From d19a0394723440eea452d519566667d0e52bd5d0 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Fri, 24 Apr 2026 16:27:34 +0200 Subject: [PATCH] mbedtls: cleanup more without care for 'initialized' Several mbedTLS resources (entropy/CTR-DRBG, CA/client certs, keys, CRL) are initialized and may allocate memory before initialized is set, and must still be cleaned up. Follow-up to 1c4813c769ea65c128c067004 Caught by Codex Security Closes #21440 --- lib/vtls/mbedtls.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c index b4c58afa88..6f90f44cb2 100644 --- a/lib/vtls/mbedtls.c +++ b/lib/vtls/mbedtls.c @@ -1355,15 +1355,15 @@ static void mbedtls_close(struct Curl_cfilter *cf, struct Curl_easy *data) (void)data; DEBUGASSERT(backend); - if(backend->initialized) { - mbedtls_pk_free(&backend->pk); - mbedtls_x509_crt_free(&backend->clicert); - mbedtls_x509_crt_free(&backend->cacert); + mbedtls_pk_free(&backend->pk); + mbedtls_x509_crt_free(&backend->clicert); + mbedtls_x509_crt_free(&backend->cacert); #ifdef MBEDTLS_X509_CRL_PARSE_C - mbedtls_x509_crl_free(&backend->crl); + mbedtls_x509_crl_free(&backend->crl); #endif - curlx_safefree(backend->ciphersuites); - mbedtls_ssl_config_free(&backend->config); + curlx_safefree(backend->ciphersuites); + mbedtls_ssl_config_free(&backend->config); + if(backend->initialized) { mbedtls_ssl_free(&backend->ssl); backend->initialized = FALSE; }