From a9603be1a8484fc17cbcb0f4df953a4c6f37ffa1 Mon Sep 17 00:00:00 2001 From: Pavel Kopyl Date: Fri, 3 Nov 2017 22:18:35 +0300 Subject: [PATCH] do_body: fix heap-use-after-free. The memory pointed to by the 'push' is freed by the X509_NAME_ENTRY_free() in do_body(). The second time it is referenced to (indirectly) in certify_cert:X509_REQ_free(). Reviewed-by: Rich Salz Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/4698) --- apps/ca.c | 1 - 1 file changed, 1 deletion(-) diff --git a/apps/ca.c b/apps/ca.c index 26ca6bb5d2..ad8c5c8bbe 100644 --- a/apps/ca.c +++ b/apps/ca.c @@ -1560,7 +1560,6 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, if (push != NULL) { if (!X509_NAME_add_entry(subject, push, -1, 0)) { - X509_NAME_ENTRY_free(push); BIO_printf(bio_err, "Memory allocation failure\n"); goto end; } -- 2.25.1