diff options
| author | Yann Ylavic <ylavic@apache.org> | 2020-02-27 13:34:03 +0100 |
|---|---|---|
| committer | Yann Ylavic <ylavic@apache.org> | 2020-02-27 13:34:03 +0100 |
| commit | a4c4586997828c20bdccad6a290603592b9d2c30 (patch) | |
| tree | 732d1a79784a13392ecc4ae76157ce7c70a5f693 /modules/ssl | |
| parent | "?:" is a GNU extension, use standard syntax (diff) | |
| download | apache2-a4c4586997828c20bdccad6a290603592b9d2c30.tar.xz apache2-a4c4586997828c20bdccad6a290603592b9d2c30.zip | |
mod_ssl: Fix memory leak of OCSP stapling response.
The OCSP_RESPONSE is either ignored or serialized (i2d_OCSP_RESPONSE) in the
TLS response/handshake extension, so it must be freed.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1874574 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'modules/ssl')
| -rw-r--r-- | modules/ssl/ssl_util_stapling.c | 28 |
1 files changed, 18 insertions, 10 deletions
diff --git a/modules/ssl/ssl_util_stapling.c b/modules/ssl/ssl_util_stapling.c index 8bb6e7c6c0..32a838a07a 100644 --- a/modules/ssl/ssl_util_stapling.c +++ b/modules/ssl/ssl_util_stapling.c @@ -870,17 +870,25 @@ static int stapling_cb(SSL *ssl, void *arg) } } - if (rsp && ((ok == TRUE) || (mctx->stapling_return_errors == TRUE))) { - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01956) - "stapling_cb: setting response"); - if (!stapling_set_response(ssl, rsp)) - return SSL_TLSEXT_ERR_ALERT_FATAL; - return SSL_TLSEXT_ERR_OK; + rv = SSL_TLSEXT_ERR_NOACK; + if (!rsp) { + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01957) + "stapling_cb: no suitable response available"); } - ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01957) - "stapling_cb: no suitable response available"); - - return SSL_TLSEXT_ERR_NOACK; + else { + if (ok == TRUE || mctx->stapling_return_errors == TRUE) { + ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01956) + "stapling_cb: setting response"); + if (!stapling_set_response(ssl, rsp)) { + rv = SSL_TLSEXT_ERR_ALERT_FATAL; + } + else { + rv = SSL_TLSEXT_ERR_OK; + } + } + OCSP_RESPONSE_free(rsp); + } + return rv; } |