[trafficserver] branch master updated: Fixes more leaks when no OCSP URL is available

[bc...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

bcall pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/master by this push:
     new d83798a  Fixes more leaks when no OCSP URL is available
d83798a is described below

commit d83798a5be6cb162713bcd1f5178a3bfdc93f666
Author: Randall Meyer <rr...@apple.com>
AuthorDate: Tue Oct 23 08:49:36 2018 -0700

    Fixes more leaks when no OCSP URL is available
    
    This is a follow up and more complete version of
    19a55a2679dda03f1258e097a82c27c98f00efbc
---
 iocore/net/OCSPStapling.cc | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/iocore/net/OCSPStapling.cc b/iocore/net/OCSPStapling.cc
index 1fe2520..90133e4 100644
--- a/iocore/net/OCSPStapling.cc
+++ b/iocore/net/OCSPStapling.cc
@@ -120,9 +120,6 @@ stapling_get_issuer(SSL_CTX *ssl_ctx, X509 *x)
     }
   }
 
-  if (!X509_STORE_CTX_init(inctx, st, nullptr, nullptr)) {
-    goto end;
-  }
   if (X509_STORE_CTX_get1_issuer(&issuer, inctx, x) <= 0) {
     issuer = nullptr;
   }
@@ -169,13 +166,14 @@ ssl_stapling_init_cert(SSL_CTX *ctx, X509 *cert, const char *certname)
   issuer = stapling_get_issuer(ctx, cert);
   if (issuer == nullptr) {
     Note("cannot get issuer certificate from %s", certname);
-    return false;
+    goto err;
   }
 
   cinf->cid = OCSP_cert_to_id(nullptr, cert, issuer);
   if (!cinf->cid) {
-    return false;
+    goto err;
   }
+
   X509_digest(cert, EVP_sha1(), cinf->idx, nullptr);
 
   aia = X509_get1_ocsp(cert);
@@ -185,17 +183,28 @@ ssl_stapling_init_cert(SSL_CTX *ctx, X509 *cert, const char *certname)
   }
 
   if (!cinf->uri) {
-    OCSP_CERTID_free(cinf->cid);
-    cinf->cid = nullptr;
-
     Note("no OCSP responder URI for %s", certname);
-    return false;
+    goto err;
   }
 
   SSL_CTX_set_ex_data(ctx, ssl_stapling_index, cinf);
 
   Note("successfully initialized stapling for %s into SSL_CTX: %p", certname, ctx);
   return true;
+
+err:
+  if (cinf->uri) {
+    OCSP_CERTID_free(cinf->cid);
+  }
+
+  if (cinf->certname) {
+    ats_free(cinf->certname);
+  }
+
+  if (cinf) {
+    OPENSSL_free(cinf);
+  }
+  return false;
 }
 
 static certinfo *