https://bz.apache.org/bugzilla/show_bug.cgi?id=70291
Bug ID: 70291
Summary: mod_ssl: Missing NULL check for
sk_X509_INFO_new_null() in ssl_init_proxy_certs()
Product: Apache httpd-2
Version: 2.4.69
Hardware: PC
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: mod_ssl
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
In modules/ssl/ssl_engine_init.c, within the function ssl_init_proxy_certs(),
the return value of sk_X509_INFO_new_null() is assigned to the variable sk
(around line 1876) but is not checked for NULL.
Note that sk_X509_INFO_new_null() is a macro/wrapper that ultimately invokes
OPENSSL_sk_new_null() under the hood. If memory allocation fails, this
underlying call will return NULL. The unchecked sk pointer is subsequently
passed to load_x509_info() (line 1879) and potentially other stack operations.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
