Skip to content

Commit 558091d

Browse files
obiltschnigobiltschnig
committed
fixed a memory leak if the CA file was not found while creating the Context (the OpenSSL context would leak)
1 parent d74bd7b commit 558091d

1 file changed

Lines changed: 82 additions & 72 deletions

File tree

‎NetSSL_OpenSSL/src/Context.cpp‎

Lines changed: 82 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -50,64 +50,68 @@ Context::Context(
5050

5151
createSSLContext();
5252

53-
int errCode = 0;
54-
if (!caLocation.empty())
53+
try
5554
{
56-
Poco::File aFile(caLocation);
57-
if (aFile.isDirectory())
58-
errCode = SSL_CTX_load_verify_locations(_pSSLContext, 0, Poco::Path::transcode(caLocation).c_str());
59-
else
60-
errCode = SSL_CTX_load_verify_locations(_pSSLContext, Poco::Path::transcode(caLocation).c_str(), 0);
61-
if (errCode != 1)
55+
int errCode = 0;
56+
if (!caLocation.empty())
6257
{
63-
std::string msg = Utility::getLastError();
64-
SSL_CTX_free(_pSSLContext);
65-
throw SSLContextException(std::string("Cannot load CA file/directory at ") + caLocation, msg);
58+
Poco::File aFile(caLocation);
59+
if (aFile.isDirectory())
60+
errCode = SSL_CTX_load_verify_locations(_pSSLContext, 0, Poco::Path::transcode(caLocation).c_str());
61+
else
62+
errCode = SSL_CTX_load_verify_locations(_pSSLContext, Poco::Path::transcode(caLocation).c_str(), 0);
63+
if (errCode != 1)
64+
{
65+
std::string msg = Utility::getLastError();
66+
throw SSLContextException(std::string("Cannot load CA file/directory at ") + caLocation, msg);
67+
}
6668
}
67-
}
6869

69-
if (loadDefaultCAs)
70-
{
71-
errCode = SSL_CTX_set_default_verify_paths(_pSSLContext);
72-
if (errCode != 1)
70+
if (loadDefaultCAs)
7371
{
74-
std::string msg = Utility::getLastError();
75-
SSL_CTX_free(_pSSLContext);
76-
throw SSLContextException("Cannot load default CA certificates", msg);
72+
errCode = SSL_CTX_set_default_verify_paths(_pSSLContext);
73+
if (errCode != 1)
74+
{
75+
std::string msg = Utility::getLastError();
76+
throw SSLContextException("Cannot load default CA certificates", msg);
77+
}
7778
}
78-
}
7979

80-
if (!privateKeyFile.empty())
81-
{
82-
errCode = SSL_CTX_use_PrivateKey_file(_pSSLContext, Poco::Path::transcode(privateKeyFile).c_str(), SSL_FILETYPE_PEM);
83-
if (errCode != 1)
80+
if (!privateKeyFile.empty())
8481
{
85-
std::string msg = Utility::getLastError();
86-
SSL_CTX_free(_pSSLContext);
87-
throw SSLContextException(std::string("Error loading private key from file ") + privateKeyFile, msg);
82+
errCode = SSL_CTX_use_PrivateKey_file(_pSSLContext, Poco::Path::transcode(privateKeyFile).c_str(), SSL_FILETYPE_PEM);
83+
if (errCode != 1)
84+
{
85+
std::string msg = Utility::getLastError();
86+
throw SSLContextException(std::string("Error loading private key from file ") + privateKeyFile, msg);
87+
}
8888
}
89-
}
9089

91-
if (!certificateFile.empty())
92-
{
93-
errCode = SSL_CTX_use_certificate_chain_file(_pSSLContext, Poco::Path::transcode(certificateFile).c_str());
94-
if (errCode != 1)
90+
if (!certificateFile.empty())
9591
{
96-
std::string errMsg = Utility::getLastError();
97-
SSL_CTX_free(_pSSLContext);
98-
throw SSLContextException(std::string("Error loading certificate from file ") + certificateFile, errMsg);
92+
errCode = SSL_CTX_use_certificate_chain_file(_pSSLContext, Poco::Path::transcode(certificateFile).c_str());
93+
if (errCode != 1)
94+
{
95+
std::string errMsg = Utility::getLastError();
96+
throw SSLContextException(std::string("Error loading certificate from file ") + certificateFile, errMsg);
97+
}
9998
}
100-
}
10199

102-
if (isForServerUse())
103-
SSL_CTX_set_verify(_pSSLContext, verificationMode, &SSLManager::verifyServerCallback);
104-
else
105-
SSL_CTX_set_verify(_pSSLContext, verificationMode, &SSLManager::verifyClientCallback);
100+
if (isForServerUse())
101+
SSL_CTX_set_verify(_pSSLContext, verificationMode, &SSLManager::verifyServerCallback);
102+
else
103+
SSL_CTX_set_verify(_pSSLContext, verificationMode, &SSLManager::verifyClientCallback);
106104

