diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2022-07-01 20:38:59 +0200 |
|---|---|---|
| committer | Dr. David von Oheimb <dev@ddvo.net> | 2022-07-11 11:03:28 +0200 |
| commit | 8c094747d78bb8627e9ca5241fed0550a3de2fdb (patch) | |
| tree | 7e448f44f617cf1b8a55c3d3995764acd49d6164 /apps/cmp.c | |
| parent | 93d9d6097685dc29e654db15c091c550aef16d5b (diff) | |
| download | openssl-new-8c094747d78bb8627e9ca5241fed0550a3de2fdb.tar.gz | |
apps/cmp.c: fix cleanup of CMP_CTX vs. APP_HTTP_TLS_INFO in its http_cb_arg field
Prevent crashes on error by making sure the info is freed after OSSL_CMP_CTX_free(),
which may call OSSL_HTTP_close() and thus indirectly reference the info.
Moreover, should not attempt to reference the cmp_ctx variable when NULL.
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18702)
Diffstat (limited to 'apps/cmp.c')
| -rw-r--r-- | apps/cmp.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/apps/cmp.c b/apps/cmp.c index 25c32f69cd..deb709cae0 100644 --- a/apps/cmp.c +++ b/apps/cmp.c @@ -1942,7 +1942,6 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine) if ((info = OPENSSL_zalloc(sizeof(*info))) == NULL) goto err; (void)OSSL_CMP_CTX_set_http_cb_arg(ctx, info); - /* info will be freed along with CMP ctx */ info->server = opt_server; info->port = server_port; /* workaround for callback design flaw, see #17088: */ @@ -3035,12 +3034,19 @@ int cmp_main(int argc, char **argv) if (ret != 1) OSSL_CMP_CTX_print_errors(cmp_ctx); - ossl_cmp_mock_srv_free(OSSL_CMP_CTX_get_transfer_cb_arg(cmp_ctx)); + if (cmp_ctx != NULL) { #ifndef OPENSSL_NO_SOCK - APP_HTTP_TLS_INFO_free(OSSL_CMP_CTX_get_http_cb_arg(cmp_ctx)); + APP_HTTP_TLS_INFO *info = OSSL_CMP_CTX_get_http_cb_arg(cmp_ctx); + +#endif + ossl_cmp_mock_srv_free(OSSL_CMP_CTX_get_transfer_cb_arg(cmp_ctx)); + X509_STORE_free(OSSL_CMP_CTX_get_certConf_cb_arg(cmp_ctx)); + /* cannot free info already here, as it may be used indirectly by: */ + OSSL_CMP_CTX_free(cmp_ctx); +#ifndef OPENSSL_NO_SOCK + APP_HTTP_TLS_INFO_free(info); #endif - X509_STORE_free(OSSL_CMP_CTX_get_certConf_cb_arg(cmp_ctx)); - OSSL_CMP_CTX_free(cmp_ctx); + } X509_VERIFY_PARAM_free(vpm); release_engine(engine); |