From: Joe Orton <jorton@apache.org>
Date: Fri, 12 Aug 2011 13:40:09 +0000 (+0000)
Subject: * modules/ssl/ssl_engine_config.c (ssl_cmd_SSLCryptoDevice): Fix
X-Git-Tag: 2.3.15~390
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4e858e3859831bbc023316e410a9055da6ce5790;p=apache

* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLCryptoDevice): Fix
  double-free (and segfault) with bad arg to SSLCryptoDevice.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157105 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
index 918f9216d7..fee529d0b6 100644
--- a/modules/ssl/ssl_engine_config.c
+++ b/modules/ssl/ssl_engine_config.c
@@ -461,12 +461,11 @@ const char *ssl_cmd_SSLCryptoDevice(cmd_parms *cmd,
               "'builtin' (none)";
         e = ENGINE_get_first();
         while (e) {
-            ENGINE *en;
             err = apr_pstrcat(cmd->pool, err, ", '", ENGINE_get_id(e),
                                          "' (", ENGINE_get_name(e), ")", NULL);
-            en = ENGINE_get_next(e);
-            ENGINE_free(e);
-            e = en;
+            /* Iterate; this call implicitly decrements the refcount
+             * on the 'old' e, per the docs in engine.h. */
+            e = ENGINE_get_next(e);
         }
         return err;
     }