Skip to content

Commit 09e5144

Browse files
committed
Fix memory leak in openssl_x509_parse()
If called with a `NULL` buffer argument, `X509_NAME_oneline` returns a pointer to an owned buffer that the caller is responsible for freeing. OpenSSL 3.x documents this expectation[1] and existing 1.1.1 usage concurs.[2] [1] https://docs.openssl.org/master/man3/X509_NAME_print_ex/ [2] https://github.com/openssl/openssl/blob/e04bd3433fd84e1861bf258ea37928d9845e6a86/crypto/x509/x_name.c#L498
1 parent 52ada4d commit 09e5144

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

hphp/runtime/ext/openssl/ext_openssl.cpp

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2772,7 +2772,11 @@ Variant HHVM_FUNCTION(openssl_x509_parse, const Variant& x509cert,
27722772
auto ret = Array::CreateDict();
27732773
const auto sn = X509_get_subject_name(cert);
27742774
if (sn) {
2775-
ret.set(s_name, String(X509_NAME_oneline(sn, nullptr, 0), CopyString));
2775+
char* subjectName = X509_NAME_oneline(sn, nullptr, 0);
2776+
SCOPE_EXIT {
2777+
OPENSSL_free(subjectName);
2778+
};
2779+
ret.set(s_name, String(subjectName, CopyString));
27762780
}
27772781
add_assoc_name_entry(ret, "subject", sn, shortnames);
27782782
/* hash as used in CA directories to lookup cert by subject name */

0 commit comments

Comments
 (0)