romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 06:43:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

openssl: fix DER buffer leak in Apple SecTrust verification

Browse source 
`ossl_chain_get_der()` allocates a DER encoding of each peer certificate
via `i2d_X509()`, but `Curl_vtls_apple_verify()` only copies it into a
CFData and never frees the original. This leaks per certificate, per
handshake, whenever USE_APPLE_SECTRUST is used with the
OpenSSL/LibreSSL/BoringSSL backend.

Fix frees the buffer inside openssl.c itself, so the GnuTLS backend
(which borrows rather than allocates) is unaffected.

Closes #22631
This commit is contained in:
Fred Klassen 2026-08-20 09:03:11 -07:00 • committed by Daniel Stenberg
parent 2ba2fe3540
commit 961c95fea6
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/vtls/openssl.c
View file

@ -4669,6 +4669,7 @@ out:
struct ossl_certs_ctx {
STACK_OF(X509) *sk;
size_t num_certs;
unsigned char *last_der;
};
static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf,
@ -4682,6 +4683,9 @@ static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf,
X509 *cert;
int der_len;
OPENSSL_free(chain->last_der);
chain->last_der = NULL;
(void)cf;
(void)data;
*pder_len = 0;
@ -4695,6 +4699,7 @@ static CURLcode ossl_chain_get_der(struct Curl_cfilter *cf,
der_len = i2d_X509(cert, pder);
if(der_len < 0)
return CURLE_FAILED_INIT;
chain->last_der = *pder;
*pder_len = (size_t)der_len;
return CURLE_OK;
}
@ -4748,6 +4753,8 @@ static CURLcode ossl_apple_verify(struct Curl_cfilter *cf,
result = Curl_vtls_apple_verify(cf, data, peer, chain.num_certs,
ossl_chain_get_der, &chain,
ocsp_data, ocsp_len);
OPENSSL_free(chain.last_der);
chain.last_der = NULL;
if(!result && ocsp_missing && conn_config->verifystatus &&
!octx->reused_session) {
/* verified, but OCSP stapling is required and server sent none */