You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ji...@apache.org on 2020/06/20 14:19:56 UTC
svn commit: r1879034 - in /httpd/httpd/branches/2.4.x: ./ CHANGES STATUS
modules/ssl/ssl_util_stapling.c
Author: jim
Date: Sat Jun 20 14:19:56 2020
New Revision: 1879034
URL: http://svn.apache.org/viewvc?rev=1879034&view=rev
Log:
Merge r1876548 from trunk:
mod_ssl: Fix memory leak in stapling code. PR63687.
Free issuer's X509 in ssl_stapling_init_cert()'s early return paths.
Submitted by: icing
Submitted by: ylavic
Reviewed by: gbechis, jorton, icing
Modified:
httpd/httpd/branches/2.4.x/ (props changed)
httpd/httpd/branches/2.4.x/CHANGES
httpd/httpd/branches/2.4.x/STATUS
httpd/httpd/branches/2.4.x/modules/ssl/ssl_util_stapling.c
Propchange: httpd/httpd/branches/2.4.x/
------------------------------------------------------------------------------
Merged /httpd/httpd/trunk:r1876548
Modified: httpd/httpd/branches/2.4.x/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?rev=1879034&r1=1879033&r2=1879034&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/CHANGES [utf-8] (original)
+++ httpd/httpd/branches/2.4.x/CHANGES [utf-8] Sat Jun 20 14:19:56 2020
@@ -1,6 +1,8 @@
-*- coding: utf-8 -*-
Changes with Apache 2.4.44
+ *) mod_ssl: Fix memory leak in stapling code. PR63687. [Stefan Eissing]
+
*) mod_proxy_http2: the "ping" proxy parameter·
(see <https://httpd.apache.org/docs/2.4/mod/mod_proxy.html>) is now used
when checking the liveliness of a new or reused h2 connection to the
Modified: httpd/httpd/branches/2.4.x/STATUS
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/STATUS?rev=1879034&r1=1879033&r2=1879034&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/STATUS (original)
+++ httpd/httpd/branches/2.4.x/STATUS Sat Jun 20 14:19:56 2020
@@ -150,12 +150,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
2.4.x patch: svn merge -c 1877783 ^/httpd/httpd/trunk .
+1: icing, steffenal, rpluem
- *) mod_ssl: Fix memory leak in stapling code. PR63687.
- trunk patch:
- - http://svn.apache.org/r1876548
- 2.4.x patch: svn merge -c 1876548 ^/httpd/httpd/trunk .
- +1: gbechis, jorton, icing
-
PATCHES PROPOSED TO BACKPORT FROM TRUNK:
[ New proposals should be added at the end of the list ]
Modified: httpd/httpd/branches/2.4.x/modules/ssl/ssl_util_stapling.c
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/modules/ssl/ssl_util_stapling.c?rev=1879034&r1=1879033&r2=1879034&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/modules/ssl/ssl_util_stapling.c (original)
+++ httpd/httpd/branches/2.4.x/modules/ssl/ssl_util_stapling.c Sat Jun 20 14:19:56 2020
@@ -134,6 +134,7 @@ int ssl_stapling_init_cert(server_rec *s
X509 *issuer = NULL;
OCSP_CERTID *cid = NULL;
STACK_OF(OPENSSL_STRING) *aia = NULL;
+ int rv = 1; /* until further notice */
if (x == NULL)
return 0;
@@ -158,16 +159,18 @@ int ssl_stapling_init_cert(server_rec *s
SSL_CTX_set_tlsext_status_cb(mctx->ssl_ctx, stapling_cb);
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(10177) "OCSP stapling added via hook");
}
- return 1;
+ goto cleanup;
}
if (mctx->stapling_enabled != TRUE) {
/* mod_ssl's own implementation is not enabled */
- return 1;
+ goto cleanup;
}
- if (X509_digest(x, EVP_sha1(), idx, NULL) != 1)
- return 0;
+ if (X509_digest(x, EVP_sha1(), idx, NULL) != 1) {
+ rv = 0;
+ goto cleanup;
+ }
cinf = apr_hash_get(stapling_certinfo, idx, sizeof(idx));
if (cinf) {
@@ -181,18 +184,18 @@ int ssl_stapling_init_cert(server_rec *s
APLOGNO(02814) "ssl_stapling_init_cert: no OCSP URI "
"in certificate and no SSLStaplingForceURL "
"configured for server %s", mctx->sc->vhost_id);
- return 0;
+ rv = 0;
}
- return 1;
+ goto cleanup;
}
cid = OCSP_cert_to_id(NULL, x, issuer);
- X509_free(issuer);
if (!cid) {
ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x, APLOGNO(02815)
"ssl_stapling_init_cert: can't create CertID "
"for OCSP request");
- return 0;
+ rv = 0;
+ goto cleanup;
}
aia = X509_get1_ocsp(x);
@@ -201,7 +204,8 @@ int ssl_stapling_init_cert(server_rec *s
ssl_log_xerror(SSLLOG_MARK, APLOG_ERR, 0, ptemp, s, x,
APLOGNO(02218) "ssl_stapling_init_cert: no OCSP URI "
"in certificate and no SSLStaplingForceURL set");
- return 0;
+ rv = 0;
+ goto cleanup;
}
/* At this point, we have determined that there's something to store */
@@ -222,8 +226,10 @@ int ssl_stapling_init_cert(server_rec *s
mctx->sc->vhost_id);
apr_hash_set(stapling_certinfo, cinf->idx, sizeof(cinf->idx), cinf);
-
- return 1;
+
+cleanup:
+ X509_free(issuer);
+ return rv;
}
static certinfo *stapling_get_certinfo(server_rec *s, X509 *x, modssl_ctx_t *mctx,