From abd5f6752d693b7f313c19604f0723ecec4d39a6 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Mon, 22 Dec 2014 12:16:46 +0100 Subject: dirmngr,gpgsm: Return NULL on fail * dirmngr/ldapserver.c (ldapserver_parse_one): Set SERVER to NULL. * sm/gpgsm.c (parse_keyserver_line): Ditto. -- Reported-by: Joshua Rogers "If something inside the ldapserver_parse_one function failed, 'server' would be freed, then returned, leading to a use-after-free. This code is likely copied from sm/gpgsm.c, which was also susceptible to this bug." Signed-off-by: Werner Koch --- dirmngr/ldapserver.c | 1 + sm/gpgsm.c | 1 + 2 files changed, 2 insertions(+) diff --git a/dirmngr/ldapserver.c b/dirmngr/ldapserver.c index 20a574cb6..5808c5b02 100644 --- a/dirmngr/ldapserver.c +++ b/dirmngr/ldapserver.c @@ -125,6 +125,7 @@ ldapserver_parse_one (char *line, { log_info (_("%s:%u: skipping this line\n"), filename, lineno); ldapserver_list_free (server); + server = NULL; } return server; diff --git a/sm/gpgsm.c b/sm/gpgsm.c index 3398d173f..72bceb433 100644 --- a/sm/gpgsm.c +++ b/sm/gpgsm.c @@ -862,6 +862,7 @@ parse_keyserver_line (char *line, { log_info (_("%s:%u: skipping this line\n"), filename, lineno); keyserver_list_free (server); + server = NULL; } return server; -- cgit v1.2.3