From: Pavel Kopyl <p.kopyl@samsung.com>
Date: Sun, 10 Dec 2017 19:57:43 +0000 (+0300)
Subject: do_body: fix heap-use-after-free.
X-Git-Tag: OpenSSL_1_0_2o~31
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=a25e2d49a75eb01dcdad41a5bec05666d461b2d6;p=oweals%2Fopenssl.git

do_body: fix heap-use-after-free.

The memory pointed to by the 'push' is freed by the
X509_NAME_ENTRY_free() in do_body(). The second time
it is referenced to (indirectly) in certify_cert:X509_REQ_free().

Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4896)
---

diff --git a/apps/ca.c b/apps/ca.c
index bde3e4438a..06002adf2d 100644
--- a/apps/ca.c
+++ b/apps/ca.c
@@ -1825,8 +1825,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
 
             if (push != NULL) {
                 if (!X509_NAME_add_entry(subject, push, -1, 0)) {
-                    if (push != NULL)
-                        X509_NAME_ENTRY_free(push);
                     BIO_printf(bio_err, "Memory allocation failure\n");
                     goto err;
                 }