]> granicus.if.org Git - openssl/commit
projects / openssl / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: d109438) | patch
Fix memory leak on invalid CertificateRequest.
authorDavid Benjamin <davidben@google.com>
Mon, 14 Mar 2016 19:03:07 +0000 (15:03 -0400)
committerDr. Stephen Henson <steve@openssl.org>
Thu, 7 Apr 2016 18:22:20 +0000 (19:22 +0100)
commit6afef8b1fb679df7d6a8606d713192c9907b1890
treee2113ce4f8371a8491c69ecce082509a4b71388atree | snapshot
parentd1094383df07cc8ae266c04cf3ace782447b4d5bcommit | diff
Fix memory leak on invalid CertificateRequest.

Free up parsed X509_NAME structure if the CertificateRequest message
contains excess data.

The security impact is considered insignificant. This is a client side
only leak and a large number of connections to malicious servers would
be needed to have a significant impact.

This was found by libFuzzer.

Reviewed-by: Emilia Käsper <emilia@openssl.org>
Reviewed-by: Stephen Henson <steve@openssl.org>
ssl/statem/statem_clnt.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.