From 04444a2606e3db92e66d74e29bef9103452f2cee Mon Sep 17 00:00:00 2001 From: Nalin Dahyabhai Date: Wed, 10 Jul 2013 22:17:58 -0400 Subject: [PATCH] Don't leak PKINIT CMS signed data certs and CRLs The stacks of certificates and CRLs that we retrieve from CMS objects include newly-owned references to the certificates and CRLs, so when we go to free them, we need to remember to free those. [ghudson@mit.edu: minor formatting change; removed unrelated style fix] --- src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c index ae4efc343b..29c4f5755b 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c @@ -177,8 +177,10 @@ pkinit_pkcs11_code_to_text(int err); #include #define pkinit_CMS_get0_content_signed(_cms) CMS_get0_content(_cms) #define pkinit_CMS_get0_content_data(_cms) CMS_get0_content(_cms) -#define pkinit_CMS_free1_crls(_sk_x509crl) sk_X509_CRL_free((_sk_x509crl)) -#define pkinit_CMS_free1_certs(_sk_x509) sk_X509_free((_sk_x509)) +#define pkinit_CMS_free1_crls(_sk_x509crl) \ + sk_X509_CRL_pop_free((_sk_x509crl), X509_CRL_free) +#define pkinit_CMS_free1_certs(_sk_x509) \ + sk_X509_pop_free((_sk_x509), X509_free) #define pkinit_CMS_SignerInfo_get_cert(_cms,_si,_x509_pp) \ CMS_SignerInfo_get0_algs(_si,NULL,_x509_pp,NULL,NULL) #else -- 2.47.2