This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 1.3.x
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/1.3.x by this push:
new 072109034 Fix a potential crash when configuring raw certificates.
072109034 is described below
commit 072109034121ae309dcbd67f093311a8d26f5889
Author: Mark Thomas <[email protected]>
AuthorDate: Thu Aug 27 17:09:57 2026 +0100
Fix a potential crash when configuring raw certificates.
---
native/src/sslcontext.c | 25 +++++++++++++++++--------
xdocs/miscellaneous/changelog.xml | 3 +++
2 files changed, 20 insertions(+), 8 deletions(-)
diff --git a/native/src/sslcontext.c b/native/src/sslcontext.c
index b2a36f607..fb4ba8f4b 100644
--- a/native/src/sslcontext.c
+++ b/native/src/sslcontext.c
@@ -1222,10 +1222,6 @@ TCN_IMPLEMENT_CALL(jboolean, SSLContext,
setCertificateRaw)(TCN_STDARGS, jlong c
rv = JNI_FALSE;
goto cleanup;
}
- if(c->certs[idx] != NULL) {
- free(c->certs[idx]);
- }
- c->certs[idx] = certs;
bio = BIO_new(BIO_s_mem());
BIO_write(bio, key, lengthOfKey);
@@ -1236,11 +1232,17 @@ TCN_IMPLEMENT_CALL(jboolean, SSLContext,
setCertificateRaw)(TCN_STDARGS, jlong c
ERR_error_string_n(SSL_ERR_get(), err,
TCN_OPENSSL_ERROR_STRING_LENGTH);
tcn_Throw(e, "Error reading private key (%s)", err);
rv = JNI_FALSE;
+ X509_free(certs);
goto cleanup;
}
BIO_free(bio);
+
+ if(c->certs[idx] != NULL) {
+ X509_free(c->certs[idx]);
+ }
+ c->certs[idx] = certs;
if(c->keys[idx] != NULL) {
- free(c->keys[idx]);
+ EVP_PKEY_free(c->keys[idx]);
}
c->keys[idx] = evp;
@@ -1248,20 +1250,20 @@ TCN_IMPLEMENT_CALL(jboolean, SSLContext,
setCertificateRaw)(TCN_STDARGS, jlong c
ERR_error_string_n(SSL_ERR_get(), err,
TCN_OPENSSL_ERROR_STRING_LENGTH);
tcn_Throw(e, "Error setting certificate (%s)", err);
rv = JNI_FALSE;
- goto cleanup;
+ goto cleanup_openssl;
}
if (SSL_CTX_use_PrivateKey(c->ctx, c->keys[idx]) <= 0) {
ERR_error_string_n(SSL_ERR_get(), err,
TCN_OPENSSL_ERROR_STRING_LENGTH);
tcn_Throw(e, "Error setting private key (%s)", err);
rv = JNI_FALSE;
- goto cleanup;
+ goto cleanup_openssl;
}
if (SSL_CTX_check_private_key(c->ctx) <= 0) {
ERR_error_string_n(SSL_ERR_get(), err,
TCN_OPENSSL_ERROR_STRING_LENGTH);
tcn_Throw(e, "Private key does not match the certificate public key
(%s)",
err);
rv = JNI_FALSE;
- goto cleanup;
+ goto cleanup_openssl;
}
/*
@@ -1274,6 +1276,13 @@ TCN_IMPLEMENT_CALL(jboolean, SSLContext,
setCertificateRaw)(TCN_STDARGS, jlong c
*/
#endif
SSL_CTX_set_tmp_dh_callback(c->ctx, SSL_callback_tmp_DH);
+ goto cleanup;
+
+cleanup_openssl:
+ X509_free(certs);
+ EVP_PKEY_free(evp);
+ c->certs[idx] = NULL;
+ c->keys[idx] = NULL;
cleanup:
free(key);
free(cert);
diff --git a/xdocs/miscellaneous/changelog.xml
b/xdocs/miscellaneous/changelog.xml
index 97d7c0c68..193c7240d 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -60,6 +60,9 @@
e.g. to support client certificate authentication, do not modify the
certificate verification settings for other connections. (markt)
</fix>
+ <fix>
+ Fix a potential crash when configuring raw certificates. (markt)
+ </fix>
</changelog>
</section>
<section name="1.3.8" rtext="2026-06-15">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
