From: Dr. David von Oheimb <David.von.Oheimb@siemens.com>
Date: Wed, 30 Dec 2020 08:46:38 +0000 (+0100)
Subject: d2i_X509(): Make deallocation behavior consistent with d2i_X509_AUX()
X-Git-Tag: openssl-3.0.0-alpha11~128
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3339606a38cc9023c807428b429e01cfa1fde4d9;p=thirdparty%2Fopenssl.git

d2i_X509(): Make deallocation behavior consistent with d2i_X509_AUX()

Partly fixes #13754

Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/13755)
---

diff --git a/crypto/x509/x_x509.c b/crypto/x509/x_x509.c
index b09fa2754ad..287b6c2a1ec 100644
--- a/crypto/x509/x_x509.c
+++ b/crypto/x509/x_x509.c
@@ -125,12 +125,16 @@ IMPLEMENT_ASN1_DUP_FUNCTION(X509)
 X509 *d2i_X509(X509 **a, const unsigned char **in, long len)
 {
     X509 *cert = NULL;
+    int free_on_error = a != NULL && *a == NULL;
 
     cert = (X509 *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, (X509_it()));
     /* Only cache the extensions if the cert object was passed in */
     if (cert != NULL && a != NULL) {
-        if (!x509v3_cache_extensions(cert))
+        if (!x509v3_cache_extensions(cert)) {
+            if (free_on_error)
+                X509_free(cert);
             cert = NULL;
+        }
     }
     return cert;
 }