From 7c4763ab8b985f46ed834ef94362338f946b2a4e Mon Sep 17 00:00:00 2001
From: Jakub Zelenka <bukka@php.net>
Date: Thu, 21 Dec 2023 16:42:09 +0000
Subject: [PATCH] Fix GH-12987: openssl_csr_sign might leak new cert on error

Closes GH-12988
---
 NEWS                  | 4 ++++
 ext/openssl/openssl.c | 8 +++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/NEWS b/NEWS
index 8431cd83472..b98074d0635 100644
--- a/NEWS
+++ b/NEWS
@@ -25,6 +25,10 @@ PHP                                                                        NEWS
   . Added workaround for SELinux mprotect execheap issue.
     See https://bugzilla.kernel.org/show_bug.cgi?id=218258. (ilutov)
 
+- OpenSSL:
+  . Fixed bug GH-12987 (openssl_csr_sign might leak new cert on error).
+    (Jakub Zelenka)
+
 - PDO_ODBC:
   . Fixed bug GH-12767 (Unable to turn on autocommit mode with setAttribute()).
     (SakiTakamachi)
diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
index 0f8adf01351..59d938d77e8 100644
--- a/ext/openssl/openssl.c
+++ b/ext/openssl/openssl.c
@@ -3154,6 +3154,7 @@ PHP_FUNCTION(openssl_csr_sign)
 	X509 *cert = NULL, *new_cert = NULL;
 	EVP_PKEY * key = NULL, *priv_key = NULL;
 	int i;
+	bool new_cert_used = false;
 	struct php_x509_request req;
 
 	ZEND_PARSE_PARAMETERS_START(4, 6)
@@ -3275,11 +3276,12 @@ PHP_FUNCTION(openssl_csr_sign)
 	object_init_ex(return_value, php_openssl_certificate_ce);
 	cert_object = Z_OPENSSL_CERTIFICATE_P(return_value);
 	cert_object->x509 = new_cert;
+	new_cert_used = true;
 
 cleanup:
 
-	if (cert == new_cert) {
-		cert = NULL;
+	if (!new_cert_used && new_cert) {
+		X509_free(new_cert);
 	}
 
 	PHP_SSL_REQ_DISPOSE(&req);
@@ -3288,7 +3290,7 @@ cleanup:
 	if (csr_str) {
 		X509_REQ_free(csr);
 	}
-	if (cert_str && cert) {
+	if (cert_str && cert && cert != new_cert) {
 		X509_free(cert);
 	}
 }