]> git.ipfire.org Git - thirdparty/openssl.git/commit
crypto/x509/t_req.c: avoid exts leaking on error paths
authorEugene Syromiatnikov <esyr@openssl.org>
Mon, 1 Sep 2025 14:34:34 +0000 (16:34 +0200)
committerNeil Horman <nhorman@openssl.org>
Mon, 8 Sep 2025 20:56:58 +0000 (16:56 -0400)
commit58f1782b20654390836e991c538d7b5f80035daf
tree0fea50e7595e6c846181044934e39dfb57adcf37
parentfcb83e1fe49a370a979df3bc4ecfa2c28721293f
crypto/x509/t_req.c: avoid exts leaking on error paths

If an error occurred and jump to the "err" label is performed after
exts has been allocated, it can leak.  Avoid that by adding
sk_X509_EXTENSION_pop_free() on the error path and setting exts to NULL
after sk_X509_EXTENSION_pop_free() in the normal handling.

Fixes: ae880ae6719e "Fix error handling in X509_REQ_print_ex"
Fixes: 87c49f622e7f "Support for parsing of certificate extensions in PKCS#10 requests: these are"
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665161
References: https://github.com/openssl/project/issues/1362
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28407)
crypto/x509/t_req.c