]> git.ipfire.org Git - thirdparty/openssl.git/commit
crypto/x509/t_req.c: avoid exts leaking on error paths
authorEugene Syromiatnikov <esyr@openssl.org>
Mon, 1 Sep 2025 14:34:34 +0000 (16:34 +0200)
committerNeil Horman <nhorman@openssl.org>
Sat, 6 Sep 2025 14:11:45 +0000 (10:11 -0400)
commit3b83a7183c71395cdc70eacddce21f4d2d9d2b88
tree2f8579afb737317ffbd65309b39dbb4eee0bef5b
parent05902818236f65de43c48d60353f989530a5e7b9
crypto/x509/t_req.c: avoid exts leaking on error paths

If an error occurred and jump to the "err" label is performed after
exts has been allocated, it can leak.  Avoid that by adding
sk_X509_EXTENSION_pop_free() on the error path and setting exts to NULL
after sk_X509_EXTENSION_pop_free() in the normal handling.

Fixes: ae880ae6719e "Fix error handling in X509_REQ_print_ex"
Fixes: 87c49f622e7f "Support for parsing of certificate extensions in PKCS#10 requests: these are"
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665161
References: https://github.com/openssl/project/issues/1362
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28408)
crypto/x509/t_req.c