Skip to content

Commit db08ef0

Browse files
committed
Fix RSA memory leak in mysqlnd auth
1 parent 347d18b commit db08ef0

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

ext/mysqlnd/mysqlnd_auth.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -728,6 +728,7 @@ mysqlnd_sha256_public_encrypt(MYSQLND_CONN_DATA * conn, mysqlnd_rsa_t server_pub
728728
*/
729729
if (server_public_key_len <= passwd_len + 41) {
730730
/* password message is to long */
731+
RSA_free(server_public_key);
731732
SET_CLIENT_ERROR(conn->error_info, CR_UNKNOWN_ERROR, UNKNOWN_SQLSTATE, "password is too long");
732733
DBG_ERR("password is too long");
733734
DBG_RETURN(NULL);
@@ -1018,13 +1019,15 @@ mysqlnd_caching_sha2_public_encrypt(MYSQLND_CONN_DATA * conn, mysqlnd_rsa_t serv
10181019
*/
10191020
if (server_public_key_len <= passwd_len + 41) {
10201021
/* password message is to long */
1022+
RSA_free(server_public_key);
10211023
SET_CLIENT_ERROR(conn->error_info, CR_UNKNOWN_ERROR, UNKNOWN_SQLSTATE, "password is too long");
10221024
DBG_ERR("password is too long");
10231025
DBG_RETURN(0);
10241026
}
10251027

10261028
*crypted = emalloc(server_public_key_len);
10271029
RSA_public_encrypt(passwd_len + 1, (zend_uchar *) xor_str, *crypted, server_public_key, RSA_PKCS1_OAEP_PADDING);
1030+
RSA_free(server_public_key);
10281031
DBG_RETURN(server_public_key_len);
10291032
}
10301033
/* }}} */

0 commit comments

Comments
 (0)