fix memory leak (or use-after-free) from previous commit

This commit is contained in:
Karel Miko 2026-04-16 22:38:37 +02:00
parent 435d067d7c
commit 08c91988d1

View file

@ -522,19 +522,23 @@ static int s_get_ce_value(const ltc_asn1_list *os, st_ce_value *ce)
return err;
}
if (value->type != LTC_ASN1_SEQUENCE) {
err = CRYPT_INVALID_PACKET;
goto err_out;
der_free_sequence_flexi(value);
return CRYPT_INVALID_PACKET;
} else {
err = ce->ce->u.ce.handler(value, &ce->value);
}
der_free_sequence_flexi(value);
if (err != CRYPT_OK) {
der_free_sequence_flexi(value);
return err;
}
/* store the flexi tree root so it can be freed in s_free_extension, handlers store pointers into this tree */
ce->value.asn1 = value;
} else {
err = ce->ce->u.ce.handler(os, &ce->value);
}
if (err == CRYPT_OK) {
ce->value.type = ce->ce->detail;
}
err_out:
return err;
}
@ -545,15 +549,19 @@ static LTC_INLINE void s_free_extension(const ltc_x509_extension *ext)
s_free(ext->u.authority_key_id.key_identifier.str);
s_free(ext->u.authority_key_id.authority_cert_issuer.str);
s_free(ext->u.authority_key_id.authority_cert_serial_number.str);
der_free_sequence_flexi((void*)ext->asn1);
break;
case LTC_X509_CE_SUBJECT_KEY_ID:
s_free(ext->u.subject_key_identifier.str);
break;
case LTC_X509_CE_SUBJECT_ALT_NAME:
s_free_x509_string_array(ext->u.subject_alt_name.names, ext->u.subject_alt_name.names_num);
der_free_sequence_flexi((void*)ext->asn1);
break;
case LTC_X509_CE_BASIC_CONSTRAINTS:
case LTC_X509_CE_EXT_KEY_USAGE:
der_free_sequence_flexi((void*)ext->asn1);
break;
case LTC_X509_CE_KEY_USAGE:
default:
break;