]> git.ipfire.org Git - thirdparty/openssl.git/commit
crypto/x509/t_req.c: avoid exts leaking on error paths
authorEugene Syromiatnikov <esyr@openssl.org>
Mon, 1 Sep 2025 14:34:34 +0000 (16:34 +0200)
committerNeil Horman <nhorman@openssl.org>
Wed, 3 Sep 2025 11:47:34 +0000 (07:47 -0400)
commit71c8e2baa3b9f1a6b1a545b874782ccbd7ed02fc
tree5bde8f7522991d83e999a89a8e2933e87dcf0062
parent146889381ab353a8769f85288f45cc3580ffc50f
crypto/x509/t_req.c: avoid exts leaking on error paths

If an error occurred and jump to the "err" label is performed after
exts has been allocated, it can leak.  Avoid that by adding
sk_X509_EXTENSION_pop_free() on the error path and setting exts to NULL
after sk_X509_EXTENSION_pop_free() in the normal handling.

Fixes: ae880ae6719e "Fix error handling in X509_REQ_print_ex"
Fixes: 87c49f622e7f "Support for parsing of certificate extensions in PKCS#10 requests: these are"
Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1665161
References: https://github.com/openssl/project/issues/1362
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28405)
crypto/x509/t_req.c