File gnutls-CVE-2025-32988.patch of Package gnutls.39718

From 608829769cbc247679ffe98841109fc73875e573 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <ueno@gnu.org>
Date: Mon, 7 Jul 2025 10:44:12 +0900
Subject: [PATCH] x509: avoid double free when exporting othernames in SAN

Previously, the _gnutls_write_new_othername function, called by
gnutls_x509_ext_export_subject_alt_names to export "otherName" in a
certificate's SAN extension, freed the caller allocated ASN.1
structure upon error, resulting in a potential double-free.

Reported by OpenAI Security Research Team.

Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
 NEWS                  | 5 +++++
 lib/x509/extensions.c | 2 --
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/x509/extensions.c b/lib/x509/extensions.c
index 6c2da8fd10..e8be12eaf5 100644
--- a/lib/x509/extensions.c
+++ b/lib/x509/extensions.c
@@ -754,7 +754,6 @@ int _gnutls_write_new_othername(asn1_node ext, const char *ext_name,
 	result = asn1_write_value(ext, name2, oid, 1);
 	if (result != ASN1_SUCCESS) {
 		gnutls_assert();
-		asn1_delete_structure(&ext);
 		return _gnutls_asn2err(result);
 	}
 
@@ -763,7 +762,6 @@ int _gnutls_write_new_othername(asn1_node ext, const char *ext_name,
 	result = asn1_write_value(ext, name2, data, data_size);
 	if (result != ASN1_SUCCESS) {
 		gnutls_assert();
-		asn1_delete_structure(&ext);
 		return _gnutls_asn2err(result);
 	}
 
-- 
GitLab