From 961c95fea6e097ef4dbc19ee996e5127e58acbac Mon Sep 17 00:00:00 2001 From: Fred Klassen Date: Thu, 20 Aug 2026 09:03:11 -0700 Subject: [PATCH] openssl: fix DER buffer leak in Apple SecTrust verification `ossl_chain_get_der()` allocates a DER encoding of each peer certificate via `i2d_X509()`, but `Curl_vtls_apple_verify()` only copies it into a CFData and never frees the original. This leaks per certificate, per handshake, whenever USE_APPLE_SECTRUST is used with the OpenSSL/LibreSSL/BoringSSL backend. Fix frees the buffer inside openssl.c itself, so the GnuTLS backend (which borrows rather than allocates) is unaffected. Closes #22631 --- lib/vtls/openssl.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c index 0740c32fbb..802f3da862 100644 --- a/lib/vtls/openssl.c +++ b/lib/vtls/openssl.c @@ -4669,6 +4669,7 @@ out: struct ossl_certs_ctx { STACK_OF(X509) *sk; size_t num_certs; + unsigned char *last_der; }; static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf, @@ -4682,6 +4683,9 @@ static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf, X509 *cert; int der_len; + OPENSSL_free(chain->last_der); + chain->last_der = NULL; + (void)cf; (void)data; *pder_len = 0; @@ -4695,6 +4699,7 @@ static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf, der_len = i2d_X509(cert, pder); if(der_len < 0) return CURLE_FAILED_INIT; + chain->last_der = *pder; *pder_len = (size_t)der_len; return CURLE_OK; } @@ -4748,6 +4753,8 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf, result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs, ossl_chain_get_der, &chain, ocsp_data, ocsp_len); + OPENSSL_free(chain.last_der); + chain.last_der = NULL; if(!result && ocsp_missing && conn_config->verifystatus && !octx->reused_session) { /* verified, but OCSP stapling is required and server sent none */