Fix memory leaks in openssl_cms_encrypt() when push fails

ndossche · ndossche · commit f6887f04f623 · 2026-02-17T21:39:51.000+01:00
diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
@@ -6464,7 +6464,10 @@ PHP_FUNCTION(openssl_cms_encrypt)
 					goto clean_exit;
 				}
 			}
-			sk_X509_push(recipcerts, cert);
+			if (sk_X509_push(recipcerts, cert) <= 0) {
+				php_openssl_store_errors();
+				goto clean_exit;
+			}
 		} ZEND_HASH_FOREACH_END();
 	} else {
 		/* a single certificate */
@@ -6484,7 +6487,10 @@ PHP_FUNCTION(openssl_cms_encrypt)
 				goto clean_exit;
 			}
 		}
-		sk_X509_push(recipcerts, cert);
+		if (sk_X509_push(recipcerts, cert) <= 0) {
+			php_openssl_store_errors();
+			goto clean_exit;
+		}
 	}
 
 	/* sanity check the cipher */

Original file line number	Diff line number	Diff line change
`@@ -6464,7 +6464,10 @@ PHP_FUNCTION(openssl_cms_encrypt)`
`6464`	`6464`	`goto clean_exit;`
`6465`	`6465`	`}`
`6466`	`6466`	`}`
`6467`		`- sk_X509_push(recipcerts, cert);`
	`6467`	`+ if (sk_X509_push(recipcerts, cert) <= 0) {`
	`6468`	`+ php_openssl_store_errors();`
	`6469`	`+ goto clean_exit;`
	`6470`	`+ }`
`6468`	`6471`	`} ZEND_HASH_FOREACH_END();`
`6469`	`6472`	`} else {`
`6470`	`6473`	`/* a single certificate */`
`@@ -6484,7 +6487,10 @@ PHP_FUNCTION(openssl_cms_encrypt)`
`6484`	`6487`	`goto clean_exit;`
`6485`	`6488`	`}`
`6486`	`6489`	`}`
`6487`		`- sk_X509_push(recipcerts, cert);`
	`6490`	`+ if (sk_X509_push(recipcerts, cert) <= 0) {`
	`6491`	`+ php_openssl_store_errors();`
	`6492`	`+ goto clean_exit;`
	`6493`	`+ }`
`6488`	`6494`	`}`
`6489`	`6495`
`6490`	`6496`	`/* sanity check the cipher */`