From patchwork Fri Nov 13 16:13:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5690 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:18c:b0:11a:a05e:cb97 with SMTP id 12csp408438lag; Fri, 13 Nov 2026 08:13:23 -0800 (PST) X-Forwarded-Encrypted: i=2; AL+hErFgdOsUczMo+24B8UyBFAGYAtc83QrNkMf+kHIFCehRsz2wz6GtCPO6mF6hOtzYHtjOn7TDXqDRAB0=@openvpn.net X-Received: by 2002:a05:6820:a08c:b0:6f8:92ab:bb3b with SMTP id 006d021491bc7-71ab51eaec6mr1484621eaf.79.1794586402728; Fri, 13 Nov 2026 08:13:22 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1794586402; cv=none; d=google.com; s=arc-20260327; b=pVo7YtjbUGrzvBtgqkyuhIXReytaCSgtm7h5teOJAqj8TQHUxf3kx3Si7bbNJHcoZe rHpU30AlWYg/TIABE7sDRv3vtOA0C5qxihyNJwukxcRobRLwJNc1XYVNisGcmyDNFI0C m65en3R9TmJiY5YzNOz/aWQn3uifKiSxHkCw9DQdl+ixOqzUvTetoO1U0RzPGLxt5iyR wrTNlnAGAAhKnvNr4Jms9WXBVd9ecD5gHYdsAHSvdfg950c6EFUwZ8WAh1XrV6Y9LG99 NB4F/okgof3mCQ/PV/DUmj0OK6eEKrhASM3Q0nhr/UeIpuRTj4HFL5BIwQeMpdVAjrQi ip3A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=2V7WyquN8CcgZKs72yUnesuwjNXkJ05nqEtlzVGQgPQ=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=KOJDDNMjhrb0Xp/BnhFSt8BGh3uoP9Z900MMvugwntts8I91twp1uWJbvDea7jf3CJ ppWppxFxYahDW9AM3G4g60vBD6BOHibWN0pJApx01cKLWULSMRV5N60P8gd7YYo9cny0 LiC9Ye3NgocPftwAXjWb7UJjr43FCbqcuzSPMYUEz1pmjP73alPtp1WMB+e9SbeQCZoQ 6RcBC8N+gjZ2UPKsFc0lZdSONW8i5b66xDX0kklUEdDh5w/9nQntBICiyArxQDzBEJ32 4p7zysfbHMMcw11ZeBgSQWuLNtem1FPJcRAADYWRaagLZj+L/zuK93DjRkiqOLDAOPHM IqQw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=ReywhTCZ; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=dk1UiWZ7; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=lSuDQGwL; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 46e09a7af769-86287f0df5csi5046240a34.19.2026.11.13.08.13.22 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 13 Nov 2026 08:13:22 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=ReywhTCZ; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=dk1UiWZ7; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=lSuDQGwL; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=2V7WyquN8CcgZKs72yUnesuwjNXkJ05nqEtlzVGQgPQ=; b=ReywhTCZduHRDc 4Xk8TRcapz7SU19TqOudiOzoM4uwCqAv39Ke5loxrbSdpQvtzbZorLk366n9w5s9O6fva0tBhHaMG Gek2diz9g5eNwtHy12o9iwY8THykVOMSQdkheruCo2JCqGgjgn+J/yFJ/V4cudnTJU7dMM/idRGWV Hj0=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xRttv-000000006Dy-3zmq; Fri, 13 Nov 2026 16:13:19 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xRttu-000000006Dk-1LJq for openvpn-devel@lists.sourceforge.net; Fri, 13 Nov 2026 16:13:18 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=ctMpZLHiTdJfgAbSog/NF21EFjjQbooVPpLxiSO8rcc=; b=dk1UiWZ7k85q+H86gVYMc4M4d0 UDCL9OZ/48meYQUYt/jKL5cpBOqp/1BPPtDyykz8wglyUCz7qCvchjMad9N65AtkFrt3uJDqWhIN7 Q7kEE0mnL6QUm0EkfIEjwI413ziVQfil+mZhCz+2wxUguQ4KdnML9suOBA7Y8SAT+9cY=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=ctMpZLHiTdJfgAbSog/NF21EFjjQbooVPpLxiSO8rcc=; b=lSuDQGwL7Sswk5WOCEvYnwPjzT 0lVPXxvAFkS1Mf5zfmBp6s8IOScvciKtgbp9l3lc0SXvYYYLVCLKWm0OQLTKpeJAmokzz+JSnJ/sV a440Nz58EQ/Xy2VmW6o6SlOwdhGAQTYBlgg2RjesMdEs8IQDjGDCrti7xUEN0ZIWpogo=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xRtts-000000000Cj-3GJZ for openvpn-devel@lists.sourceforge.net; Fri, 13 Nov 2026 16:13:18 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6ADGD9aY024493 for ; Fri, 13 Nov 2026 17:13:09 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6ADGD9KF024492 for openvpn-devel@lists.sourceforge.net; Fri, 13 Nov 2026 17:13:09 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Fri, 13 Nov 2026 17:13:01 +0100 Message-ID: <20261113161309.24472-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Razvan Cojocaru tls_ctx_load_pkcs12() never released its references to the certificate, key and CA stack, leaking them on every SSL context setup. The context takes its own references, except for extra chain certific [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xRtts-000000000Cj-3GJZ Subject: [Openvpn-devel] [PATCH v1] ssl_openssl: free what PKCS12_parse() returns X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1881760231642566373 X-GMAIL-MSGID: 1881760231642566373 From: Razvan Cojocaru tls_ctx_load_pkcs12() never released its references to the certificate, key and CA stack, leaking them on every SSL context setup. The context takes its own references, except for extra chain certificates, which it takes over. Change-Id: I387f652ecba92283a272610ff0780273c4902996 Signed-off-by: Razvan Cojocaru Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2183 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2183 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c index fe2bfda..bb51d96 100644 --- a/src/openvpn/ssl_openssl.c +++ b/src/openvpn/ssl_openssl.c @@ -1009,6 +1009,7 @@ } } } + sk_X509_pop_free(ca, X509_free); } else { @@ -1029,7 +1030,11 @@ } } } + /* the certs now belong to ctx */ + sk_X509_free(ca); } + X509_free(cert); + EVP_PKEY_free(pkey); return 0; }