From 4379d5ce782d4cc83840db7b7b66e18d325dfd3e Mon Sep 17 00:00:00 2001 From: Todd Short Date: Wed, 25 May 2016 20:56:48 -0400 Subject: [PATCH] Fix ssl_cert_set0_chain invalid pointer When setting the certificate chain, if a certificate doesn't pass security checks, then chain may point to a freed STACK_OF(X509) Reviewed-by: Rich Salz Reviewed-by: Matt Caswell --- ssl/ssl_cert.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c index 7481705ed0..d668afafe7 100644 --- a/ssl/ssl_cert.c +++ b/ssl/ssl_cert.c @@ -267,7 +267,6 @@ int ssl_cert_set0_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain) CERT_PKEY *cpk = s ? s->cert->key : ctx->cert->key; if (!cpk) return 0; - sk_X509_pop_free(cpk->chain, X509_free); for (i = 0; i < sk_X509_num(chain); i++) { r = ssl_security_cert(s, ctx, sk_X509_value(chain, i), 0, 0); if (r != 1) { @@ -275,6 +274,7 @@ int ssl_cert_set0_chain(SSL *s, SSL_CTX *ctx, STACK_OF(X509) *chain) return 0; } } + sk_X509_pop_free(cpk->chain, X509_free); cpk->chain = chain; return 1; } -- 2.34.1