apps/lib/tlssrp_depr.c: fix leak of vb in set_up_srp_verifier_file()

set_up_srp_verifier_file() allocates srp_callback_parm->vb via SRP_VBASE_new().
If SRP_VBASE_init() fails, vb must be freed before returning.

Additionally, add SRP_VBASE_free() to the end: cleanup path in s_server.c so
that vb is also freed on normal program exit.

Solves https://github.com/openssl/openssl/issues/30362
Fixes #30362

Signed-off-by: huanghuihui0904 <625173@qq.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Wed May 13 07:20:48 2026
(Merged from https://github.com/openssl/openssl/pull/30434)

diff --git a/apps/include/s_apps.h b/apps/include/s_apps.h
index 6432a2032a5fe6a8a8fa828f5f114a11152034f7..c46f6327e95d32c44bdbb7685be1b14061339162 100644 (file)
--- a/apps/include/s_apps.h
+++ b/apps/include/s_apps.h
@@ -113,6 +113,7 @@ typedef struct srpsrvparm_st {
 
 int set_up_srp_verifier_file(SSL_CTX *ctx, srpsrvparm *srp_callback_parm,
     char *srpuserseed, char *srp_verifier_file);
+void cleanup_srp(srpsrvparm *srp_callback_parm);
 void lookup_srp_user(srpsrvparm *srp_callback_parm, BIO *bio_s_out);
 #endif /* OPENSSL_NO_SRP */
 

diff --git a/apps/lib/tlssrp_depr.c b/apps/lib/tlssrp_depr.c
index cc36365748cb446f7aaaf0e3bac14a0762f30081..eb9f3a1814538b2f672d23628f12555581c45fe6 100644 (file)
--- a/apps/lib/tlssrp_depr.c
+++ b/apps/lib/tlssrp_depr.c
@@ -203,6 +203,8 @@ int set_up_srp_verifier_file(SSL_CTX *ctx, srpsrvparm *srp_callback_parm,
         BIO_printf(bio_err,
             "Cannot initialize SRP verifier file \"%s\":ret=%d\n",
             srp_verifier_file, ret);
+        SRP_VBASE_free(srp_callback_parm->vb);
+        srp_callback_parm->vb = NULL;
         return 0;
     }
     SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, verify_callback);
@@ -224,3 +226,11 @@ void lookup_srp_user(srpsrvparm *srp_callback_parm, BIO *bio_s_out)
     else
         BIO_puts(bio_s_out, "LOOKUP not successful\n");
 }
+
+void cleanup_srp(srpsrvparm *srp_callback_parm)
+{
+    SRP_user_pwd_free(srp_callback_parm->user);
+    srp_callback_parm->user = NULL;
+    SRP_VBASE_free(srp_callback_parm->vb);
+    srp_callback_parm->vb = NULL;
+}

diff --git a/apps/s_server.c b/apps/s_server.c
index e8f431cd0a76b8d5e890e7aacccdf3f4ca85734b..ebb8514fef3a4f71e78f0e137cefa5e334c70c7e 100644 (file)
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -3131,6 +3131,9 @@ int s_server_main(int argc, char *argv[])
     ret = 0;
 end:
     SSL_CTX_free(ctx);
+#ifndef OPENSSL_NO_SRP
+    cleanup_srp(&srp_callback_parm);
+#endif
     SSL_SESSION_free(psksess);
     set_keylog_file(NULL, NULL);
     X509_free(s_cert);