Plug a big memory leak in the new validator

The legacy validator would only call x509_vfy_check_policy() once at
the very end after cobbling together a chain.  Therefore it didn't
matter that X509_policy_check() always allocates a new tree on top of
the one that might have been passed in.  This is in stark contrast to
other, similar APIs in this code base.  The new validator calls this
function several times over while building its chains.  This adds up
to a sizable leak in the new validator.

Reported with a reproducer by Hanno Zysik on github, who also bisected
this to the commit enabling the new validator.

Narrowed down to x509_vfy_check_policy() by jsing.
We simultaenously came up with a functionally identical fix.

ok jsing

0 files changed, 0 insertions, 0 deletions