Skip to content

schannel_verify: fix a memory leak of cert_context#19556

Closed
x2018 wants to merge 7 commits into
curl:masterfrom
x2018:schannel_verify_memleak
Closed

schannel_verify: fix a memory leak of cert_context#19556
x2018 wants to merge 7 commits into
curl:masterfrom
x2018:schannel_verify_memleak

Conversation

@x2018

@x2018 x2018 commented Nov 16, 2025

Copy link
Copy Markdown
Contributor

When CryptQueryObject returns a context of unexpected type, the cert_context was not freed.
This could be exploited by malicious servers providing specially crafted CA files.

@github-actions github-actions Bot added TLS Windows Windows-specific labels Nov 16, 2025
Comment thread lib/vtls/schannel_verify.c Outdated
@x2018
x2018 marked this pull request as draft November 17, 2025 01:11
Comment thread lib/vtls/schannel_verify.c Outdated
@x2018

x2018 commented Nov 17, 2025

Copy link
Copy Markdown
Contributor Author

I unify the handling at one place. According to the document of CryptQueryObject at https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptqueryobject, the output type of last parameter (cert_context) is based on the dwContentType (i.e., actual_content_type). So I also try to clean the resource based on actual_content_type.
Other: The API is deprecated. We may need to update the implementation in the future.

@x2018
x2018 marked this pull request as ready for review November 17, 2025 03:15
@bagder bagder closed this in a6c940a Nov 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

TLS Windows Windows-specific

Development

Successfully merging this pull request may close these issues.

3 participants