sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-01-28 20:12:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

[x509] Ensure certificate remains valid during x509_append()

Browse Source 
The allocation of memory for the certificate chain link may cause the
certificate itself to be freed by the cache discarder, if the only
current reference to the certificate is held by the certificate store
and the system runs out of memory during the call to malloc().

Ensure that this cannot happen by taking out a temporary additional
reference to the certificate within x509_append(), rather than
requiring the caller to do so.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2025-03-31 17:44:59 +01:00
parent a289b4b8c2
commit 0a48bb3214
2 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/crypto/x509.c
View File

@@ -1634,11 +1634,17 @@ struct x509_chain * x509_alloc_chain ( void ) {
*/
int x509_append ( struct x509_chain *chain, struct x509_certificate *cert ) {
struct x509_link *link;
int rc;
/* Ensure allocation of link cannot invalidate certificate */
x509_get ( cert );
/* Allocate link */
link = zalloc ( sizeof ( *link ) );
if ( ! link )
return -ENOMEM;
if ( ! link ) {
rc = -ENOMEM;
goto err_alloc;
}
/* Add link to chain */
link->cert = x509_get ( cert );
@@ -1646,7 +1652,12 @@ int x509_append ( struct x509_chain *chain, struct x509_certificate *cert ) {
DBGC ( chain, "X509 chain %p added X509 %p \"%s\"\n",
chain, cert, x509_name ( cert ) );
return 0;
/* Success */
rc = 0;
x509_put ( cert );
err_alloc:
return rc;
}
/**