From f7aedca70e24e9a35f0cbd33d1aa708b4daf0055 Mon Sep 17 00:00:00 2001 From: Lev Stipakov Date: Thu, 17 Apr 2025 15:46:30 +0200 Subject: [PATCH] ssl_openssl.c: Prevent potential double-free Fixes a potential double-free issue in tls_ctx_load_cert_uri() by explicitly nullifying the pointer immediately after calling OSSL_STORE_INFO_free(info). This ensures that subsequent cleanup won't attempt to free the same structure again. Github: closes OpenVPN/openvpn#726 Change-Id: I4507be07cd5573b2117e837ef03187535a38a4b1 Signed-off-by: Lev Stipakov Acked-by: Antonio Quartulli Message-Id: <20250417134636.21279-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg31478.html Signed-off-by: Gert Doering --- src/openvpn/ssl_openssl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index d1d5d3e3c..f7be50c50 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -1152,6 +1152,7 @@ tls_ctx_load_cert_uri(struct tls_root_ctx *tls_ctx, const char *uri) goto end; } OSSL_STORE_INFO_free(info); + info = NULL; /* iterate through the store and add extra certificates if any to the chain */ while (!OSSL_STORE_eof(store_ctx)) @@ -1170,6 +1171,7 @@ tls_ctx_load_cert_uri(struct tls_root_ctx *tls_ctx, const char *uri) break; } OSSL_STORE_INFO_free(info); + info = NULL; } end: -- 2.47.3