[openssl/openssl] 438cfd: crypto/x509/x509_lu.c: check X509_OBJECT_up_ref_co...

  Branch: refs/heads/openssl-3.6
  Home:   https://github.com/openssl/openssl
  Commit: 438cfdaf08833a4726fa5c0357c41a14bc1657f8
      https://github.com/openssl/openssl/commit/438cfdaf08833a4726fa5c0357c41a14bc1657f8
  Author: Nikola Pajkovsky <[email protected]>
  Date:   2026-07-08 (Wed, 08 Jul 2026)

  Changed paths:
    M crypto/x509/x509_lu.c

  Log Message:
  -----------
  crypto/x509/x509_lu.c: check X509_OBJECT_up_ref_count() in x509_object_dup()

the return value of X509_OBJECT_up_ref_count() was ignored. If the
reference count increment fails, x509_object_dup() still returned a
duplicate X509_OBJECT whose ->data aliases the source X509/X509_CRL
without a reference actually having been taken. Freeing that duplicate
later drops a reference it never held, leading to a premature free and
use-after-free of the shared object.

Signed-off-by: Nikola Pajkovsky <[email protected]>

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
MergeDate: Wed Jul  8 18:20:10 2026
(Merged from https://github.com/openssl/openssl/pull/31811)

(cherry picked from commit 38c7ace6c17267ca9a5dde25c7f025ba418a0c36)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.6/59ec9b-438cfd%40github.com.