res_rtp_asterisk: Don't leak temporary key when enabling PFS.

A change recently went in which enabled perfect forward secrecy for
DTLS in res_rtp_asterisk. This was accomplished two different ways
depending on the availability of a feature in OpenSSL. The fallback
method created a temporary instance of a key but did not free it.
This change fixes that.

ASTERISK-25265

Change-Id: Iadc031b67a91410bbefb17ffb4218d615d051396

diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index d3c704c25d62d5cba80a8ce2593ce59e4af3e5aa..6f7f94a0c1f60599cf629e0b5f7c5aabaab3c9ec 100644 (file)
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -1254,6 +1254,9 @@ static int ast_rtp_dtls_set_configuration(struct ast_rtp_instance *instance, con
 {
        struct ast_rtp *rtp = ast_rtp_instance_get_data(instance);
        int res;
+#ifndef HAVE_OPENSSL_ECDH_AUTO
+       EC_KEY *ecdh;
+#endif
 
        if (!dtls_cfg->enabled) {
                return 0;
@@ -1273,8 +1276,11 @@ static int ast_rtp_dtls_set_configuration(struct ast_rtp_instance *instance, con
 #ifdef HAVE_OPENSSL_ECDH_AUTO
        SSL_CTX_set_ecdh_auto(rtp->ssl_ctx, 1);
 #else
-       SSL_CTX_set_tmp_ecdh(rtp->ssl_ctx,
-               EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
+       ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+       if (ecdh) {
+               SSL_CTX_set_tmp_ecdh(rtp->ssl_ctx, ecdh);
+               EC_KEY_free(ecdh);
+       }
 #endif
 
        rtp->dtls_verify = dtls_cfg->verify;