107-
SSL_CTX_set_cipher_list(_pSSLContext, cipherList.c_str());
108-
SSL_CTX_set_verify_depth(_pSSLContext, verificationDepth);
109-
SSL_CTX_set_mode(_pSSLContext, SSL_MODE_AUTO_RETRY);
110-
SSL_CTX_set_session_cache_mode(_pSSLContext, SSL_SESS_CACHE_OFF);
105+
SSL_CTX_set_cipher_list(_pSSLContext, cipherList.c_str());
106+
SSL_CTX_set_verify_depth(_pSSLContext, verificationDepth);
107+
SSL_CTX_set_mode(_pSSLContext, SSL_MODE_AUTO_RETRY);
108+
SSL_CTX_set_session_cache_mode(_pSSLContext, SSL_SESS_CACHE_OFF);
109+
}
110+
catch (...)
111+
{
112+
SSL_CTX_free(_pSSLContext);
113+
throw;
114+
}
111115
}
112116

113117

@@ -127,42 +131,48 @@ Context::Context(
127131

128132
createSSLContext();
129133

130-
int errCode = 0;
131-
if (!caLocation.empty())
134+
try
132135
{
133-
Poco::File aFile(caLocation);
134-
if (aFile.isDirectory())
135-
errCode = SSL_CTX_load_verify_locations(_pSSLContext, 0, Poco::Path::transcode(caLocation).c_str());
136-
else
137-
errCode = SSL_CTX_load_verify_locations(_pSSLContext, Poco::Path::transcode(caLocation).c_str(), 0);
138-
if (errCode != 1)
136+
int errCode = 0;
137+
if (!caLocation.empty())
139138
{
140-
std::string msg = Utility::getLastError();
141-
SSL_CTX_free(_pSSLContext);
142-
throw SSLContextException(std::string("Cannot load CA file/directory at ") + caLocation, msg);
139+
Poco::File aFile(caLocation);
140+
if (aFile.isDirectory())
141+
errCode = SSL_CTX_load_verify_locations(_pSSLContext, 0, Poco::Path::transcode(caLocation).c_str());
142+
else
143+
errCode = SSL_CTX_load_verify_locations(_pSSLContext, Poco::Path::transcode(caLocation).c_str(), 0);
144+
if (errCode != 1)
145+
{
146+
std::string msg = Utility::getLastError();
147+
throw SSLContextException(std::string("Cannot load CA file/directory at ") + caLocation, msg);
148+
}
143149
}
144-
}
145150

146-
if (loadDefaultCAs)
147-
{
148-
errCode = SSL_CTX_set_default_verify_paths(_pSSLContext);
149-
if (errCode != 1)
151+
if (loadDefaultCAs)
150152
{
151-
std::string msg = Utility::getLastError();
152-
SSL_CTX_free(_pSSLContext);
153-
throw SSLContextException("Cannot load default CA certificates", msg);
153+
errCode = SSL_CTX_set_default_verify_paths(_pSSLContext);
154+
if (errCode != 1)
155+
{
156+
std::string msg = Utility::getLastError();
157+
throw SSLContextException("Cannot load default CA certificates", msg);
158+
}
154159
}
155-
}
156160

157-
if (isForServerUse())
158-
SSL_CTX_set_verify(_pSSLContext, verificationMode, &SSLManager::verifyServerCallback);
159-
else
160-
SSL_CTX_set_verify(_pSSLContext, verificationMode, &SSLManager::verifyClientCallback);
161+
if (isForServerUse())
162+
SSL_CTX_set_verify(_pSSLContext, verificationMode, &SSLManager::verifyServerCallback);
163+
else
164+
SSL_CTX_set_verify(_pSSLContext, verificationMode, &SSLManager::verifyClientCallback);
161165

162-
SSL_CTX_set_cipher_list(_pSSLContext, cipherList.c_str());
163-
SSL_CTX_set_verify_depth(_pSSLContext, verificationDepth);
164-
SSL_CTX_set_mode(_pSSLContext, SSL_MODE_AUTO_RETRY);
165-
SSL_CTX_set_session_cache_mode(_pSSLContext, SSL_SESS_CACHE_OFF);
166+
SSL_CTX_set_cipher_list(_pSSLContext, cipherList.c_str());
167+
SSL_CTX_set_verify_depth(_pSSLContext, verificationDepth);
168+
SSL_CTX_set_mode(_pSSLContext, SSL_MODE_AUTO_RETRY);
169+
SSL_CTX_set_session_cache_mode(_pSSLContext, SSL_SESS_CACHE_OFF);
170+
}
171+
catch (...)
172+
{
173+
SSL_CTX_free(_pSSLContext);
174+
throw;
175+
}
166176
}
167177

168178

0 commit comments

Comments
 (0)