Branch: refs/heads/openssl-3.3
Home: https://github.com/openssl/openssl
Commit: fab9111520f17be27dead558fb0230c1653f7610
https://github.com/openssl/openssl/commit/fab9111520f17be27dead558fb0230c1653f7610
Author: Bernd Edlinger <bernd.edlin...@hotmail.de>
Date: 2024-07-08 (Mon, 08 Jul 2024)
Changed paths:
M crypto/pkcs7/pk7_doit.c
Log Message:
-----------
Fix possible double-free in pkcs7 add_attribute function
The problem is the ownership of the input parameter value
is transfered to the X509_ATTRIBUTE object attr, as soon
as X509_ATTRIBUTE_create succeeds, but when an error happens
after that point there is no way to get the ownership back
to the caller, which is necessary to fullfill the API contract.
Fixed that by moving the call to X509_ATTRIBUTE_create to the
end of the function, and make sure that no errors are possible
after that point.
Reviewed-by: Neil Horman <nhor...@openssl.org>
Reviewed-by: Tomas Mraz <to...@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22721)
(cherry picked from commit 82a13a1f5053462f826bfb90061f0f77e3cc98a5)
To unsubscribe from these emails, change your notification settings at
https://github.com/openssl/openssl/settings/notifications
