From: Alexander Bainbridge-Sedivy <alex.bainbridge@inkbridge.io>
Date: Mon, 20 Jul 2026 13:39:43 +0000 (-0400)
Subject: lib/tls/virtual_server: detach child on all fr_tls_call_push failure paths (double... 
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=400703beeb1270fcf148eeb8e99f11033782d41b;p=thirdparty%2Ffreeradius-server.git

lib/tls/virtual_server: detach child on all fr_tls_call_push failure paths (double-free)
---

diff --git a/src/lib/tls/virtual_server.c b/src/lib/tls/virtual_server.c
index 60f34b4f449..59fe54ef327 100644
--- a/src/lib/tls/virtual_server.c
+++ b/src/lib/tls/virtual_server.c
@@ -67,6 +67,7 @@ unlang_action_t fr_tls_call_push(request_t *child, unlang_function_no_result_t r
 	if (unlang_subrequest_child_push(NULL, child,
 					 tls_session,
 					 true, UNLANG_SUB_FRAME) < 0) {
+		request_detach(child);
 		return UNLANG_ACTION_FAIL;
 	}
 
@@ -79,7 +80,10 @@ unlang_action_t fr_tls_call_push(request_t *child, unlang_function_no_result_t r
 				 resume,
 				 NULL,
 				 0, UNLANG_SUB_FRAME,
-				 tls_session) < 0) return UNLANG_ACTION_FAIL;
+				 tls_session) < 0) {
+		request_detach(child);
+		return UNLANG_ACTION_FAIL;
+	}
 
 	/*
 	 *	Now the child and parent stacks are both