From d03b00fd87df04e776145684f4de5af072ded620 Mon Sep 17 00:00:00 2001
From: Chris Conlon <chris@wolfssl.com>
Date: Tue, 18 Aug 2026 16:50:49 -0600
Subject: [PATCH] F-4153: release JNI local refs on all exit paths in
 NativeCtxMissingCRLCallback

---
 native/com_wolfssl_WolfSSLContext.c | 34 +++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/native/com_wolfssl_WolfSSLContext.c b/native/com_wolfssl_WolfSSLContext.c
index 3688048..9cc6e4c 100644
--- a/native/com_wolfssl_WolfSSLContext.c
+++ b/native/com_wolfssl_WolfSSLContext.c
@@ -2193,6 +2193,31 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLContext_setCRLCb
 
 #ifdef HAVE_CRL
 
+/* Delete JNI local references created inside NativeCtxMissingCRLCallback() */
+static void freeCtxMissingCRLCbLocalRefs(JNIEnv* jenv, jclass excClass,
+    jobject crlCbObj, jclass crlClass, jstring missingUrl)
+{
+    if (jenv == NULL) {
+        return;
+    }
+
+    if (missingUrl != NULL) {
+        (*jenv)->DeleteLocalRef(jenv, missingUrl);
+    }
+
+    if (crlClass != NULL) {
+        (*jenv)->DeleteLocalRef(jenv, crlClass);
+    }
+
+    if (crlCbObj != NULL) {
+        (*jenv)->DeleteLocalRef(jenv, crlCbObj);
+    }
+
+    if (excClass != NULL) {
+        (*jenv)->DeleteLocalRef(jenv, excClass);
+    }
+}
+
 void NativeCtxMissingCRLCallback(const char* url)
 {
     JNIEnv*   jenv;
@@ -2245,6 +2270,8 @@ void NativeCtxMissingCRLCallback(const char* url)
 
     if (crlCbObj == NULL) {
         /* No Java callback registered, drop silently. */
+        freeCtxMissingCRLCbLocalRefs(jenv, excClass, crlCbObj, crlClass,
+            missingUrl);
         if (needsDetach) {
             (*g_vm)->DetachCurrentThread(g_vm);
         }
@@ -2261,6 +2288,8 @@ void NativeCtxMissingCRLCallback(const char* url)
         if (!crlClass) {
             (*jenv)->ThrowNew(jenv, excClass,
                 "Can't get native WolfSSLMissingCRLCallback class reference");
+            freeCtxMissingCRLCbLocalRefs(jenv, excClass, crlCbObj, crlClass,
+                missingUrl);
             if (needsDetach)
                 (*g_vm)->DetachCurrentThread(g_vm);
             return;
@@ -2277,6 +2306,8 @@ void NativeCtxMissingCRLCallback(const char* url)
 
             (*jenv)->ThrowNew(jenv, excClass,
                 "Error getting missingCRLCallback method from JNI");
+            freeCtxMissingCRLCbLocalRefs(jenv, excClass, crlCbObj, crlClass,
+                missingUrl);
             if (needsDetach)
                 (*g_vm)->DetachCurrentThread(g_vm);
             return;
@@ -2303,6 +2334,9 @@ void NativeCtxMissingCRLCallback(const char* url)
                 "Object reference invalid in NativeMissingCRLCallback");
     }
 
+    freeCtxMissingCRLCbLocalRefs(jenv, excClass, crlCbObj, crlClass,
+        missingUrl);
+
     if (needsDetach)
         (*g_vm)->DetachCurrentThread(g_vm);
 }