dane_match_cert() should X509_free() on ->mcert instead

Sashan · nhorman · commit 7a4e08cee62a · 2026-03-05T07:43:14.000-05:00
of OPENSSL_free() Fixes: 170b735 "DANE support for X509_verify_cert()" Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Neil Horman <nhorman@openssl.org> MergeDate: Thu Mar 5 12:37:17 2026 (Merged from #30250) (cherry picked from commit 8b5cd6a)
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
@@ -2938,7 +2938,7 @@ static int dane_match_cert(X509_STORE_CTX *ctx, X509 *cert, int depth)
             if (matched || dane->mdpth < 0) {
                 dane->mdpth = depth;
                 dane->mtlsa = t;
-                OPENSSL_free(dane->mcert);
+                X509_free(dane->mcert);
                 dane->mcert = cert;
                 X509_up_ref(cert);
             }

Original file line number	Diff line number	Diff line change
`@@ -2938,7 +2938,7 @@ static int dane_match_cert(X509_STORE_CTX ctx, X509 cert, int depth)`
`2938`	`2938`	`if (matched \|\| dane->mdpth < 0) {`
`2939`	`2939`	`dane->mdpth = depth;`
`2940`	`2940`	`dane->mtlsa = t;`
`2941`		`- OPENSSL_free(dane->mcert);`
	`2941`	`+ X509_free(dane->mcert);`
`2942`	`2942`	`dane->mcert = cert;`
`2943`	`2943`	`X509_up_ref(cert);`
`2944`	`2944`	`}`