From: Neil Horman <nhorman@openssl.org>
Date: Wed, 13 Aug 2025 14:12:38 +0000 (-0400)
Subject: Add CRYPTO_FREE_REF to ossl_quic_free_token_store
X-Git-Tag: openssl-3.5.3~66
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7ba09090bca8a8f4d9677f0f7fd6934b64cf2dc4;p=thirdparty%2Fopenssl.git

Add CRYPTO_FREE_REF to ossl_quic_free_token_store

ossl_quic_free_token_store doesn't call CRYPTO_FREE_REF on the
hdl->reference object, which could lead to memory leaks on platforms
that don't support atomics (where the call to CRYPTO_NEW_REF allocates a
mutex as part of its function.  It wasn't caught before because all the
platforms we do ci on support threads.

Fixes #28241

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28247)

(cherry picked from commit d2a71ed94e82f96a589fbc017d525d415b427337)
---

diff --git a/ssl/quic/quic_impl.c b/ssl/quic/quic_impl.c
index 5ad5a79157f..c44e6b33c2a 100644
--- a/ssl/quic/quic_impl.c
+++ b/ssl/quic/quic_impl.c
@@ -4769,6 +4769,7 @@ void ossl_quic_free_token_store(SSL_TOKEN_STORE *hdl)
     ossl_crypto_mutex_free(&hdl->mutex);
     lh_QUIC_TOKEN_doall(hdl->cache, free_this_token);
     lh_QUIC_TOKEN_free(hdl->cache);
+    CRYPTO_FREE_REF(&hdl->references);
     OPENSSL_free(hdl);
     return;
 }