OpenSSL: Fix memory leak in subjectAltName parsing

The parsed data from X509_get_ext_d2i() needs to be freed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index e53b1b64187b40f62b66de9de86f6a186643dbff..a03d8d817eb3e079a521082b8cb80a23d0fe0af7 100644 (file)
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -1420,6 +1420,8 @@ static int tls_match_altsubject_component(X509 *cert, int type,
                        found++;
        }
 
+       sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
+
        return found;
 }
 
@@ -1532,9 +1534,11 @@ static int tls_match_suffix(X509 *cert, const char *match, int full)
                    1) {
                        wpa_printf(MSG_DEBUG, "TLS: %s in dNSName found",
                                   full ? "Match" : "Suffix match");
+                       sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
                        return 1;
                }
        }
+       sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
 
        if (dns_name) {
                wpa_printf(MSG_DEBUG, "TLS: None of the dNSName(s) matched");
@@ -1731,6 +1735,7 @@ static void openssl_tls_cert_event(struct tls_connection *conn,
                pos += gen->d.ia5->length;
                *pos = '\0';
        }
+       sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
 
        for (alt = 0; alt < num_altsubject; alt++)
                ev.peer_cert.altsubject[alt] = altsubject[alt];