Fix memory leak in libpq when using sslmode=verify-full

michaelpq · michaelpq · commit 1bb0293d8445 · 2020-04-22T07:27:53.000+09:00
Checking if Subject Alternative Names (SANs) from a certificate match with the hostname connected to leaked memory after each lookup done. This is broken since acd08d7 that added support for SANs in SSL certificates, so backpatch down to 9.5. Author: Roman Peshkurov Reviewed-by: Hamid Akhtar, Michael Paquier, David Steele Discussion: https://postgr.es/m/CALLDf-pZ-E3mjxd5=bnHsDu9zHEOnpgPgdnO84E2RuwMCjjyPw@mail.gmail.com Backpatch-through: 9.5
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
@@ -627,7 +627,7 @@ verify_peer_name_matches_certificate(PGconn *conn)
 			if (found_match || got_error)
 				break;
 		}
-		sk_GENERAL_NAME_free(peer_san);
+		sk_GENERAL_NAME_pop_free(peer_san, GENERAL_NAME_free);
 	}
 
 	/*

Original file line number	Diff line number	Diff line change
`@@ -627,7 +627,7 @@ verify_peer_name_matches_certificate(PGconn *conn)`
`627`	`627`	`if (found_match \|\| got_error)`
`628`	`628`	`break;`
`629`	`629`	`}`
`630`		`- sk_GENERAL_NAME_free(peer_san);`
	`630`	`+ sk_GENERAL_NAME_pop_free(peer_san, GENERAL_NAME_free);`
`631`	`631`	`}`
`632`	`632`
`633`	`633`	`/*`