Commit 0dfd4cbc6d for openssl.org
commit 0dfd4cbc6d11788a4ae61a6ae86b981f403455c3
Author: Greensi7 <adam.tabak04@gmail.com>
Date: Thu Oct 29 16:38:49 2026 +0100
crypto/asn1/asn1_lib.c: fix memory leak in ossl_asn1_string_set_internal()
A zero length ASN1_STRING can own a one byte NULL buffer. When
it is set again, passing NULL to OPENSSL_realloc() leaks that buffer.
Fixes: 28179061bfcd "Prepare a now opaque ASN1_STRING for the size_t rapture."
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Merge-date: Sat Nov 7 11:41:46 2026
Merged-from: https://github.com/openssl/openssl/pull/33210
diff --git a/crypto/asn1/asn1_lib.c b/crypto/asn1/asn1_lib.c
index a216525f8d..dfd48b69f1 100644
--- a/crypto/asn1/asn1_lib.c
+++ b/crypto/asn1/asn1_lib.c
@@ -433,7 +433,7 @@ int ossl_asn1_string_set_internal(ASN1_STRING *str, const uint8_t *data,
if ((size_t)str->length != alloc_len) {
uint8_t *c;
- c = OPENSSL_realloc(str->length == 0 ? NULL : str->data, alloc_len);
+ c = OPENSSL_realloc(str->data, alloc_len);
if (c == NULL)
return 0;
str->data = c;