From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Wed, 9 Sep 2026 09:06:00 +0000 (+0200)
Subject: BUG/MINOR: ssl: Fix leak of ca_list in cafile_entry
X-Git-Tag: v3.5-dev7~21
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=209c027c1a02791f80400f37c54bcc1718be30b6;p=haproxy.git

BUG/MINOR: ssl: Fix leak of ca_list in cafile_entry

The list of X509_NAMEs was not freed when deleting cafile entries.

This patch should be backported to all stable branches.
---

diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index a4928e108..5d1bd86ab 100644
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -1426,6 +1426,8 @@ void ssl_store_delete_cafile_entry(struct cafile_entry *ca_e)
 	if (!ca_e)
 		return;
 
+	sk_X509_NAME_pop_free(ca_e->ca_list, X509_NAME_free);
+
 	X509_STORE_free(ca_e->ca_store);
 
 	list_for_each_entry_safe(link, link_s, &ca_e->ckch_inst_link, list) {