std::unique_ptr<BIO, BIODeleter> keyBIO(BIO_new_mem_buf(
         const_cast<char*>(keyPem.c_str()) /*api hack - this function assumes memory is readonly but lacks const modifier*/,
         keyPem.length() + 1));
diff --git a/src/common/Cryptography/RSA.h b/src/common/Cryptography/RSA.h
index 9c8399d2fda..18771f14926 100644
--- a/src/common/Cryptography/RSA.h
+++ b/src/common/Cryptography/RSA.h
@@ -60,11 +60,12 @@ public:
     };
 
     RsaSignature();
-    RsaSignature(RsaSignature&& rsa) noexcept;
+    RsaSignature(RsaSignature const& other);
+    RsaSignature(RsaSignature&& other) noexcept;
     ~RsaSignature();
 
-    RsaSignature(RsaSignature const& rsa) = delete;
-    RsaSignature& operator=(RsaSignature const& rsa) = delete;
+    RsaSignature& operator=(RsaSignature const& right);
+    RsaSignature& operator=(RsaSignature&& right) noexcept;
 
     bool LoadKeyFromFile(std::string const& fileName);