[31611] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Fix leaks on error in PKINIT signed-data
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Tue Nov 3 19:17:53 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261104001749.1DDFC105851@krbdev.mit.edu>
Date: Tue, 3 Nov 2026 19:17:49 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/ebbfc6eecb0be9559da4f682ab67ec9d49a3eabf
commit ebbfc6eecb0be9559da4f682ab67ec9d49a3eabf
Author: Greg Hudson <ghudson@mit.edu>
Date: Sat Oct 24 20:48:51 2026 -0400
Fix leaks on error in PKINIT signed-data creation
In cms_signeddata_create(), free more allocated variables in the
cleanup label to prevent them from leaking on error paths. Also check
the result of X509_STORE_CTX_get1_chain() before using it, to prevent
a null dereference on allocation failure. Reported by Brian Knoll.
(cherry picked from commit f01d35b8df208e6b338b82269c1f82829e083220)
ticket: 9271
version_fixed: 1.22.3
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index a16ae1bfe..bed0f65f6 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -1749,7 +1749,9 @@ cms_signeddata_create(krb5_context context,
PKCS7_SIGNED *p7s = NULL;
PKCS7_SIGNER_INFO *p7si = NULL;
unsigned char *p;
- STACK_OF(X509) * cert_stack = NULL;
+ STACK_OF(X509) *cert_stack = NULL, *certstack = NULL;
+ X509_STORE *certstore = NULL;
+ X509_STORE_CTX *certctx = NULL;
ASN1_OCTET_STRING *digest_attr = NULL;
EVP_MD_CTX *ctx;
unsigned char md_data[EVP_MAX_MD_SIZE], *abuf = NULL;
@@ -1778,9 +1780,6 @@ cms_signeddata_create(krb5_context context,
goto cleanup;
if (id_cryptoctx->my_cert != NULL) {
- X509_STORE *certstore = NULL;
- X509_STORE_CTX *certctx;
- STACK_OF(X509) *certstack = NULL;
char buf[DN_BUF_LEN];
unsigned int i = 0, size = 0;
@@ -1805,6 +1804,8 @@ cms_signeddata_create(krb5_context context,
goto cleanup;
}
certstack = X509_STORE_CTX_get1_chain(certctx);
+ if (certstack == NULL)
+ goto cleanup;
size = sk_X509_num(certstack);
for (i = 0; i < size - 1; i++) {
X509 *x = sk_X509_value(certstack, i);
@@ -1812,11 +1813,9 @@ cms_signeddata_create(krb5_context context,
TRACE_PKINIT_CERT_CHAIN_NAME(context, (int)i, buf);
sk_X509_push(cert_stack, X509_dup(x));
}
- X509_STORE_CTX_free(certctx);
- X509_STORE_free(certstore);
- sk_X509_pop_free(certstack, X509_free);
p7s->cert = cert_stack;
+ cert_stack = NULL;
/* fill-in PKCS7_SIGNER_INFO */
if ((p7si = PKCS7_SIGNER_INFO_new()) == NULL)
@@ -1902,6 +1901,7 @@ cms_signeddata_create(krb5_context context,
/* adder signer_info to pkcs7 signed */
if (!PKCS7_add_signer(p7, p7si))
goto cleanup2;
+ p7si = NULL;
} /* we have a certificate */
/* start on adding data to the pkcs7 signed */
@@ -1943,6 +1943,11 @@ cleanup2:
X509_ALGOR_free(alg);
}
cleanup:
+ X509_STORE_CTX_free(certctx);
+ X509_STORE_free(certstore);
+ sk_X509_pop_free(cert_stack, X509_free);
+ sk_X509_pop_free(certstack, X509_free);
+ PKCS7_SIGNER_INFO_free(p7si);
if (p7 != NULL)
PKCS7_free(p7);
free(sig);
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
