[openssl/openssl] f6e62b: crypto/x509/pcy_cache.c: fix ext_pcons leak in pol...

  Branch: refs/heads/openssl-3.6
  Home:   https://github.com/openssl/openssl
  Commit: f6e62bc775a55c2f1e618c81e8ae5c1c294cda3f
      https://github.com/openssl/openssl/commit/f6e62bc775a55c2f1e618c81e8ae5c1c294cda3f
  Author: 007bsd <[email protected]>
  Date:   2026-06-26 (Fri, 26 Jun 2026)

  Changed paths:
    M crypto/x509/pcy_cache.c

  Log Message:
  -----------
  crypto/x509/pcy_cache.c: fix ext_pcons leak in policy_cache_new()

Two early-return paths in policy_cache_new() bypass the just_cleanup:
label and leak the POLICY_CONSTRAINTS object ext_pcons: (1) when
certificatePolicies is absent but policyConstraints is present, and
(2) when policy_cache_create() returns <= 0.  Free ext_pcons before
each early return.

Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial
Fixes: 4acc3e907d29 "Initial support for certificate policy checking and evaluation."

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
MergeDate: Fri Jun 26 15:26:07 2026
(Merged from https://github.com/openssl/openssl/pull/31678)

(cherry picked from commit 1f5a44a66df44751d999fc90751ce098975f18a6)


  Commit: 166750d3f7bc8fcf8909b451ecd54be644e6b275
      https://github.com/openssl/openssl/commit/166750d3f7bc8fcf8909b451ecd54be644e6b275
  Author: 007bsd <[email protected]>
  Date:   2026-06-26 (Fri, 26 Jun 2026)

  Changed paths:
    M crypto/x509/v3_ncons.c

  Log Message:
  -----------
  crypto/x509/v3_ncons.c: fix scheme buffer leak in nc_uri() for schemeless URIs

OSSL_parse_url() allocates a 1-byte empty-string buffer for the scheme
even when the URI has no scheme.  The empty-scheme error branch freed
uri_copy and jumped to end: which only frees host, leaving scheme
unfreed.  Add OPENSSL_free(scheme) before the goto.

Assisted-by: Claude:claude-sonnet-4-6
CLA: trivial
Fixes: e599893a9fec "x509: allow SAN URIs to contain userinfo"

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
MergeDate: Fri Jun 26 15:26:09 2026
(Merged from https://github.com/openssl/openssl/pull/31678)

(cherry picked from commit 8be7309f34eecac16b23edfa2ea8de7c52a33b3d)


Compare: https://github.com/openssl/openssl/compare/71c8a78cb8fc...166750d3f7bc

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.6/71c8a7-166750%40github.com.