From a25e2d49a75eb01dcdad41a5bec05666d461b2d6 Mon Sep 17 00:00:00 2001 From: Pavel Kopyl Date: Sun, 10 Dec 2017 22:57:43 +0300 Subject: [PATCH] do_body: fix heap-use-after-free. The memory pointed to by the 'push' is freed by the X509_NAME_ENTRY_free() in do_body(). The second time it is referenced to (indirectly) in certify_cert:X509_REQ_free(). Reviewed-by: Bernd Edlinger Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/4896) --- apps/ca.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/apps/ca.c b/apps/ca.c index bde3e4438a..06002adf2d 100644 --- a/apps/ca.c +++ b/apps/ca.c @@ -1825,8 +1825,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, if (push != NULL) { if (!X509_NAME_add_entry(subject, push, -1, 0)) { - if (push != NULL) - X509_NAME_ENTRY_free(push); BIO_printf(bio_err, "Memory allocation failure\n"); goto err; } -- 2.25.1