Document the bizarre fact that {CMS,PCKS7}_get0_signers() needs some

freeing of what they return despite being get0 functions: the stack
of X509s that they return must be freed with sk_X509_free(). The get0
thus probably refers to the individual certs, but not to the stack
itself.

The libcrypto and libssl APIs never cease to amaze with new traps.

ok inoguchi

1 files changed, 6 insertions, 2 deletions

diff --git a/src/lib/libcrypto/man/PKCS7_verify.3 b/src/lib/libcrypto/man/PKCS7_verify.3
index 42c3338e67..2895da16d8 100644
--- a/src/lib/libcrypto/man/PKCS7_verify.3
+++ b/src/lib/libcrypto/man/PKCS7_verify.3
@@ -1,4 +1,4 @@
-.\"     $OpenBSD: PKCS7_verify.3,v 1.9 2019/06/10 14:58:48 schwarze Exp $
+.\"     $OpenBSD: PKCS7_verify.3,v 1.10 2022/01/19 20:28:06 tb Exp $
 .\"     OpenSSL a528d4f0 Oct 27 13:40:11 2015 -0400
 .\"
 .\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 10 2019 $
+.Dd $Mdocdate: January 19 2022 $
 .Dt PKCS7_VERIFY 3
 .Os
 .Sh NAME
@@ -100,6 +100,8 @@ operation.
 .Fn PKCS7_get0_signers
 retrieves the signer's certificates from
 .Fa p7 .
+The signers must be freed with
+.Fn sk_X509_free .
 It does
 .Sy not
 check their validity or whether any signatures are valid.
@@ -220,6 +222,8 @@ an error occurs.
 returns all signers or
 .Dv NULL
 if an error occurred.
+The signers must be freed with
+.Fn sk_X509_free .
 .Pp
 The error can be obtained from
 .Xr ERR_get_error 3 .