From 17a64b13a4739738a846cffac38c66c007dd9070 Mon Sep 17 00:00:00 2001 From: Jakub Zelenka Date: Wed, 20 Dec 2023 21:56:36 +0000 Subject: [PATCH] Fix GH-12987: openssl_csr_sign might leak new cert on error Closes GH-12988 --- ext/openssl/openssl.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index 0f8adf013515..59d938d77e8c 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -3154,6 +3154,7 @@ PHP_FUNCTION(openssl_csr_sign) X509 *cert = NULL, *new_cert = NULL; EVP_PKEY * key = NULL, *priv_key = NULL; int i; + bool new_cert_used = false; struct php_x509_request req; ZEND_PARSE_PARAMETERS_START(4, 6) @@ -3275,11 +3276,12 @@ PHP_FUNCTION(openssl_csr_sign) object_init_ex(return_value, php_openssl_certificate_ce); cert_object = Z_OPENSSL_CERTIFICATE_P(return_value); cert_object->x509 = new_cert; + new_cert_used = true; cleanup: - if (cert == new_cert) { - cert = NULL; + if (!new_cert_used && new_cert) { + X509_free(new_cert); } PHP_SSL_REQ_DISPOSE(&req); @@ -3288,7 +3290,7 @@ PHP_FUNCTION(openssl_csr_sign) if (csr_str) { X509_REQ_free(csr); } - if (cert_str && cert) { + if (cert_str && cert && cert != new_cert) { X509_free(cert); } }