mod_ssl: Fix memory leak of OCSP stapling response.

The OCSP_RESPONSE is either ignored or serialized (i2d_OCSP_RESPONSE) in the
TLS response/handshake extension, so it must be freed.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1874574 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index d5d0b5eb16cba3087e873785040a53154fe80e83..7a0d10591168f5888c6e1142211bea808e3fc01a 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,8 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  *) mod_ssl: Fix memory leak of OCSP stapling response.  [Yann Ylavic]
+
   *) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
      PR64172.
 

diff --git a/modules/ssl/ssl_util_stapling.c b/modules/ssl/ssl_util_stapling.c
index 8bb6e7c6c0a4c2b36abbda1a341ce2f9e801581a..32a838a07a2e99c2d17fc03828faead3f23fb5e4 100644 (file)
--- a/modules/ssl/ssl_util_stapling.c
+++ b/modules/ssl/ssl_util_stapling.c
@@ -870,17 +870,25 @@ static int stapling_cb(SSL *ssl, void *arg)
         }
     }
 
-    if (rsp && ((ok == TRUE) || (mctx->stapling_return_errors == TRUE))) {
-        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01956)
-                     "stapling_cb: setting response");
-        if (!stapling_set_response(ssl, rsp))
-            return SSL_TLSEXT_ERR_ALERT_FATAL;
-        return SSL_TLSEXT_ERR_OK;
+    rv = SSL_TLSEXT_ERR_NOACK;
+    if (!rsp) {
+        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01957)
+                     "stapling_cb: no suitable response available");
     }
-    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01957)
-                 "stapling_cb: no suitable response available");
-
-    return SSL_TLSEXT_ERR_NOACK;
+    else {
+        if (ok == TRUE || mctx->stapling_return_errors == TRUE) {
+            ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01956)
+                         "stapling_cb: setting response");
+            if (!stapling_set_response(ssl, rsp)) {
+                rv = SSL_TLSEXT_ERR_ALERT_FATAL;
+            }
+            else {
+                rv = SSL_TLSEXT_ERR_OK;
+            }
+        }
+        OCSP_RESPONSE_free(rsp);
+    }
+    return rv;
 
 }