Fix memory leaks in openssl_pkcs7_encrypt() when push fails

ndossche · ndossche · commit 556ec779512b · 2026-02-17T21:39:51.000+01:00
diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
@@ -5849,7 +5849,10 @@ PHP_FUNCTION(openssl_pkcs7_encrypt)
 					goto clean_exit;
 				}
 			}
-			sk_X509_push(recipcerts, cert);
+			if (sk_X509_push(recipcerts, cert) <= 0) {
+				X509_free(cert);
+				goto clean_exit;
+			}
 		} ZEND_HASH_FOREACH_END();
 	} else {
 		/* a single certificate */
@@ -5870,7 +5873,10 @@ PHP_FUNCTION(openssl_pkcs7_encrypt)
 				goto clean_exit;
 			}
 		}
-		sk_X509_push(recipcerts, cert);
+		if (sk_X509_push(recipcerts, cert) <= 0) {
+			X509_free(cert);
+			goto clean_exit;
+		}
 	}
 
 	/* sanity check the cipher */

Original file line number	Diff line number	Diff line change
`@@ -5849,7 +5849,10 @@ PHP_FUNCTION(openssl_pkcs7_encrypt)`
`5849`	`5849`	`goto clean_exit;`
`5850`	`5850`	`}`
`5851`	`5851`	`}`
`5852`		`- sk_X509_push(recipcerts, cert);`
	`5852`	`+ if (sk_X509_push(recipcerts, cert) <= 0) {`
	`5853`	`+ X509_free(cert);`
	`5854`	`+ goto clean_exit;`
	`5855`	`+ }`
`5853`	`5856`	`} ZEND_HASH_FOREACH_END();`
`5854`	`5857`	`} else {`
`5855`	`5858`	`/* a single certificate */`
`@@ -5870,7 +5873,10 @@ PHP_FUNCTION(openssl_pkcs7_encrypt)`
`5870`	`5873`	`goto clean_exit;`
`5871`	`5874`	`}`
`5872`	`5875`	`}`
`5873`		`- sk_X509_push(recipcerts, cert);`
	`5876`	`+ if (sk_X509_push(recipcerts, cert) <= 0) {`
	`5877`	`+ X509_free(cert);`
	`5878`	`+ goto clean_exit;`
	`5879`	`+ }`
`5874`	`5880`	`}`
`5875`	`5881`
`5876`	`5882`	`/* sanity check the cipher */`