[openssl-users] Does STACK_OF(X509_NAME) need to be free'd when using SSL_load_client_CA_file?

[Viktor Dukhovni]

On Sat, May 09, 2015 at 05:16:22AM -0400, Jeffrey Walton wrote:

> Does STACK_OF(X509_NAME) need to be free'd when using SSL_load_client_CA_file?

Yes, unless it is passed to SSL_CTX_set_client_CA_list() which
takes ownership of the stack.  That is, you must not free a stack
that is passed to that function, because the stack will be freed
when the context is freed.

> s_server.c uses it like so, but I'm not sure if its correct:
> 
>     if (caFile != NULL) {
>         SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(caFile));

This is correct.

> Or does SSL_CTX_set_client_CA_list take ownership or assign ownership
> to the context?

It takes ownership.  

By the way, there is an implementation oddity in SSL_load_client_CA_file().
It builds two stacks, one of which is always freed.  I don't know
why.  The second seems to be used for duplicate detection, but I
fail to see why the returned stack can't be used for that.

-- 
	Viktor.