From 1d0901845010c857202d156367a8f5994a8583b7 Mon Sep 17 00:00:00 2001
From: JacobBarthelmeh <jacob@wolfssl.com>
Date: Tue, 24 Dec 2024 14:54:43 -0800
Subject: [PATCH] adjust x509 reference up location for store certs

---
 src/x509_str.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/x509_str.c b/src/x509_str.c
index 2bd801ca1a..d0636655fd 100644
--- a/src/x509_str.c
+++ b/src/x509_str.c
@@ -1860,9 +1860,17 @@ WOLF_STACK_OF(WOLFSSL_X509_OBJECT)* wolfSSL_X509_STORE_get0_objects(
         }
     }
     for (i = 0; i < wolfSSL_sk_X509_num(store->certs); i++) {
-        if (wolfSSL_sk_X509_push(cert_stack,
-                             wolfSSL_sk_X509_value(store->certs, i)) > 0) {
+        x509 = wolfSSL_sk_X509_value(store->certs, i);
+        if (wolfSSL_sk_X509_push(cert_stack, x509) > 0) {
             store->numAdded++;
+
+            /* up x509 reference count since now store->certs points to it and
+             * cert_stack (which later gets passed off to a new obj and free'd)
+             */
+            if (wolfSSL_X509_up_ref(x509) != WOLFSSL_SUCCESS) {
+                WOLFSSL_MSG("wolfSSL_X509_up_ref error");
+                goto err_cleanup;
+            }
         }
     }
     /* Do not modify stack until after we guarantee success to
@@ -1879,11 +1887,6 @@ WOLF_STACK_OF(WOLFSSL_X509_OBJECT)* wolfSSL_X509_STORE_get0_objects(
             wolfSSL_X509_OBJECT_free(obj);
             goto err_cleanup;
         }
-        if (wolfSSL_X509_up_ref(x509) != WOLFSSL_SUCCESS) {
-            WOLFSSL_MSG("wolfSSL_X509_up_ref error");
-            wolfSSL_X509_OBJECT_free(obj);
-            goto err_cleanup;
-        }
         obj->type = WOLFSSL_X509_LU_X509;
         obj->data.x509 = x509;
     }
@@ -1918,10 +1921,7 @@ WOLF_STACK_OF(WOLFSSL_X509_OBJECT)* wolfSSL_X509_STORE_get0_objects(
     if (ret != NULL)
         X509StoreFreeObjList(store, ret);
     if (cert_stack != NULL) {
-        while (store->numAdded > 0) {
-            wolfSSL_sk_X509_pop(cert_stack);
-            store->numAdded--;
-        }
+        store->numAdded = 0;
         wolfSSL_sk_X509_pop_free(cert_stack, NULL);
     }
     return NULL;