961c95fea6
Fred Klassen
2026-08-21
Subject
openssl: fix DER buffer leak in Apple SecTrust verification
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/vtls/openssl.c+7 -0
| @@ -4669,6 +4669,7 @@ out: | |
| struct ossl_certs_ctx { | |
| STACK_OF(X509) *sk; | |
| size_t num_certs; | |
| + | unsigned char *last_der; |
| }; | |
| static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf, | |
| @@ -4682,6 +4683,9 @@ static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf, | |
| X509 *cert; | |
| int der_len; | |
| + | OPENSSL_free(chain->last_der); |
| + | chain->last_der = NULL; |
| + | |
| (void)cf; | |
| (void)data; | |
| *pder_len = 0; | |
| @@ -4695,6 +4699,7 @@ static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf, | |
| der_len = i2d_X509(cert, pder); | |
| if(der_len < 0) | |
| return CURLE_FAILED_INIT; | |
| + | chain->last_der = *pder; |
| *pder_len = (size_t)der_len; | |
| return CURLE_OK; | |
| } | |
| @@ -4748,6 +4753,8 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf, | |
| result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs, | |
| ossl_chain_get_der, &chain, | |
| ocsp_data, ocsp_len); | |
| + | OPENSSL_free(chain.last_der); |
| + | chain.last_der = NULL; |
| if(!result && ocsp_missing && conn_config->verifystatus && | |
| !octx->reused_session) { | |
| /* verified, but OCSP stapling is required and server sent none */ | |