romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 10:27:21 +03:00
Code Issues Projects Releases Packages Wiki Activity

wolfssl: fix resource leak in verify_pinned error paths

Browse source 
Pointed out by ZeroPath

Closes #19110
This commit is contained in:
Daniel Stenberg 2025-10-17 23:14:37 +02:00
parent e29706d6e2
commit c921f6d052
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 13 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

26
lib/vtls/wolfssl.c
View file

@ -1546,6 +1546,8 @@ CURLcode Curl_wssl_verify_pinned(struct Curl_cfilter *cf,
struct Curl_easy *data,
struct wssl_ctx *wssl)
{
WOLFSSL_X509 *x509 = NULL;
CURLcode result = CURLE_OK;
#ifndef CURL_DISABLE_PROXY
const char * const pinnedpubkey = Curl_ssl_cf_is_proxy(cf) ?
data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
@ -1557,50 +1559,48 @@ CURLcode Curl_wssl_verify_pinned(struct Curl_cfilter *cf,
if(pinnedpubkey) {
#ifdef KEEP_PEER_CERT
WOLFSSL_X509 *x509;
const char *x509_der;
int x509_der_len;
struct Curl_X509certificate x509_parsed;
struct Curl_asn1Element *pubkey;
CURLcode result;
result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
x509 = wolfSSL_get_peer_certificate(wssl->ssl);
if(!x509) {
failf(data, "SSL: failed retrieving server certificate");
return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
goto end;
}
x509_der = (const char *)wolfSSL_X509_get_der(x509, &x509_der_len);
if(!x509_der) {
failf(data, "SSL: failed retrieving ASN.1 server certificate");
return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
goto end;
}
memset(&x509_parsed, 0, sizeof(x509_parsed));
if(Curl_parseX509(&x509_parsed, x509_der, x509_der + x509_der_len))
return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
goto end;
pubkey = &x509_parsed.subjectPublicKeyInfo;
if(!pubkey->header || pubkey->end <= pubkey->header) {
failf(data, "SSL: failed retrieving public key from server certificate");
return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
goto end;
}
result = Curl_pin_peer_pubkey(data,
pinnedpubkey,
result = Curl_pin_peer_pubkey(data, pinnedpubkey,
(const unsigned char *)pubkey->header,
(size_t)(pubkey->end - pubkey->header));
wolfSSL_FreeX509(x509);
if(result) {
if(result)
failf(data, "SSL: public key does not match pinned public key");
return result;
}
#else
failf(data, "Library lacks pinning support built-in");
return CURLE_NOT_BUILT_IN;
#endif
}
return CURLE_OK;
end:
wolfSSL_FreeX509(x509);
return result;
}
#ifdef WOLFSSL_EARLY_DATA