Fix potential memory leak in BIO_get_accept_socket()

When BIO_parse_hostserv() fails it may still have allocated memory, yet
this memory is not freed. Fix it by jumping to the err label.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25817)

(cherry picked from commit 32476957ead4151dceaf873306fc7e79cd262812)

diff --git a/crypto/bio/bio_addr.c b/crypto/bio/bio_addr.c
index 77cb4395743ee8657e4547bf24c2349f6bfb1825..5852e9fe9e79167e584fd696aafb6e03edd71cda 100644 (file)
--- a/crypto/bio/bio_addr.c
+++ b/crypto/bio/bio_addr.c
@@ -547,8 +547,13 @@ int BIO_parse_hostserv(const char *hostserv, char **host, char **service,
             *service = NULL;
         } else {
             *service = OPENSSL_strndup(p, pl);
-            if (*service == NULL)
+            if (*service == NULL) {
+                if (h != NULL && host != NULL) {
+                    OPENSSL_free(*host);
+                    *host = NULL;
+                }
                 goto memerr;
+            }
         }
     }
 

diff --git a/crypto/bio/bio_sock.c b/crypto/bio/bio_sock.c
index 12e6a68e3a25d82f17def02e4b9d6544318b471b..bb536379dc56fc3d357b5bed5092f56474f68599 100644 (file)
--- a/crypto/bio/bio_sock.c
+++ b/crypto/bio/bio_sock.c
@@ -222,7 +222,7 @@ int BIO_get_accept_socket(char *host, int bind_mode)
         return INVALID_SOCKET;
 
     if (BIO_sock_init() != 1)
-        return INVALID_SOCKET;
+        goto err;
 
     if (BIO_lookup(h, p, BIO_LOOKUP_SERVER, AF_UNSPEC, SOCK_STREAM, &res) != 0)
         goto err;