[31592] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix leaks on error in PKINIT signed-data creation
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Fri Oct 30 13:11:46 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261029222526.E03D31057EE@krbdev.mit.edu>
Date: Thu, 29 Oct 2026 18:25:26 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/f01d35b8df208e6b338b82269c1f82829e083220
commit f01d35b8df208e6b338b82269c1f82829e083220
Author: Greg Hudson <ghudson@mit.edu>
Date: Sat Oct 24 20:48:51 2026 -0400
Fix leaks on error in PKINIT signed-data creation
In cms_signeddata_create(), free more allocated variables in the
cleanup label to prevent them from leaking on error paths. Also check
the result of X509_STORE_CTX_get1_chain() before using it, to prevent
a null dereference on allocation failure. Reported by Brian Knoll.
ticket: 9271 (new)
tags: pullup
target_version: 1.22-next
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index 0a6fd7c1e..a435847a4 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -1410,7 +1410,9 @@ cms_signeddata_create(krb5_context context,
PKCS7_SIGNED *p7s = NULL;
PKCS7_SIGNER_INFO *p7si = NULL;
unsigned char *p;
- STACK_OF(X509) * cert_stack = NULL;
+ STACK_OF(X509) *cert_stack = NULL, *certstack = NULL;
+ X509_STORE *certstore = NULL;
+ X509_STORE_CTX *certctx = NULL;
ASN1_OCTET_STRING *digest_attr = NULL;
EVP_MD_CTX *ctx;
unsigned char md_data[EVP_MAX_MD_SIZE], *abuf = NULL;
@@ -1439,9 +1441,6 @@ cms_signeddata_create(krb5_context context,
goto cleanup;
if (id_cryptoctx->my_cert != NULL) {
- X509_STORE *certstore = NULL;
- X509_STORE_CTX *certctx;
- STACK_OF(X509) *certstack = NULL;
char buf[DN_BUF_LEN];
unsigned int i = 0, size = 0;
@@ -1466,6 +1465,8 @@ cms_signeddata_create(krb5_context context,
goto cleanup;
}
certstack = X509_STORE_CTX_get1_chain(certctx);
+ if (certstack == NULL)
+ goto cleanup;
size = sk_X509_num(certstack);
for (i = 0; i < size - 1; i++) {
X509 *x = sk_X509_value(certstack, i);
@@ -1473,11 +1474,9 @@ cms_signeddata_create(krb5_context context,
TRACE_PKINIT_CERT_CHAIN_NAME(context, (int)i, buf);
sk_X509_push(cert_stack, X509_dup(x));
}
- X509_STORE_CTX_free(certctx);
- X509_STORE_free(certstore);
- sk_X509_pop_free(certstack, X509_free);
p7s->cert = cert_stack;
+ cert_stack = NULL;
/* fill-in PKCS7_SIGNER_INFO */
if ((p7si = PKCS7_SIGNER_INFO_new()) == NULL)
@@ -1563,6 +1562,7 @@ cms_signeddata_create(krb5_context context,
/* adder signer_info to pkcs7 signed */
if (!PKCS7_add_signer(p7, p7si))
goto cleanup2;
+ p7si = NULL;
} /* we have a certificate */
/* start on adding data to the pkcs7 signed */
@@ -1604,6 +1604,11 @@ cleanup2:
X509_ALGOR_free(alg);
}
cleanup:
+ X509_STORE_CTX_free(certctx);
+ X509_STORE_free(certstore);
+ sk_X509_pop_free(cert_stack, X509_free);
+ sk_X509_pop_free(certstack, X509_free);
+ PKCS7_SIGNER_INFO_free(p7si);
if (p7 != NULL)
PKCS7_free(p7);
free(sig);
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
