Commit df83a40a authored by Eric Covener's avatar Eric Covener
Browse files

Merge r1666297 from trunk: 

ssl_util: Fix possible crash (free => OPENSSL_free) and error path leaks when
checking the server certificate constraints (SSL_X509_getBC()).



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1673940 13f79535-47bb-0310-9956-ffa450edef68
parent c2e15e29

CHANGES

+7 −0
Changes for CHANGES: 7 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -12,6 +12,13 @@ Changes with Apache 2.4.13 
     calls r:wsupgrade() can cause a child process crash. 

     [Edward Lu <Chaosed0 gmail.com>]



  *) mod_ssl: Fix possible crash when loading server certificate constraints.

     PR 57694. [Paul Spangler <paul.spangler ni com>, Yann Ylavic]



  *) core, modules: Avoid error response/document handling by the core if some

     handler or input filter already did it while reading the request (causing

     a double response body).  [Yann Ylavic]



  *) build: Don't load mod_cgi and mod_cgid in the default configuration

     if they're both built.  [olli hauer <ohauer gmx.de>]

STATUS

+0 −6
Changes for STATUS: 0 added lines, 6 removed lines.
Original line number Diff line number Diff line
@@ -105,12 +105,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) mod_ssl: Fix possible crash when loading server certificate constraints.

     PR 57694.

     trunk patch: http://svn.apache.org/r1666297

     2.4.x patch: trunk works (modulo CHANGES)

     +1: ylavic, rjung, trawick



  *) mod_proxy: Use the correct server name for SNI in case the backend

     SSL connection itself is established via a proxy server.  PR 57139

     trunk patch: http://svn.apache.org/r1634120

modules/ssl/ssl_util_ssl.c

+8 −3
Changes for modules/ssl/ssl_util_ssl.c: 8 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -173,12 +173,17 @@ BOOL SSL_X509_getBC(X509 *cert, int *ca, int *pathlen) 
    *ca = bc->ca;

    *pathlen = -1 /* unlimited */;

    if (bc->pathlen != NULL) {

        if ((bn = ASN1_INTEGER_to_BN(bc->pathlen, NULL)) == NULL)

        if ((bn = ASN1_INTEGER_to_BN(bc->pathlen, NULL)) == NULL) {

            BASIC_CONSTRAINTS_free(bc);

            return FALSE;

        if ((cp = BN_bn2dec(bn)) == NULL)

        }

        if ((cp = BN_bn2dec(bn)) == NULL) {

            BN_free(bn);

            BASIC_CONSTRAINTS_free(bc);

            return FALSE;

        }

        *pathlen = atoi(cp);

        free(cp);

        OPENSSL_free(cp);

        BN_free(bn);

    }

    BASIC_CONSTRAINTS_free(bc);