[openssl-dev] memory leak?

[Wall, Stephen]

This looks like a potential memory leak to me...

openssl-1.0.2e/crypto/x509/x509_lu.c:

X509_STORE *X509_STORE_new(void)
{
    X509_STORE *ret;

    if ((ret = (X509_STORE *)OPENSSL_malloc(sizeof(X509_STORE))) == NULL)
        return NULL;
    ret->objs = sk_X509_OBJECT_new(x509_object_cmp);
    ret->cache = 1;
    ret->get_cert_methods = sk_X509_LOOKUP_new_null();
    ret->verify = 0;
    ret->verify_cb = 0;

    if ((ret->param = X509_VERIFY_PARAM_new()) == NULL)
        return NULL;


If X509_VERIFY_PARAM_new() fails, function returns NULL without freeing ret.


- spw