From a6d7417f0ca6ac262493c76084fe5f2dafc936e9 Mon Sep 17 00:00:00 2001 From: Nikola Pajkovsky Date: Mon, 22 Sep 2025 12:17:16 +0200 Subject: [PATCH] x509: fix mem leak on error path The x509_store_add() creates X509_OBJECT wrapping either X509 or X509_CRL. However, if you set the type to X509_LU_NONE before X509_OBJECT_free then it skips the free on the wrapped type and just calls OPENSSL_free on the object itself. Hence, leaking wrapped object. Signed-off-by: Nikola Pajkovsky Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/28631) (cherry picked from commit 8a4ef31f3ab9c8e512d29600ccc833cf03533b9e) --- crypto/x509/x509_lu.c | 1 - 1 file changed, 1 deletion(-) diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c index d8927bda070..6959e9c24a1 100644 --- a/crypto/x509/x509_lu.c +++ b/crypto/x509/x509_lu.c @@ -374,7 +374,6 @@ static int x509_store_add(X509_STORE *store, void *x, int crl) { } if (!X509_STORE_lock(store)) { - obj->type = X509_LU_NONE; X509_OBJECT_free(obj); return 0; } -- 2.47.3