diff options
| author | Kenny Root <kroot@google.com> | 2013-09-09 18:43:37 -0700 |
|---|---|---|
| committer | Kenny Root <kroot@google.com> | 2013-09-09 19:18:05 -0700 |
| commit | bb8428f762b3632f493572c4f73957e1281ade79 (patch) | |
| tree | fa1d8a0214c1fa98f59569b9bd1e60ed34b49c84 | |
| parent | afd3666daae38a89eb3369a19dfd171fb82c2979 (diff) | |
| download | replicant_openssl-bb8428f762b3632f493572c4f73957e1281ade79.zip replicant_openssl-bb8428f762b3632f493572c4f73957e1281ade79.tar.gz replicant_openssl-bb8428f762b3632f493572c4f73957e1281ade79.tar.bz2 | |
Fix leak in setting certificate chain patch
Android has a custom certificate chain patch that didn't check whether
the cert_chain was already set when setting the new chain. This results
in a leak of all the X509 instances in the stack of certificates.
Bug: 10610037
Change-Id: I62433671ef18b06cafa5ec18e7b2e6190ce4504d
| -rw-r--r-- | patches/jsse.patch | 4 | ||||
| -rw-r--r-- | ssl/ssl_rsa.c | 2 |
2 files changed, 5 insertions, 1 deletions
diff --git a/patches/jsse.patch b/patches/jsse.patch index e4fa3b4..795a2bb 100644 --- a/patches/jsse.patch +++ b/patches/jsse.patch @@ -352,7 +352,7 @@ --- openssl-1.0.0b.orig/ssl/ssl_rsa.c 2009-09-12 23:09:26.000000000 +0000 +++ openssl-1.0.0b/ssl/ssl_rsa.c 2010-11-30 00:03:47.000000000 +0000 -@@ -697,6 +697,42 @@ int SSL_CTX_use_PrivateKey_ASN1(int type +@@ -697,6 +697,44 @@ int SSL_CTX_use_PrivateKey_ASN1(int type } @@ -373,6 +373,8 @@ + SSLerr(SSL_F_SSL_USE_CERTIFICATE_CHAIN,SSL_R_NO_CERTIFICATE_ASSIGNED); + return(0); + } ++ if (ssl->cert->key->cert_chain != NULL) ++ sk_X509_pop_free(ssl->cert->key->cert_chain, X509_free); + ssl->cert->key->cert_chain = cert_chain; + return(1); + } diff --git a/ssl/ssl_rsa.c b/ssl/ssl_rsa.c index 82f55b6..e98e862 100644 --- a/ssl/ssl_rsa.c +++ b/ssl/ssl_rsa.c @@ -714,6 +714,8 @@ int SSL_use_certificate_chain(SSL *ssl, STACK_OF(X509) *cert_chain) SSLerr(SSL_F_SSL_USE_CERTIFICATE_CHAIN,SSL_R_NO_CERTIFICATE_ASSIGNED); return(0); } + if (ssl->cert->key->cert_chain != NULL) + sk_X509_pop_free(ssl->cert->key->cert_chain, X509_free); ssl->cert->key->cert_chain = cert_chain; return(1); } |