From 5347a7bd2802824b96a082ca0baa6c82e6c7ebce Mon Sep 17 00:00:00 2001 From: Igor Ustinov Date: Sat, 16 May 2026 08:16:23 +0200 Subject: [PATCH] Fix possible use-after-free in OpenSSL PKCS7_verify() Fixes CVE-2026-45447 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Norbert Pocs MergeDate: Mon Jun 8 20:32:32 2026 --- crypto/pkcs7/pk7_smime.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/crypto/pkcs7/pk7_smime.c b/crypto/pkcs7/pk7_smime.c index 0fe603169d..159e3be4a0 100644 --- a/crypto/pkcs7/pk7_smime.c +++ b/crypto/pkcs7/pk7_smime.c @@ -219,6 +219,7 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store, int i, j = 0, k, ret = 0; BIO *p7bio = NULL; BIO *tmpout = NULL; + BIO *next = NULL; const PKCS7_CTX *p7_ctx; if (p7 == NULL) { @@ -345,9 +346,11 @@ err: BIO_free(tmpout); X509_STORE_CTX_free(cert_ctx); OPENSSL_free(buf); - if (indata != NULL) - BIO_pop(p7bio); - BIO_free_all(p7bio); + while (p7bio != NULL && p7bio != indata) { + next = BIO_pop(p7bio); + BIO_free(p7bio); + p7bio = next; + } sk_X509_free(signers); return ret; } -- 2.55.0