From 85370b4300ba56d3ddb67ef98cbd19e559645271 Mon Sep 17 00:00:00 2001
From: Magnus Larsen <golgothasTerror101@gmail.com>
Date: Thu, 22 Jan 2026 23:57:28 -0800
Subject: [PATCH 2/2] Fix use-after-free in openssl cert popup

This bug was half-addressed last year in commit 9b6c641, but conn could
still be a dangling pointer if ongoing==TRUE.
---
 src/IO/tls_openssl.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/IO/tls_openssl.c b/src/IO/tls_openssl.c
index dddde0e8..dd619996 100644
--- a/src/IO/tls_openssl.c
+++ b/src/IO/tls_openssl.c
@@ -1213,8 +1213,10 @@ static void Tls_connect(int fd, int connkey)
     * been closed by the server if the user responded too slowly to a popup.
     */
 
+   conn = a_Klist_get_data(conn_list, connkey);
+
    if (!ongoing) {
-      if (a_Klist_get_data(conn_list, connkey)) {
+      if (conn) {
          conn->connecting = FALSE;
          if (failed) {
             conn->in_connect = FALSE;
-- 
2.51.2

