Skip to content

Conversation

@x2018
Copy link
Contributor

@x2018 x2018 commented Nov 16, 2025

When CryptQueryObject returns a context of unexpected type, the cert_context was not freed.
This could be exploited by malicious servers providing specially crafted CA files.

@github-actions github-actions bot added TLS Windows Windows-specific labels Nov 16, 2025
@x2018 x2018 marked this pull request as draft November 17, 2025 01:11
@x2018
Copy link
Contributor Author

x2018 commented Nov 17, 2025

I unify the handling at one place. According to the document of CryptQueryObject at https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptqueryobject, the output type of last parameter (cert_context) is based on the dwContentType (i.e., actual_content_type). So I also try to clean the resource based on actual_content_type.
Other: The API is deprecated. We may need to update the implementation in the future.

@x2018 x2018 marked this pull request as ready for review November 17, 2025 03:15
@bagder bagder closed this in a6c940a Nov 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

TLS Windows Windows-specific

Development

Successfully merging this pull request may close these issues.

3 participants