diff mbox series

[Openvpn-devel,v1] ssl_openssl: free what PKCS12_parse() returns

Message ID 20261113161309.24472-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] ssl_openssl: free what PKCS12_parse() returns |

Commit Message

Gert Doering Nov. 13, 2026, 4:13 p.m. UTC 
  From: Razvan Cojocaru <razvanc@mailbox.org>

tls_ctx_load_pkcs12() never released its references to the
certificate, key and CA stack, leaking them on every SSL context
setup. The context takes its own references, except for extra chain
certificates, which it takes over.

Change-Id: I387f652ecba92283a272610ff0780273c4902996
Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2183
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2183
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Frank Lichtenheld <frank@lichtenheld.com>
diff mbox series

Patch

diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c
index fe2bfda..bb51d96 100644
--- a/src/openvpn/ssl_openssl.c
+++ b/src/openvpn/ssl_openssl.c
@@ -1009,6 +1009,7 @@ 
                 }
             }
         }
+        sk_X509_pop_free(ca, X509_free);
     }
     else
     {
@@ -1029,7 +1030,11 @@ 
                 }
             }
         }
+        /* the certs now belong to ctx */
+        sk_X509_free(ca);
     }
+    X509_free(cert);
+    EVP_PKEY_free(pkey);
     return 0;
 }