Fix assorted error-cleanup bugs in SSL min/max protocol version code.

tglsfdc · tglsfdc · commit 6148e2b9a639 · 2020-02-02T13:09:33.000-05:00
The error exits added to initialize_SSL() failed to clean up the partially-built SSL_context, and some of them also leaked the result of SSLerrmessage(). Make them match other error-handling cases in that function. The error exits added to connectOptions2() failed to set conn->status like every other error exit in that function. In passing, make the SSL_get_peer_certificate() error exit look more like all the other calls of SSLerrmessage(). Oversights in commit ff8ca5f. Coverity whined about leakage of the SSLerrmessage() results; I noted the rest in manual code review.
diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c
@@ -1306,13 +1306,15 @@ connectOptions2(PGconn *conn)
 	 */
 	if (!sslVerifyProtocolVersion(conn->sslminprotocolversion))
 	{
+		conn->status = CONNECTION_BAD;
 		printfPQExpBuffer(&conn->errorMessage,
 						  libpq_gettext("invalid sslminprotocolversion value: \"%s\"\n"),
 						  conn->sslminprotocolversion);
 		return false;
 	}
 	if (!sslVerifyProtocolVersion(conn->sslmaxprotocolversion))
 	{
+		conn->status = CONNECTION_BAD;
 		printfPQExpBuffer(&conn->errorMessage,
 						  libpq_gettext("invalid sslmaxprotocolversion value: \"%s\"\n"),
 						  conn->sslmaxprotocolversion);
@@ -1329,6 +1331,7 @@ connectOptions2(PGconn *conn)
 	if (!sslVerifyProtocolRange(conn->sslminprotocolversion,
 								conn->sslmaxprotocolversion))
 	{
+		conn->status = CONNECTION_BAD;
 		printfPQExpBuffer(&conn->errorMessage,
 						  libpq_gettext("invalid SSL protocol version range"));
 		return false;
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
@@ -854,6 +854,7 @@ initialize_SSL(PGconn *conn)
 			printfPQExpBuffer(&conn->errorMessage,
 							  libpq_gettext("invalid value \"%s\" for minimum version of SSL protocol\n"),
 							  conn->sslminprotocolversion);
+			SSL_CTX_free(SSL_context);
 			return -1;
 		}
 
@@ -864,6 +865,8 @@ initialize_SSL(PGconn *conn)
 			printfPQExpBuffer(&conn->errorMessage,
 							  libpq_gettext("could not set minimum version of SSL protocol: %s\n"),
 							  err);
+			SSLerrfree(err);
+			SSL_CTX_free(SSL_context);
 			return -1;
 		}
 	}
@@ -880,6 +883,7 @@ initialize_SSL(PGconn *conn)
 			printfPQExpBuffer(&conn->errorMessage,
 							  libpq_gettext("invalid value \"%s\" for maximum version of SSL protocol\n"),
 							  conn->sslmaxprotocolversion);
+			SSL_CTX_free(SSL_context);
 			return -1;
 		}
 
@@ -890,6 +894,8 @@ initialize_SSL(PGconn *conn)
 			printfPQExpBuffer(&conn->errorMessage,
 							  libpq_gettext("could not set maximum version of SSL protocol: %s\n"),
 							  err);
+			SSLerrfree(err);
+			SSL_CTX_free(SSL_context);
 			return -1;
 		}
 	}
@@ -1321,9 +1327,7 @@ open_client_SSL(PGconn *conn)
 	conn->peer = SSL_get_peer_certificate(conn->ssl);
 	if (conn->peer == NULL)
 	{
-		char	   *err;
-
-		err = SSLerrmessage(ERR_get_error());
+		char	   *err = SSLerrmessage(ERR_get_error());
 
 		printfPQExpBuffer(&conn->errorMessage,
 						  libpq_gettext("certificate could not be obtained: %s\n"),

