Commit 7a433893 authored by David Benjamin's avatar David Benjamin Committed by Dr. Stephen Henson
Browse files

Fix memory leak on invalid CertificateRequest. 



Free up parsed X509_NAME structure if the CertificateRequest message
contains excess data.

The security impact is considered insignificant. This is a client side
only leak and a large number of connections to malicious servers would
be needed to have a significant impact.

This was found by libFuzzer.

Reviewed-by: default avatarEmilia Käsper <emilia@openssl.org>
Reviewed-by: default avatarStephen Henson <steve@openssl.org>
(cherry picked from commit ec66c8c9)
parent f4bed7c7

ssl/s3_clnt.c

+2 −0
Original line number Diff line number Diff line
@@ -2104,6 +2104,7 @@ int ssl3_get_certificate_request(SSL *s) 
            SSLerr(SSL_F_SSL3_GET_CERTIFICATE_REQUEST, ERR_R_MALLOC_FAILURE);

            goto err;

        }

        xn = NULL;



        p += l;

        nc += l + 2;
@@ -2127,6 +2128,7 @@ int ssl3_get_certificate_request(SSL *s) 
 err:

    s->state = SSL_ST_ERR;

 done:

    X509_NAME_free(xn);

    if (ca_sk != NULL)

        sk_X509_NAME_pop_free(ca_sk, X509_NAME_free);

    return (ret);