This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/main by this push:
new c7e499eee Fix a potential crash when configuring raw certificates.
c7e499eee is described below
commit c7e499eeee6c16854445cdce43fd83907304d3cf
Author: Mark Thomas <[email protected]>
AuthorDate: Thu Aug 27 17:09:57 2026 +0100
Fix a potential crash when configuring raw certificates.
---
native/src/sslcontext.c | 25 +++++++++++++++++--------
xdocs/miscellaneous/changelog.xml | 3 +++
2 files changed, 20 insertions(+), 8 deletions(-)
diff --git a/native/src/sslcontext.c b/native/src/sslcontext.c
index 9c968d5f8..c051a37ce 100644
--- a/native/src/sslcontext.c
+++ b/native/src/sslcontext.c
@@ -855,10 +855,6 @@ TCN_IMPLEMENT_CALL(jboolean, SSLContext,
setCertificateRaw)(TCN_STDARGS, jlong c
rv = JNI_FALSE;
goto cleanup;
}
- if(c->certs[idx] != NULL) {
- free(c->certs[idx]);
- }
- c->certs[idx] = certs;
bio = BIO_new(BIO_s_mem());
BIO_write(bio, key, lengthOfKey);
@@ -869,11 +865,17 @@ TCN_IMPLEMENT_CALL(jboolean, SSLContext,
setCertificateRaw)(TCN_STDARGS, jlong c
ERR_error_string_n(SSL_ERR_get(), err,
TCN_OPENSSL_ERROR_STRING_LENGTH);
tcn_Throw(e, "Error reading private key (%s)", err);
rv = JNI_FALSE;
+ X509_free(certs);
goto cleanup;
}
BIO_free(bio);
+
+ if(c->certs[idx] != NULL) {
+ X509_free(c->certs[idx]);
+ }
+ c->certs[idx] = certs;
if(c->keys[idx] != NULL) {
- free(c->keys[idx]);
+ EVP_PKEY_free(c->keys[idx]);
}
c->keys[idx] = evp;
@@ -881,20 +883,20 @@ TCN_IMPLEMENT_CALL(jboolean, SSLContext,
setCertificateRaw)(TCN_STDARGS, jlong c
ERR_error_string_n(SSL_ERR_get(), err,
TCN_OPENSSL_ERROR_STRING_LENGTH);
tcn_Throw(e, "Error setting certificate (%s)", err);
rv = JNI_FALSE;
- goto cleanup;
+ goto cleanup_openssl;
}
if (SSL_CTX_use_PrivateKey(c->ctx, c->keys[idx]) <= 0) {
ERR_error_string_n(SSL_ERR_get(), err,
TCN_OPENSSL_ERROR_STRING_LENGTH);
tcn_Throw(e, "Error setting private key (%s)", err);
rv = JNI_FALSE;
- goto cleanup;
+ goto cleanup_openssl;
}
if (SSL_CTX_check_private_key(c->ctx) <= 0) {
ERR_error_string_n(SSL_ERR_get(), err,
TCN_OPENSSL_ERROR_STRING_LENGTH);
tcn_Throw(e, "Private key does not match the certificate public key
(%s)",
err);
rv = JNI_FALSE;
- goto cleanup;
+ goto cleanup_openssl;
}
/*
@@ -907,6 +909,13 @@ TCN_IMPLEMENT_CALL(jboolean, SSLContext,
setCertificateRaw)(TCN_STDARGS, jlong c
*/
#endif
SSL_CTX_set_dh_auto(c->ctx, 1);
+ goto cleanup;
+
+cleanup_openssl:
+ X509_free(certs);
+ EVP_PKEY_free(evp);
+ c->certs[idx] = NULL;
+ c->keys[idx] = NULL;
cleanup:
free(key);
free(cert);
diff --git a/xdocs/miscellaneous/changelog.xml
b/xdocs/miscellaneous/changelog.xml
index 02c59e72f..e15e522ef 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -69,6 +69,9 @@
e.g. to support client certificate authentication, do not modify the
certificate verification settings for other connections. (markt)
</fix>
+ <fix>
+ Fix a potential crash when configuring raw certificates. (markt)
+ </fix>
</changelog>
</section>
<section name="2.0.15" rtext="2026-06-15">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
