From 907a9a1e986b8c8266f4f01e8ed82acfc636a519 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Mon, 22 Dec 2014 12:16:46 +0100 Subject: gpgsm: Return NULL on fail * sm/gpgsm.c (parse_keyserver_line): Set SERVER to NULL. -- Cherry-pick of abd5f6752d693b7f313c19604f0723ecec4d39a6. Reported-by: Joshua Rogers "If something inside the ldapserver_parse_one function failed, 'server' would be freed, then returned, leading to a use-after-free. This code is likely copied from sm/gpgsm.c, which was also susceptible to this bug." Signed-off-by: Werner Koch --- sm/gpgsm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sm/gpgsm.c b/sm/gpgsm.c index 97ec4bbf6..855de83d6 100644 --- a/sm/gpgsm.c +++ b/sm/gpgsm.c @@ -840,6 +840,7 @@ parse_keyserver_line (char *line, { log_info (_("%s:%u: skipping this line\n"), filename, lineno); keyserver_list_free (server); + server = NULL; } return server; -- cgit v1.2.3