OpenSSL: Fix memory leak in PKCS12 additional certificate parsing

The additional PKCS12 certificates were not freed properly in the loop
added in commit de2a7b796d82d92120aa9532450863f503e1885a ('OpenSSL: Use
connection certificate chain with PKCS#12 extra certs').

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index 7a2db492bd3655d29d54aac91ba141a16f4693e1..b23c219e81505a558700741388b44dfa2c00455f 100644 (file)
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -2488,13 +2488,15 @@ static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12,
                                tls_show_errors(MSG_DEBUG, __func__,
                                                "Failed to add additional certificate");
                                res = -1;
+                               X509_free(cert);
                                break;
                        }
+                       X509_free(cert);
                }
                if (!res) {
                        /* Try to continue anyway */
                }
-               sk_X509_free(certs);
+               sk_X509_pop_free(certs, X509_free);
 #ifndef OPENSSL_IS_BORINGSSL
                if (ssl)
                        res = SSL_build_cert_chain(
@@ -2532,11 +2534,13 @@ static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12,
                         */
                        if (SSL_CTX_add_extra_chain_cert(data->ssl, cert) != 1)
                        {
+                               X509_free(cert);
                                res = -1;
                                break;
                        }
+                       X509_free(cert);
                }
-               sk_X509_free(certs);
+               sk_X509_pop_free(certs, X509_free);
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10002000L */
        }