Fix an error path leak in do_ext_nconf()

Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 8605abf13523579ecab8b1f2a4bcb8354d94af79)

diff --git a/crypto/x509v3/v3_conf.c b/crypto/x509v3/v3_conf.c
index eeff8bd185022b453c4290269eecc96459506f70..c1b4c1a89f74f31123163db49b319733d361717a 100644 (file)
--- a/crypto/x509v3/v3_conf.c
+++ b/crypto/x509v3/v3_conf.c
@@ -135,11 +135,13 @@ static X509_EXTENSION *do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid,
             nval = NCONF_get_section(conf, value + 1);
         else
             nval = X509V3_parse_list(value);
-        if (sk_CONF_VALUE_num(nval) <= 0) {
+        if (nval == NULL || sk_CONF_VALUE_num(nval) <= 0) {
             X509V3err(X509V3_F_DO_EXT_NCONF,
                       X509V3_R_INVALID_EXTENSION_STRING);
             ERR_add_error_data(4, "name=", OBJ_nid2sn(ext_nid), ",section=",
                                value);
+            if (*value != '@')
+                sk_CONF_VALUE_free(nval);
             return NULL;
         }
         ext_struc = method->v2i(method, ctx, nval);