From c4b30d9c6d03ddc6e6f03708bc2c5528362cf03c Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Thu, 5 Dec 2024 09:29:08 +0100 Subject: [PATCH] ossl_cms_get1_crls_ex(): Avoid doublefree if CRL up ref fails Reviewed-by: Tim Hudson Reviewed-by: David von Oheimb (Merged from https://github.com/openssl/openssl/pull/26100) (cherry picked from commit ef0be53f90045d0a9f0d085a7a4289335f49ee41) --- crypto/cms/cms_lib.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/crypto/cms/cms_lib.c b/crypto/cms/cms_lib.c index ede016dff0..a115a3b900 100644 --- a/crypto/cms/cms_lib.c +++ b/crypto/cms/cms_lib.c @@ -15,6 +15,7 @@ #include #include #include "internal/sizes.h" +#include "internal/cryptlib.h" #include "crypto/x509.h" #include "cms_local.h" @@ -696,8 +697,9 @@ int ossl_cms_get1_crls_ex(CMS_ContentInfo *cms, STACK_OF(X509_CRL) **crls) for (i = 0; i < n; i++) { rch = sk_CMS_RevocationInfoChoice_value(*pcrls, i); if (rch->type == 0) { - if (!sk_X509_CRL_push(*crls, rch->d.crl) - || !X509_CRL_up_ref(rch->d.crl)) { + if (!X509_CRL_up_ref(rch->d.crl) + || !ossl_assert(sk_X509_CRL_push(*crls, rch->d.crl))) { + /* push cannot fail on reserved stack */ sk_X509_CRL_pop_free(*crls, X509_CRL_free); *crls = NULL; return 0;