[openssl/openssl] ad6335: crypto/x509/x509_lu.c: avoid freeing X509_OBJECTs ...

[esyr]

Branch: refs/heads/openssl-4.1
Home: https://github.com/openssl/openssl
Commit: ad6335398b8aad67b5feb15f3269cbd1fb8bb235
https://github.com/openssl/openssl/commit/ad6335398b8aad67b5feb15f3269cbd1fb8bb235
Author: Eugene Syromiatnikov <es...@openssl.org>
Date: 2026-10-13 (Tue, 13 Oct 2026)

Changed paths:
M crypto/x509/x509_lu.c
M doc/man3/X509_STORE_get0_param.pod

Log Message:
-----------
crypto/x509/x509_lu.c: avoid freeing X509_OBJECTs in X509_STORE_get0_objects()

The implementation of hash table conversion in commit 04589b59ef50
"x509store: reduce lock contention in X509_STORE" introduced a potential
use-after-free condition when X509_STORE_get0_objects() is called during
X.509 verification. Avoid that by re-using existing X509_OBJECTs
instead of duplicating them.

Resolves: https://github.com/openssl/openssl/issues/33063
Fixes: 04589b59ef50 "x509store: reduce lock contention in X509_STORE"
Signed-off-by: Eugene Syromiatnikov <es...@openssl.org>
Reviewed-by: Mounir Idrassi <mounir....@idrix.fr>
Reviewed-by: Nikola Pajkovsky <nik...@openssl.org>
Merge-date: Tue Oct 13 13:45:39 2026
Merged-from: https://github.com/openssl/openssl/pull/33147
(cherry picked from commit b86b1098fd7ec47e1c9d43a7566bf4e287b1d390)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications