Blame SOURCES/0001-asn1-fix-use-after-free-in-asn1_write.patch
|
 |
40fde1 |
From 3aa83995d7c0ef632fe0af3d032e48691a5ce781 Mon Sep 17 00:00:00 2001
|
|
|
40fde1 |
From: Jeff Layton <jlayton@samba.org>
|
|
|
40fde1 |
Date: Sun, 13 Oct 2013 21:07:28 -0400
|
|
|
40fde1 |
Subject: [PATCH] asn1: fix use-after-free in asn1_write
|
|
|
40fde1 |
|
|
|
40fde1 |
If the talloc_realloc() fails, asn1_write calls talloc_free on the
|
|
|
40fde1 |
context and then immediately dereferences the pointer.
|
|
|
40fde1 |
|
|
|
40fde1 |
Fix this by skipping the talloc_free here. Let the caller handle it.
|
|
|
40fde1 |
|
|
|
40fde1 |
Signed-off-by: Jeff Layton <jlayton@samba.org>
|
|
|
40fde1 |
---
|
|
|
40fde1 |
asn1.c | 1 -
|
|
|
40fde1 |
1 file changed, 1 deletion(-)
|
|
|
40fde1 |
|
|
|
40fde1 |
diff --git a/asn1.c b/asn1.c
|
|
|
40fde1 |
index ea50a23..4c0e480 100644
|
|
|
40fde1 |
--- a/asn1.c
|
|
|
40fde1 |
+++ b/asn1.c
|
|
|
40fde1 |
@@ -47,7 +47,6 @@ bool asn1_write(struct asn1_data *data, const void *p, int len)
|
|
|
40fde1 |
uint8_t *newp;
|
|
|
40fde1 |
newp = talloc_realloc(data, data->data, uint8_t, data->ofs+len);
|
|
|
40fde1 |
if (!newp) {
|
|
|
40fde1 |
- asn1_free(data);
|
|
|
40fde1 |
data->has_error = true;
|
|
|
40fde1 |
return false;
|
|
|
40fde1 |
}
|
|
|
40fde1 |
--
|
|
|
40fde1 |
1.8.3.1
|
|
|
40fde1 |
|