From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Thu, 1 Oct 2026 14:59:26 +0000 (+0200)
Subject: MINOR: ocsp: Dup OCSP_CERTID in ssl_ocsp_create_request_details
X-Git-Tag: v3.5-dev9~221
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=56dc04775f5c9ba070176bb21ebd3c2ad08c63d8;p=haproxy.git

MINOR: ocsp: Dup OCSP_CERTID in ssl_ocsp_create_request_details

Instead of giving our only reference to the OCSP_CERTID to the
OCSP_REQUEST in ssl_ocsp_create_request_details we will duplicate it and
let the caller free it.
---

diff --git a/src/ssl_ocsp.c b/src/ssl_ocsp.c
index 5490bfde9..adb224025 100644
--- a/src/ssl_ocsp.c
+++ b/src/ssl_ocsp.c
@@ -829,6 +829,8 @@ end:
  * certid we will either append data to the <req_url> to create a proper URL
  * that will be sent with a GET command, or the <req_body> will be constructed
  * in case of a POST.
+ * The provided OCSP_CERTID will be duplicated before being added to the
+ * OCSP_REQUEST so the caller is expected to free the provided certid if needed.
  * Returns 0 in case of success.
  */
 int ssl_ocsp_create_request_details(const OCSP_CERTID *certid, struct buffer *req_url,
@@ -838,6 +840,7 @@ int ssl_ocsp_create_request_details(const OCSP_CERTID *certid, struct buffer *re
 	OCSP_REQUEST *ocsp;
 	struct buffer *bin_request = get_trash_chunk();
 	unsigned char *outbuf = (unsigned char*)b_orig(bin_request);
+	OCSP_CERTID *cid = NULL;
 
 	ocsp = OCSP_REQUEST_new();
 	if (ocsp == NULL) {
@@ -845,8 +848,15 @@ int ssl_ocsp_create_request_details(const OCSP_CERTID *certid, struct buffer *re
 		goto end;
 	}
 
-	if (OCSP_request_add0_id(ocsp, (OCSP_CERTID*)certid) == NULL) {
+	cid = OCSP_CERTID_dup((OCSP_CERTID*)certid);
+	if (!cid) {
+		memprintf(err, "%sOCSP_CERTID_dup() error\n", *err ? *err : "");
+		goto end;
+	}
+
+	if (OCSP_request_add0_id(ocsp, cid) == NULL) {
 		memprintf(err, "%sOCSP_request_add0_id() error\n", *err ? *err : "");
+		OCSP_CERTID_free(cid);
 		goto end;
 	}
 
@@ -1507,12 +1517,14 @@ leave:
 	ctx->hc = NULL;
 	free_trash_chunk(req_url);
 	free_trash_chunk(req_body);
+	OCSP_CERTID_free(certid);
 	task->expire = tick_add(now_ms, next_wakeup);
 	return task;
 
 wait:
 	free_trash_chunk(req_url);
 	free_trash_chunk(req_body);
+	OCSP_CERTID_free(certid);
 	task->expire = TICK_ETERNITY;
 	return task;