[openssl/openssl] cd80d0: test/cmp_vfy_test.c: prevent memory leak in test_m...

[jdymitarai]

Branch: refs/heads/openssl-3.4
Home: https://github.com/openssl/openssl
Commit: cd80d0b6e6b29f9879f0c55c7ce6e6aa0ea53ffa
https://github.com/openssl/openssl/commit/cd80d0b6e6b29f9879f0c55c7ce6e6aa0ea53ffa
Author: jdymitarai <o100...@gmail.com>
Date: 2026-10-15 (Thu, 15 Oct 2026)

Changed paths:
M test/cmp_vfy_test.c

Log Message:
-----------
test/cmp_vfy_test.c: prevent memory leak in test_msg_check_update_malicious_sender

In test_msg_check_update_malicious_sender(), expected and actual
were allocated via X509_NAME_new() prior to SETUP_TEST_FIXTURE().
If set_up() failed, SETUP_TEST_FIXTURE() returned early, leaking
both allocated X509_NAME objects.

Defer allocation until after SETUP_TEST_FIXTURE(), initialize both
pointers to NULL, and allocate them safely within the TEST_ptr()
validation chain. On setup or validation failure, both pointers
and the test fixture are freed cleanly.

Resolves: https://github.com/openssl/openssl/issues/33200
Fixes: 196a4b978499 "Add test for CVE-2026-63073"
CLA: trivial
Signed-off-by: jdymitarai <o100...@gmail.com>
Reviewed-by: Neil Horman <nho...@openssl.org>
Reviewed-by: Eugene Syromiatnikov <es...@openssl.org>
Reviewed-by: Nikola Pajkovsky <nik...@openssl.org>
Merge-date: Thu Oct 15 11:51:16 2026
Merged-from: https://github.com/openssl/openssl/pull/33203
(cherry picked from commit 6d76833d61fad07a171219d9cb1444bc37f88b8f)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications