Commit 9b7afcf5 authored by Jeff Trawick's avatar Jeff Trawick
Browse files

mod_ssl uses free() inappropriately in several places, to free 

memory which has been previously allocated inside OpenSSL.
Such memory should be freed with OPENSSL_free(), not with free().

Submitted by: Nadav Har'El <nyh@math.technion.ac.il>,
              Madhusudan Mathihalli <madhusudan_mathihalli@hp.com>
Reviewed by:  Jeff Trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/ssl@97307 13f79535-47bb-0310-9956-ffa450edef68
parent 966e75e2

ssl_engine_kernel.c

+5 −4
Changes for ssl_engine_kernel.c: 5 added lines, 4 removed lines.
Original line number Diff line number Diff line
@@ -968,7 +968,7 @@ int ssl_hook_UserCheck(request_rec *r) 
        X509_NAME *name = X509_get_subject_name(sslconn->client_cert);

        char *cp = X509_NAME_oneline(name, NULL, 0);

        sslconn->client_dn = apr_pstrdup(r->connection->pool, cp);

        free(cp);

        modssl_free(cp);

    }



    clientdn = (char *)sslconn->client_dn;
@@ -1299,11 +1299,11 @@ int ssl_callback_SSLVerify(int ok, X509_STORE_CTX *ctx) 
                     iname ? iname : "-unknown-");



        if (sname) {

            free(sname);

            modssl_free(sname);

        }



        if (iname) {

            free(iname);

            modssl_free(iname);

        }

    }
@@ -1555,7 +1555,7 @@ int ssl_callback_SSLVerify_CRL(int ok, X509_STORE_CTX *ctx, conn_rec *c) 
                                 "Certificate with serial %ld (0x%lX) "

                                 "revoked per CRL from issuer %s",

                                 serial, serial, cp);

                    free(cp);

                    modssl_free(cp);

                }



                X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REVOKED);
@@ -1593,6 +1593,7 @@ static void modssl_proxy_info_log(server_rec *s, 
    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,

                 SSLPROXY_CERT_CB_LOG_FMT "%s, sending %s", 

                 sc->vhost_id, msg, dn ? dn : "-uknown-");

    modssl_free(dn);

}



/*

ssl_engine_vars.c

+2 −2
Changes for ssl_engine_vars.c: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -334,7 +334,7 @@ static char *ssl_var_lookup_ssl_cert(apr_pool_t *p, X509 *xs, char *var) 
        xsname = X509_get_subject_name(xs);

        cp = X509_NAME_oneline(xsname, NULL, 0);

        result = apr_pstrdup(p, cp);

        free(cp);

        modssl_free(cp);

        resdup = FALSE;

    }

    else if (strlen(var) > 5 && strcEQn(var, "S_DN_", 5)) {
@@ -346,7 +346,7 @@ static char *ssl_var_lookup_ssl_cert(apr_pool_t *p, X509 *xs, char *var) 
        xsname = X509_get_issuer_name(xs);

        cp = X509_NAME_oneline(xsname, NULL, 0);

        result = apr_pstrdup(p, cp);

        free(cp);

        modssl_free(cp);

        resdup = FALSE;

    }

    else if (strlen(var) > 5 && strcEQn(var, "I_DN_", 5)) {

ssl_toolkit_compat.h

+4 −0
Changes for ssl_toolkit_compat.h: 4 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -105,6 +105,8 @@ 


#define modssl_set_cipher_list SSL_set_cipher_list



#define modssl_free OPENSSL_free



#define EVP_PKEY_reference_inc(pkey) \

   CRYPTO_add(&((pkey)->references), +1, CRYPTO_LOCK_X509_PKEY)
@@ -148,6 +150,8 @@ 
#define modssl_set_cipher_list(ssl, l) \

   SSL_set_cipher_list(ssl, (char *)l)



#define modssl_free free



#ifndef PEM_F_DEF_CALLBACK

#define PEM_F_DEF_CALLBACK PEM_F_DEF_CB

#endif