[openssl-users] Does STACK_OF(X509_NAME) need to be free'd when using SSL_load_client_CA_file?

[Jeffrey Walton]

Does STACK_OF(X509_NAME) need to be free'd when using SSL_load_client_CA_file?

s_server.c uses it like so, but I'm not sure if its correct:

if (caFile != NULL) {
SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(caFile));

Or does SSL_CTX_set_client_CA_list take ownership or assign ownership
to the context?

The man pages do not discuss the memory management requirements
(http://www.openssl.org/docs/ssl/SSL_load_client_CA_file.html and
https://www.openssl.org/docs/ssl/SSL_CTX_set_client_CA_list.html).
_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users

[Viktor Dukhovni]

On Sat, May 09, 2015 at 05:16:22AM -0400, Jeffrey Walton wrote:

> Does STACK_OF(X509_NAME) need to be free'd when using SSL_load_client_CA_file?

Yes, unless it is passed to SSL_CTX_set_client_CA_list() which
takes ownership of the stack. That is, you must not free a stack
that is passed to that function, because the stack will be freed
when the context is freed.

> s_server.c uses it like so, but I'm not sure if its correct:
>
> if (caFile != NULL) {
> SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(caFile));

This is correct.

> Or does SSL_CTX_set_client_CA_list take ownership or assign ownership
> to the context?

It takes ownership.

By the way, there is an implementation oddity in SSL_load_client_CA_file().
It builds two stacks, one of which is always freed. I don't know
why. The second seems to be used for duplicate detection, but I
fail to see why the returned stack can't be used for that.

--
Viktor.