On Sat, May 09, 2015 at 05:16:22AM -0400, Jeffrey Walton wrote:
> Does STACK_OF(X509_NAME) need to be free'd when using SSL_load_client_CA_file?
Yes, unless it is passed to SSL_CTX_set_client_CA_list() which
takes ownership of the stack. That is, you must not free a stack
that is passed to that function, because the stack will be freed
when the context is freed.
> s_server.c uses it like so, but I'm not sure if its correct:
>
> if (caFile != NULL) {
> SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(caFile));
This is correct.
> Or does SSL_CTX_set_client_CA_list take ownership or assign ownership
> to the context?
It takes ownership.
By the way, there is an implementation oddity in SSL_load_client_CA_file().
It builds two stacks, one of which is always freed. I don't know
why. The second seems to be used for duplicate detection, but I
fail to see why the returned stack can't be used for that.
--
Viktor.
