From: Dr. David von Oheimb <David.von.Oheimb@siemens.com>
Date: Fri, 10 Feb 2023 08:53:43 +0000 (+0100)
Subject: CMS_add1_crl(): prevent double free on failure of CMS_add0_crl()
X-Git-Tag: openssl-3.2.0-alpha1~1232
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6f9e531003fd736e8e96d9a1a57f7763da9722b8;p=thirdparty%2Fopenssl.git

CMS_add1_crl(): prevent double free on failure of CMS_add0_crl()

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19199)
---

diff --git a/crypto/cms/cms_lib.c b/crypto/cms/cms_lib.c
index b5a4b315a3a..2744306959e 100644
--- a/crypto/cms/cms_lib.c
+++ b/crypto/cms/cms_lib.c
@@ -620,11 +620,12 @@ int CMS_add0_crl(CMS_ContentInfo *cms, X509_CRL *crl)
 
 int CMS_add1_crl(CMS_ContentInfo *cms, X509_CRL *crl)
 {
-    int r;
-    r = CMS_add0_crl(cms, crl);
-    if (r > 0)
-        X509_CRL_up_ref(crl);
-    return r;
+    if (!X509_CRL_up_ref(crl))
+        return 0;
+    if (CMS_add0_crl(cms, crl))
+        return 1;
+    X509_CRL_free(crl);
+    return 0;
 }
 
 STACK_OF(X509) *CMS_get1_certs(CMS_ContentInfo *cms)