Original file line number	Diff line number	Diff line change
`@@ -1306,13 +1306,15 @@ connectOptions2(PGconn *conn)`
`1306`	`1306`	`*/`
`1307`	`1307`	`if (!sslVerifyProtocolVersion(conn->sslminprotocolversion))`
`1308`	`1308`	`{`
	`1309`	`+ conn->status = CONNECTION_BAD;`
`1309`	`1310`	`printfPQExpBuffer(&conn->errorMessage,`
`1310`	`1311`	`libpq_gettext("invalid sslminprotocolversion value: \"%s\"\n"),`
`1311`	`1312`	`conn->sslminprotocolversion);`
`1312`	`1313`	`return false;`
`1313`	`1314`	`}`
`1314`	`1315`	`if (!sslVerifyProtocolVersion(conn->sslmaxprotocolversion))`
`1315`	`1316`	`{`
	`1317`	`+ conn->status = CONNECTION_BAD;`
`1316`	`1318`	`printfPQExpBuffer(&conn->errorMessage,`
`1317`	`1319`	`libpq_gettext("invalid sslmaxprotocolversion value: \"%s\"\n"),`
`1318`	`1320`	`conn->sslmaxprotocolversion);`
`@@ -1329,6 +1331,7 @@ connectOptions2(PGconn *conn)`
`1329`	`1331`	`if (!sslVerifyProtocolRange(conn->sslminprotocolversion,`
`1330`	`1332`	`conn->sslmaxprotocolversion))`
`1331`	`1333`	`{`
	`1334`	`+ conn->status = CONNECTION_BAD;`
`1332`	`1335`	`printfPQExpBuffer(&conn->errorMessage,`
`1333`	`1336`	`libpq_gettext("invalid SSL protocol version range"));`
`1334`	`1337`	`return false;`
Original file line number	Diff line number	Diff line change
`@@ -854,6 +854,7 @@ initialize_SSL(PGconn *conn)`
`854`	`854`	`printfPQExpBuffer(&conn->errorMessage,`
`855`	`855`	`libpq_gettext("invalid value \"%s\" for minimum version of SSL protocol\n"),`
`856`	`856`	`conn->sslminprotocolversion);`
	`857`	`+ SSL_CTX_free(SSL_context);`
`857`	`858`	`return -1;`
`858`	`859`	`}`
`859`	`860`
`@@ -864,6 +865,8 @@ initialize_SSL(PGconn *conn)`
`864`	`865`	`printfPQExpBuffer(&conn->errorMessage,`
`865`	`866`	`libpq_gettext("could not set minimum version of SSL protocol: %s\n"),`
`866`	`867`	`err);`
	`868`	`+ SSLerrfree(err);`
	`869`	`+ SSL_CTX_free(SSL_context);`
`867`	`870`	`return -1;`
`868`	`871`	`}`
`869`	`872`	`}`
`@@ -880,6 +883,7 @@ initialize_SSL(PGconn *conn)`
`880`	`883`	`printfPQExpBuffer(&conn->errorMessage,`
`881`	`884`	`libpq_gettext("invalid value \"%s\" for maximum version of SSL protocol\n"),`
`882`	`885`	`conn->sslmaxprotocolversion);`
	`886`	`+ SSL_CTX_free(SSL_context);`
`883`	`887`	`return -1;`
`884`	`888`	`}`
`885`	`889`
`@@ -890,6 +894,8 @@ initialize_SSL(PGconn *conn)`
`890`	`894`	`printfPQExpBuffer(&conn->errorMessage,`
`891`	`895`	`libpq_gettext("could not set maximum version of SSL protocol: %s\n"),`
`892`	`896`	`err);`
	`897`	`+ SSLerrfree(err);`
	`898`	`+ SSL_CTX_free(SSL_context);`
`893`	`899`	`return -1;`
`894`	`900`	`}`
`895`	`901`	`}`
`@@ -1321,9 +1327,7 @@ open_client_SSL(PGconn *conn)`
`1321`	`1327`	`conn->peer = SSL_get_peer_certificate(conn->ssl);`
`1322`	`1328`	`if (conn->peer == NULL)`
`1323`	`1329`	`{`
`1324`		`- char *err;`
`1325`		`-`
`1326`		`- err = SSLerrmessage(ERR_get_error());`
	`1330`	`+ char *err = SSLerrmessage(ERR_get_error());`
`1327`	`1331`
`1328`	`1332`	`printfPQExpBuffer(&conn->errorMessage,`
`1329`	`1333`	`libpq_gettext("certificate could not be obtained: %s\n"),`