Fix potential memory leak in BIO_get_accept_socket()

When BIO_parse_hostserv() fails it may still have allocated memory, yet
this memory is not freed. Fix it by jumping to the err label.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25817)

diff --git a/crypto/bio/bio_addr.c b/crypto/bio/bio_addr.c
index 4b2cef6936e13eceb298e6b22506b4d491ad1396..568c0b4a1f8fd05ce70ccaf8d1c02e11c0b55db2 100644 (file)
--- a/crypto/bio/bio_addr.c
+++ b/crypto/bio/bio_addr.c
@@ -571,8 +571,13 @@ int BIO_parse_hostserv(const char *hostserv, char **host, char **service,
             *service = NULL;
         } else {
             *service = OPENSSL_strndup(p, pl);
-            if (*service == NULL)
+            if (*service == NULL) {
+                if (h != NULL && host != NULL) {
+                    OPENSSL_free(*host);
+                    *host = NULL;
+                }
                 return 0;
+            }
         }
     }
 

diff --git a/crypto/bio/bio_sock.c b/crypto/bio/bio_sock.c
index 3ea122e2b95934a8d7595cc0de239302b9a45e3b..22dbf38b00b0d05192c636ce896a9634749c9ccb 100644 (file)
--- a/crypto/bio/bio_sock.c
+++ b/crypto/bio/bio_sock.c
@@ -259,7 +259,7 @@ int BIO_get_accept_socket(char *host, int bind_mode)
         return INVALID_SOCKET;
 
     if (BIO_sock_init() != 1)
-        return INVALID_SOCKET;
+        goto err;
 
     if (BIO_lookup(h, p, BIO_LOOKUP_SERVER, AF_UNSPEC, SOCK_STREAM, &res) != 0)
         goto err;