Fix native memory leak on OCSP_Response #96561
Conversation
ghost
added
the
|
Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones Issue DetailsThis PR makes sure we parse OCSP_Response only once per certificate. This fixes a leak when We did not hit this before because the implementation generally retrieves the peer's certificate only once, but during renegotiation, we may ask for it multiple times.
|
|
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones Issue DetailsThis PR makes sure we parse OCSP_Response only once per certificate. This fixes a leak when We did not hit this before because the implementation generally retrieves the peer's certificate only once, but during renegotiation, we may ask for it multiple times.
|
|
All CI failures are Known Build Errors. |
|
/backport to release/8.0-staging |
|
/backport to release/7.0-staging |
|
Started backporting to release/8.0-staging: https://github.com/dotnet/runtime/actions/runs/7431377625 |
|
Started backporting to release/7.0-staging: https://github.com/dotnet/runtime/actions/runs/7431377941 |
|
Any ideas of when will this be available at the docker images? |
|
February if we get it approved in next few days. Likely month later otherwise as part of regular servicing cadence. |
6 participants
Fixes #96616.
This PR makes sure we parse OCSP_Response only once per certificate. This fixes a leak when
CryptoNative_SslGetPeerCertificateis called multiple times to retrieve the same certificate, as previously the already parsed OCSP_RESPONSE in X509 instance would be simply overwritten without freeing it.We did not hit this before because the implementation generally retrieves the peer's certificate only once, but during renegotiation, we may ask for it multiple times.