wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix faulty free

Browse source 
On error, i2o_SCT_signature() and i2o_SCT() free a pointer that may
have wandered off from the start of the allocated block (not currently
true for i2o_SCT_signature(), but has that potential as the code may
change.  To avoid this, save away the start of the allocated block and
free that instead.

Thanks to Guido Vranken for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2323)
This commit is contained in:
Richard Levitte 2017-01-29 08:52:02 +01:00
parent 31b69e9a26
commit d85d3c993e
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
crypto/ct/ct_oct.c
View file

@ -153,7 +153,7 @@ err:
int i2o_SCT_signature(const SCT *sct, unsigned char **out)
{
size_t len;
unsigned char *p = NULL;
unsigned char *p = NULL, *pstart = NULL;
if (!SCT_signature_is_complete(sct)) {
CTerr(CT_F_I2O_SCT_SIGNATURE, CT_R_SCT_INVALID_SIGNATURE);
@ -177,7 +177,7 @@ int i2o_SCT_signature(const SCT *sct, unsigned char **out)
p = *out;
*out += len;
} else {
p = OPENSSL_malloc(len);
pstart = p = OPENSSL_malloc(len);
if (p == NULL) {
CTerr(CT_F_I2O_SCT_SIGNATURE, ERR_R_MALLOC_FAILURE);
goto err;
@ -193,14 +193,14 @@ int i2o_SCT_signature(const SCT *sct, unsigned char **out)
return len;
err:
OPENSSL_free(p);
OPENSSL_free(pstart);
return -1;
}
int i2o_SCT(const SCT *sct, unsigned char **out)
{
size_t len;
unsigned char *p = NULL;
unsigned char *p = NULL, *pstart = NULL;
if (!SCT_is_complete(sct)) {
CTerr(CT_F_I2O_SCT, CT_R_SCT_NOT_SET);
@ -224,7 +224,7 @@ int i2o_SCT(const SCT *sct, unsigned char **out)
p = *out;
*out += len;
} else {
p = OPENSSL_malloc(len);
pstart = p = OPENSSL_malloc(len);
if (p == NULL) {
CTerr(CT_F_I2O_SCT, ERR_R_MALLOC_FAILURE);
goto err;
@ -250,7 +250,7 @@ int i2o_SCT(const SCT *sct, unsigned char **out)
return len;
err:
OPENSSL_free(p);
OPENSSL_free(pstart);
return -1;
}