@@ -313,6 +313,11 @@ Security

   --x509-track option and the client has a correct, signed and unrevoked

   certificate that contains an embedded NUL in the certificate subject.

   Discovered and reported to the OpenVPN security team by Guido Vranken.

+- CVE-2017-7521: Fix post-authentication remote-triggerable memory leaks

+  A client could cause a server to leak a few bytes each time it connects to the

+  server.  That can eventuall cause the server to run out of memory, and thereby

+  causing the server process to terminate. Discovered and reported to the

+  OpenVPN security team by Guido Vranken.  (OpenSSL builds only.)

 User-visible Changes

 --------------------

@@ -163,7 +163,7 @@ extract_x509_extension(X509 *cert, char *fieldname, char *out, int size)

                     break;

             }

         }

-        sk_GENERAL_NAME_free(extensions);

+        GENERAL_NAMES_free(extensions);

     }

     return retval;

 }

@@ -225,8 +225,7 @@ extract_x509_field_ssl(X509_NAME *x509, const char *field_name, char *out,

     {

         return FAILURE;

     }

-    tmp = ASN1_STRING_to_UTF8(&buf, asn1);

-    if (tmp <= 0)

+    if (ASN1_STRING_to_UTF8(&buf, asn1) < 0)

     {

         return FAILURE;

     }

@@ -466,7 +465,7 @@ x509_setenv_track(const struct x509_track *xt, struct env_set *es, const int dep

                         {

                             ASN1_STRING *val = X509_NAME_ENTRY_get_data(ent);

                             unsigned char *buf = NULL;

-                            if (ASN1_STRING_to_UTF8(&buf, val) > 0)

+                            if (ASN1_STRING_to_UTF8(&buf, val) >= 0)

                             {

                                 do_setenv_x509(es, xt->name, (char *)buf, depth);

                                 OPENSSL_free(buf);

@@ -553,7 +552,7 @@ x509_setenv(struct env_set *es, int cert_depth, openvpn_x509_cert_t *peer_cert)

         {

             continue;

         }

-        if (ASN1_STRING_to_UTF8(&buf, val) <= 0)

+        if (ASN1_STRING_to_UTF8(&buf, val) < 0)

         {

             continue;

         }