Hi
I would like to report what I believe is a bug in the openssl code.
Please forgive me if I do not follow any standard procedures you have
for reporting bugs.
The openssl version this bug relates to is openssl 0.9.7c, but I believe
it also applies to earlier versions.
The bug lies in the code where calls to X509_STORE_add_cert(), and
X509_STORE_add_crl() are made.
e.g. (from x509\by_file.c)
i=X509_STORE_add_cert(ctx->store_ctx,x);
if (!i) goto err;
count++;
X509_free(x);
x=NULL;
note that X509_free() is called if the call to X509_STORE_add_cert is
successful. I believe this is wrong because if successful, the pointer
to the certificate (x) is now 'owned' by the store.
It is correct to free 'x' if the call is unsuccessful as the caller will
still 'own' x, and the certificate won't be in the store.
if we look at X509_STORE_add_cert...
int X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
{
X509_OBJECT *obj;
int ret=1;
if (x == NULL) return 0;
obj=(X509_OBJECT *)OPENSSL_malloc(sizeof(X509_OBJECT));
if (obj == NULL)
{
X509err(X509_F_X509_STORE_ADD_CERT,ERR_R_MALLOC_FAILURE);
return 0;
}
obj->type=X509_LU_X509;
obj->data.x509=x;
you can see that x is used by the store.
The same sort of problem exists with calls to X509_STORE_add_crl()
I would suggest that all calls to those two functions are checked to
ensure that 'x' is not freed after a successful call.
I think that most if not all calls are made in x509\by_file.c.
I know that the openbsd project also calls X509_STORE_add_cert, but I am
not sure if that has anything to do with you. (src\isakmpd\x509.c)
In that file, they need to free the certificate is the call is not
successful, which is probably not all that likely to occur.
Chris
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.520 / Virus Database: 318 - Release Date: 18/09/2003
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
