Commit a64aa44
crypto: fix memory leak if certificate is revoked
The additional validity checks applied to StartCom and WoSign
certificates failed to free memory before returning.
Refs: #9469
Fixes: #12033
PR-URL: #12089
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>1 parent d8b71be commit a64aa44
1 file changed
Lines changed: 6 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -2760,7 +2760,9 @@ inline bool CertIsStartComOrWoSign(X509_NAME* name) { | |||
| 2760 | 2760 | startcom_wosign_data = dn.data; | |
| 2761 | 2761 | startcom_wosign_name = d2i_X509_NAME(nullptr, &startcom_wosign_data, | |
| 2762 | 2762 | dn.len); | |
| 2763 | - if (X509_NAME_cmp(name, startcom_wosign_name) == 0) | ||
| 2763 | + int cmp = X509_NAME_cmp(name, startcom_wosign_name); | ||
| 2764 | + X509_NAME_free(startcom_wosign_name); | ||
| 2765 | + if (cmp == 0) | ||
| 2764 | 2766 | return true; | |
| 2765 | 2767 | } | |
| 2766 | 2768 | ||
@@ -2805,8 +2807,10 @@ inline CheckResult CheckWhitelistedServerCert(X509_STORE_CTX* ctx) { | |||
| 2805 | 2807 | } | |
| 2806 | 2808 | ||
| 2807 | 2809 | X509* leaf_cert = sk_X509_value(chain, 0); | |
| 2808 | - if (!CheckStartComOrWoSign(root_name, leaf_cert)) | ||
| 2810 | + if (!CheckStartComOrWoSign(root_name, leaf_cert)) { | ||
| 2811 | + sk_X509_pop_free(chain, X509_free); | ||
| 2809 | 2812 | return CHECK_CERT_REVOKED; | |
| 2813 | + } | ||
| 2810 | 2814 | ||
| 2811 | 2815 | // When the cert is issued from either CNNNIC ROOT CA or CNNNIC EV | |
| 2812 | 2816 | // ROOT CA, check a hash of its leaf cert if it is in the whitelist. | |
0 commit comments