Re: [PATCH 0/1] MR8180: crypt32: Fix use-after-free in CRYPT_ImportSystemRootCertsToReg.

[Paul Gofman (＠gofman)]

On Mon Jun  2 15:00:21 2025 +0000, Paul Gofman wrote:
> Probably just calling CertDuplicateStore() for 'cached' when 'cached' is
> used with chain engine should do it? Note that CertDuplicateStore() just
> increases its refcount, it doesn't do an actual copy.

Actually, even better would be to just CertDuplicateStore in CRYPT_CreateChainEngine() if 'root' is not NULL, that would be normal idiomatic behaviour for this function. Also, it looks like CRYPT_CreateChainEngine() is only used with non-NULL root from this place in rootstore.c, other usages just pass NULL there.