json: Fix memory errors in create_keylist_patterns

* src/gpgme-json.c (create_keylist_patterns): Reserve two
pointers more then linefeeds.
(create_keylist_patterns): Fix loop to count linebreaks.
(create_keylist_patterns): Use calloc for good measure.

--
This fixes crashes and memory corruption as cnt did not
match i.
This commit is contained in:
Andre Heinecke 2018-07-18 12:57:51 +02:00
parent 16462c54b3
commit b78140daf7
No known key found for this signature in database
GPG Key ID: 2978E9D40CBABA5C

View File

@ -691,17 +691,17 @@ create_keylist_patterns (cjson_t request, const char *name)
char *p; char *p;
char *tmp; char *tmp;
char **ret; char **ret;
int cnt = 1; int cnt = 2; /* Last NULL and one is not newline delimited */
int i = 0; int i = 0;
if (get_keys (request, name, &keystring)) if (get_keys (request, name, &keystring))
return NULL; return NULL;
for (p = keystring; p; p++) for (p = keystring; *p; p++)
if (*p == '\n') if (*p == '\n')
cnt++; cnt++;
ret = xmalloc (cnt * sizeof *ret); ret = xcalloc (1, cnt * sizeof *ret);
for (p = keystring, tmp = keystring; *p; p++) for (p = keystring, tmp = keystring; *p; p++)
{ {
@ -712,8 +712,7 @@ create_keylist_patterns (cjson_t request, const char *name)
tmp = p + 1; tmp = p + 1;
} }
/* The last key is not newline delimted. */ /* The last key is not newline delimted. */
ret[i++] = *tmp ? xstrdup (tmp) : NULL; ret[i] = *tmp ? xstrdup (tmp) : NULL;
ret[i] = NULL;
xfree (keystring); xfree (keystring);
return ret; return ret;