commit bb8428f762b3632f493572c4f73957e1281ade79
author Kenny Root <kroot@google.com> Mon Sep 09 18:43:37 2013 -0700
committer Kenny Root <kroot@google.com> Mon Sep 09 19:18:05 2013 -0700
tree fa1d8a0214c1fa98f59569b9bd1e60ed34b49c84
parent afd3666daae38a89eb3369a19dfd171fb82c2979

Fix leak in setting certificate chain patch

Android has a custom certificate chain patch that didn't check whether
the cert_chain was already set when setting the new chain. This results
in a leak of all the X509 instances in the stack of certificates.

Bug: 10610037
Change-Id: I62433671ef18b06cafa5ec18e7b2e6190ce4504d

patches/jsse.patch

diff --git a/patches/jsse.patch b/patches/jsse.patch
index e4fa3b4..795a2bb 100644
--- a/patches/jsse.patch
+++ b/patches/jsse.patch
@@ -352,7 +352,7 @@
  
 --- openssl-1.0.0b.orig/ssl/ssl_rsa.c	2009-09-12 23:09:26.000000000 +0000
 +++ openssl-1.0.0b/ssl/ssl_rsa.c	2010-11-30 00:03:47.000000000 +0000
-@@ -697,6 +697,42 @@ int SSL_CTX_use_PrivateKey_ASN1(int type
+@@ -697,6 +697,44 @@ int SSL_CTX_use_PrivateKey_ASN1(int type
  	}
  
  
@@ -373,6 +373,8 @@
 +		SSLerr(SSL_F_SSL_USE_CERTIFICATE_CHAIN,SSL_R_NO_CERTIFICATE_ASSIGNED);
 +		return(0);
 +		}
++	if (ssl->cert->key->cert_chain != NULL)
++		sk_X509_pop_free(ssl->cert->key->cert_chain, X509_free);
 +	ssl->cert->key->cert_chain = cert_chain;
 +	return(1);
 +	}

ssl/ssl_rsa.c

diff --git a/ssl/ssl_rsa.c b/ssl/ssl_rsa.c
index 82f55b6..e98e862 100644
--- a/ssl/ssl_rsa.c
+++ b/ssl/ssl_rsa.c
@@ -714,6 +714,8 @@
 		SSLerr(SSL_F_SSL_USE_CERTIFICATE_CHAIN,SSL_R_NO_CERTIFICATE_ASSIGNED);
 		return(0);
 		}
+	if (ssl->cert->key->cert_chain != NULL)
+		sk_X509_pop_free(ssl->cert->key->cert_chain, X509_free);
 	ssl->cert->key->cert_chain = cert_chain;
 	return(1);
 	}