From bc0773bbbd4d3ace6957385f1f22a5cda25dc94f Mon Sep 17 00:00:00 2001 From: Bernd Edlinger Date: Mon, 20 Nov 2023 10:05:49 +0100 Subject: [PATCH] Fix a possible use-after-free in custom_exts_free This may happen when ssl_cert_dup calls custom_exts_copy, where a possible memory allocation error causes custom_exts_free to be called twice: once in the error handling of custom_exts_copy and a second time in the error handling of ssl_cert_dup. Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/22772) --- ssl/statem/extensions_cust.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ssl/statem/extensions_cust.c b/ssl/statem/extensions_cust.c index 7c049d2970..fd840e8918 100644 --- a/ssl/statem/extensions_cust.c +++ b/ssl/statem/extensions_cust.c @@ -342,6 +342,8 @@ void custom_exts_free(custom_ext_methods *exts) OPENSSL_free(meth->parse_arg); } OPENSSL_free(exts->meths); + exts->meths = NULL; + exts->meths_count = 0; } /* Return true if a client custom extension exists, false otherwise */