From: Wietse Venema <wietse@porcupine.org>
Date: Sun, 26 Jul 2020 05:00:00 +0000 (-0500)
Subject: postfix-3.2.19
X-Git-Tag: v3.2.19^0
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b6b358ed429e9039f759f6b14606e7a006af44c3;p=thirdparty%2Fpostfix.git

postfix-3.2.19
---

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 3837b12c4..078e1105a 100644
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -23361,3 +23361,8 @@ Apologies for any names omitted.
 	settings in a system-wide OpenSSL configuration file, causing
 	interoperability problems after an OS update. File:
 	tls/tls_client.c, tls/tls_server.c.
+
+20200726
+
+	Bugfix (introduced: Postfix 3.3.13): part of a memory leak
+	fix was backported to the wrong place. File: tls/tls_misc.c.
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index e0d56a2f3..da770f4dd 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20200724"
-#define MAIL_VERSION_NUMBER	"3.2.18"
+#define MAIL_RELEASE_DATE	"20200726"
+#define MAIL_VERSION_NUMBER	"3.2.19"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff --git a/postfix/src/tls/tls_misc.c b/postfix/src/tls/tls_misc.c
index e401669e8..0673ff89f 100644
--- a/postfix/src/tls/tls_misc.c
+++ b/postfix/src/tls/tls_misc.c
@@ -961,8 +961,6 @@ void    tls_get_signature_params(TLS_SESS_STATE *TLScontext)
 	 */
 	if (SSL_get_signature_nid(ssl, &nid) && nid != NID_undef)
 	    locl_sig_dgst = OBJ_nid2sn(nid);
-
-	X509_free(cert);
     }
     /* Signature algorithms for the peer end of the connection */
     if ((cert = SSL_get_peer_certificate(ssl)) != 0) {
@@ -1004,6 +1002,8 @@ void    tls_get_signature_params(TLS_SESS_STATE *TLScontext)
 	 */
 	if (SSL_get_peer_signature_nid(ssl, &nid) && nid != NID_undef)
 	    peer_sig_dgst = OBJ_nid2sn(nid);
+
+	X509_free(cert);
     }
     if (kex_name) {
 	TLScontext->kex_name = mystrdup(kex_name);