krb5 commit [krb5-1.22]: Fix leaks on error in PKINIT signed-data creation

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/ebbfc6eecb0be9559da4f682ab67ec9d49a3eabf
commit ebbfc6eecb0be9559da4f682ab67ec9d49a3eabf
Author: Greg Hudson <ghudson at mit.edu>
Date:   Sat Oct 24 20:48:51 2026 -0400

    Fix leaks on error in PKINIT signed-data creation
    
    In cms_signeddata_create(), free more allocated variables in the
    cleanup label to prevent them from leaking on error paths.  Also check
    the result of X509_STORE_CTX_get1_chain() before using it, to prevent
    a null dereference on allocation failure.  Reported by Brian Knoll.
    
    (cherry picked from commit f01d35b8df208e6b338b82269c1f82829e083220)
    
    ticket: 9271
    version_fixed: 1.22.3

 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index a16ae1bfe..bed0f65f6 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -1749,7 +1749,9 @@ cms_signeddata_create(krb5_context context,
     PKCS7_SIGNED *p7s = NULL;
     PKCS7_SIGNER_INFO *p7si = NULL;
     unsigned char *p;
-    STACK_OF(X509) * cert_stack = NULL;
+    STACK_OF(X509) *cert_stack = NULL, *certstack = NULL;
+    X509_STORE *certstore = NULL;
+    X509_STORE_CTX *certctx = NULL;
     ASN1_OCTET_STRING *digest_attr = NULL;
     EVP_MD_CTX *ctx;
     unsigned char md_data[EVP_MAX_MD_SIZE], *abuf = NULL;
@@ -1778,9 +1780,6 @@ cms_signeddata_create(krb5_context context,
         goto cleanup;
 
     if (id_cryptoctx->my_cert != NULL) {
-        X509_STORE *certstore = NULL;
-        X509_STORE_CTX *certctx;
-        STACK_OF(X509) *certstack = NULL;
         char buf[DN_BUF_LEN];
         unsigned int i = 0, size = 0;
 
@@ -1805,6 +1804,8 @@ cms_signeddata_create(krb5_context context,
             goto cleanup;
         }
         certstack = X509_STORE_CTX_get1_chain(certctx);
+        if (certstack == NULL)
+            goto cleanup;
         size = sk_X509_num(certstack);
         for (i = 0; i < size - 1; i++) {
             X509 *x = sk_X509_value(certstack, i);
@@ -1812,11 +1813,9 @@ cms_signeddata_create(krb5_context context,
             TRACE_PKINIT_CERT_CHAIN_NAME(context, (int)i, buf);
             sk_X509_push(cert_stack, X509_dup(x));
         }
-        X509_STORE_CTX_free(certctx);
-        X509_STORE_free(certstore);
-        sk_X509_pop_free(certstack, X509_free);
 
         p7s->cert = cert_stack;
+        cert_stack = NULL;
 
         /* fill-in PKCS7_SIGNER_INFO */
         if ((p7si = PKCS7_SIGNER_INFO_new()) == NULL)
@@ -1902,6 +1901,7 @@ cms_signeddata_create(krb5_context context,
         /* adder signer_info to pkcs7 signed */
         if (!PKCS7_add_signer(p7, p7si))
             goto cleanup2;
+        p7si = NULL;
     } /* we have a certificate */
 
     /* start on adding data to the pkcs7 signed */
@@ -1943,6 +1943,11 @@ cleanup2:
             X509_ALGOR_free(alg);
     }
 cleanup:
+    X509_STORE_CTX_free(certctx);
+    X509_STORE_free(certstore);
+    sk_X509_pop_free(cert_stack, X509_free);
+    sk_X509_pop_free(certstack, X509_free);
+    PKCS7_SIGNER_INFO_free(p7si);
     if (p7 != NULL)
         PKCS7_free(p7);
     free(sig);