From a9c4bb0282185e900c45587ced4cecf38751e3eb Mon Sep 17 00:00:00 2001 From: Bernd Edlinger Date: Sun, 3 Dec 2023 11:41:51 +0100 Subject: [PATCH] Fix a possible memleak in opt_verify The ASN1_OBJECT otmp was leaked if X509_VERIFY_PARAM_add0_policy fails. Reviewed-by: Shane Lontis Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/22922) (cherry picked from commit d6688e45fa2f987f3ffd324e19922468beee5ddc) --- apps/lib/opt.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/apps/lib/opt.c b/apps/lib/opt.c index 157367982d2..d56964dbe7b 100644 --- a/apps/lib/opt.c +++ b/apps/lib/opt.c @@ -696,7 +696,12 @@ int opt_verify(int opt, X509_VERIFY_PARAM *vpm) opt_printf_stderr("%s: Invalid Policy %s\n", prog, opt_arg()); return 0; } - X509_VERIFY_PARAM_add0_policy(vpm, otmp); + if (!X509_VERIFY_PARAM_add0_policy(vpm, otmp)) { + ASN1_OBJECT_free(otmp); + opt_printf_stderr("%s: Internal error adding Policy %s\n", + prog, opt_arg()); + return 0; + } break; case OPT_V_PURPOSE: /* purpose name -> purpose index */ -- 2.47.2