From d9a0f69747fbf00d3b8737f563b9f929bb952634 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Tue, 16 Feb 2016 00:40:41 +0200 Subject: [PATCH] OpenSSL: Fix memory leak in OCSP parsing The result from OCSP_cert_to_id() needs to be freed. Signed-off-by: Jouni Malinen --- src/crypto/tls_openssl.c | 2 ++ src/utils/http_curl.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c index 7ef621448..7a2db492b 100644 --- a/src/crypto/tls_openssl.c +++ b/src/crypto/tls_openssl.c @@ -3852,10 +3852,12 @@ static int ocsp_resp_cb(SSL *s, void *arg) wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s", (conn->flags & TLS_CONN_REQUIRE_OCSP) ? "" : " (OCSP not required)"); + OCSP_CERTID_free(id); OCSP_BASICRESP_free(basic); OCSP_RESPONSE_free(rsp); return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1; } + OCSP_CERTID_free(id); if (!OCSP_check_validity(this_update, next_update, 5 * 60, -1)) { tls_show_errors(MSG_INFO, __func__, diff --git a/src/utils/http_curl.c b/src/utils/http_curl.c index 9be0111fb..d59439896 100644 --- a/src/utils/http_curl.c +++ b/src/utils/http_curl.c @@ -1216,6 +1216,7 @@ static int ocsp_resp_cb(SSL *s, void *arg) wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s", (ctx->ocsp == MANDATORY_OCSP) ? "" : " (OCSP not required)"); + OCSP_CERTID_free(id); OCSP_BASICRESP_free(basic); OCSP_RESPONSE_free(rsp); if (ctx->ocsp == MANDATORY_OCSP) @@ -1223,6 +1224,7 @@ static int ocsp_resp_cb(SSL *s, void *arg) ctx->last_err = "Could not find current server certificate from OCSP response"; return (ctx->ocsp == MANDATORY_OCSP) ? 0 : 1; } + OCSP_CERTID_free(id); if (!OCSP_check_validity(this_update, next_update, 5 * 60, -1)) { tls_show_errors(__func__, "OpenSSL: OCSP status times invalid");