[openssl/openssl] 38c7ac: crypto/x509/x509_lu.c: check X509_OBJECT_up_ref_co...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 38c7ace6c17267ca9a5dde25c7f025ba418a0c36
      https://github.com/openssl/openssl/commit/38c7ace6c17267ca9a5dde25c7f025ba418a0c36
  Author: Nikola Pajkovsky <[email protected]>
  Date:   2026-07-08 (Wed, 08 Jul 2026)

  Changed paths:
    M crypto/x509/x509_lu.c

  Log Message:
  -----------
  crypto/x509/x509_lu.c: check X509_OBJECT_up_ref_count() in x509_object_dup()

the return value of X509_OBJECT_up_ref_count() was ignored. If the
reference count increment fails, x509_object_dup() still returned a
duplicate X509_OBJECT whose ->data aliases the source X509/X509_CRL
without a reference actually having been taken. Freeing that duplicate
later drops a reference it never held, leading to a premature free and
use-after-free of the shared object.

Signed-off-by: Nikola Pajkovsky <[email protected]>

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
MergeDate: Wed Jul  8 18:20:10 2026
(Merged from https://github.com/openssl/openssl/pull/31811)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/a4ee69-38c7ac%40github.com.