From: Nalin Dahyabhai Date: Thu, 11 Jul 2013 02:17:58 +0000 (-0400) Subject: Don't leak PKINIT CMS signed data certs and CRLs X-Git-Tag: krb5-1.12-alpha1~104 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=04444a2606e3db92e66d74e29bef9103452f2cee;p=thirdparty%2Fkrb5.git Don't leak PKINIT CMS signed data certs and CRLs The stacks of certificates and CRLs that we retrieve from CMS objects include newly-owned references to the certificates and CRLs, so when we go to free them, we need to remember to free those. [ghudson@mit.edu: minor formatting change; removed unrelated style fix] --- diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c index ae4efc343b..29c4f5755b 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c @@ -177,8 +177,10 @@ pkinit_pkcs11_code_to_text(int err); #include #define pkinit_CMS_get0_content_signed(_cms) CMS_get0_content(_cms) #define pkinit_CMS_get0_content_data(_cms) CMS_get0_content(_cms) -#define pkinit_CMS_free1_crls(_sk_x509crl) sk_X509_CRL_free((_sk_x509crl)) -#define pkinit_CMS_free1_certs(_sk_x509) sk_X509_free((_sk_x509)) +#define pkinit_CMS_free1_crls(_sk_x509crl) \ + sk_X509_CRL_pop_free((_sk_x509crl), X509_CRL_free) +#define pkinit_CMS_free1_certs(_sk_x509) \ + sk_X509_pop_free((_sk_x509), X509_free) #define pkinit_CMS_SignerInfo_get_cert(_cms,_si,_x509_pp) \ CMS_SignerInfo_get0_algs(_si,NULL,_x509_pp,NULL,NULL) #else