Skip to content

schannel_verify: fix mem-leak in Curl_verify_host #18972

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
bagder wants to merge 1 commit into from
Closed

schannel_verify: fix mem-leak in Curl_verify_host #18972

bagder wants to merge 1 commit into from

Conversation

@bagder
Copy link
Member

@bagder bagder commented Oct 9, 2025

Reported-by: Stanislav Fort

@bagder bagder requested a review from jay October 9, 2025 11:19
@bagder bagder added memory-leak TLS Windows Windows-specific labels Oct 9, 2025
@bagder bagder marked this pull request as ready for review October 9, 2025 11:22
@jay
Copy link
Member

jay commented Oct 9, 2025 •
edited
Loading

Looks right to me. We call CryptDecodeObjectEx with CRYPT_DECODE_ALLOC_FLAG which defaults to using LocalAlloc/LocalFree.

curl/lib/vtls/schannel_verify.c

Lines 522 to 529 in 11b9912

if(!CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
szOID_SUBJECT_ALT_NAME2,
extension->Value.pbData,
extension->Value.cbData,
CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_NOCOPY_FLAG,
&decode_para,
alt_name_info,
alt_name_info_size)) {

@bagder bagder closed this in 1e6d507 Oct 9, 2025
@bagder bagder deleted the bagder/schannel-leak branch October 9, 2025 19:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jay jay jay approved these changes

Assignees

No one assigned

Labels

memory-leak TLS Windows Windows-specific

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bagder @jay