Fix potential memory leak in BIO_get_accept_socket()

When BIO_parse_hostserv() fails it may still have allocated memory, yet
this memory is not freed. Fix it by jumping to the err label.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25817)

(cherry picked from commit 32476957ead4151dceaf873306fc7e79cd262812)

diff --git a/crypto/bio/bio_addr.c b/crypto/bio/bio_addr.c
index 5e0de089701503b83a9f66c38505b7ecdf186817..4367def8af76e73a1fadd67b60e7e74aa84f3fbe 100644 (file)
--- a/crypto/bio/bio_addr.c
+++ b/crypto/bio/bio_addr.c
@@ -571,8 +571,13 @@ int BIO_parse_hostserv(const char *hostserv, char **host, char **service,
             *service = NULL;
         } else {
             *service = OPENSSL_strndup(p, pl);
-            if (*service == NULL)
+            if (*service == NULL) {
+                if (h != NULL && host != NULL) {
+                    OPENSSL_free(*host);
+                    *host = NULL;
+                }
                 return 0;
+            }
         }
     }
 

diff --git a/crypto/bio/bio_sock.c b/crypto/bio/bio_sock.c
index ea28fd2826da9fd7b2913025275491b3faca1cd4..141b224e6e4614d09a3acd4aefd5aaf189831628 100644 (file)
--- a/crypto/bio/bio_sock.c
+++ b/crypto/bio/bio_sock.c
@@ -257,7 +257,7 @@ int BIO_get_accept_socket(char *host, int bind_mode)
         return INVALID_SOCKET;
 
     if (BIO_sock_init() != 1)
-        return INVALID_SOCKET;
+        goto err;
 
     if (BIO_lookup(h, p, BIO_LOOKUP_SERVER, AF_UNSPEC, SOCK_STREAM, &res) != 0)
         goto err;