diff options
| author | Werner Koch <[email protected]> | 2026-04-26 18:31:20 +0200 |
|---|---|---|
| committer | Werner Koch <[email protected]> | 2026-04-26 18:35:38 +0200 |
| commit | 2ceca1f5f978c878f0ce7a097002aba9778bd274 (patch) | |
| tree | 37471724678b28909a1acea60b5b81837507677b /sm | |
| parent | Post release updates (diff) | |
| download | gnupg-2ceca1f5f978c878f0ce7a097002aba9778bd274.tar.gz gnupg-2ceca1f5f978c878f0ce7a097002aba9778bd274.zip | |
gpgsm: Fix possible double free in the CMS parser.
* sm/decrypt.c (gpgsm_decrypt): Init issuer and serial in the recp
loop to avoid a double free in case of an error from
ksba_cms_get_issuer_serial. Also clar enc_val to be safe for future
code modifications.
* sm/verify.c (gpgsm_verify): Init serial. Not really needed, though.
--
A common pattern in GnuPG and related software for functions returning
allocated objects is to always init them in the called function to
NULL. Unfortunately this is not always the case in libksba and it
should have been done by the caller. Changing this in libksba would be
possible but has a minor regression risk. The allocation is done by
libksba and not user-controlled; thus the severity is low.
Reported-by: Ciwan Öztopal
GnuPG-bug-id: 8240
Diffstat (limited to 'sm')
| -rw-r--r-- | sm/decrypt.c | 11 | ||||
| -rw-r--r-- | sm/verify.c | 2 |
2 files changed, 7 insertions, 6 deletions
diff --git a/sm/decrypt.c b/sm/decrypt.c index 468b527d6..fcf293f7e 100644 --- a/sm/decrypt.c +++ b/sm/decrypt.c @@ -1120,9 +1120,9 @@ gpgsm_decrypt (ctrl_t ctrl, estream_t in_fp, estream_t out_fp) for (recp=0; !any_key; recp++) { - char *issuer; - ksba_sexp_t serial; - ksba_sexp_t enc_val; + char *issuer = NULL; + ksba_sexp_t serial = NULL; + ksba_sexp_t enc_val = NULL; char *hexkeygrip = NULL; char *pkalgostr = NULL; char *pkfpr = NULL; @@ -1275,6 +1275,7 @@ gpgsm_decrypt (ctrl_t ctrl, estream_t in_fp, estream_t out_fp) rc = prepare_decryption (ctrl, hexkeygrip, pk_algo, desc, enc_val, &dfparm); xfree (enc_val); + enc_val = NULL; if (rc) { log_info ("decrypting session key failed: %s\n", @@ -1368,8 +1369,8 @@ gpgsm_decrypt (ctrl_t ctrl, estream_t in_fp, estream_t out_fp) { for (;; recp++) { - char *issuer; - ksba_sexp_t serial; + char *issuer = NULL; + ksba_sexp_t serial = NULL; int tmp_rc; tmp_rc = ksba_cms_get_issuer_serial (cms, recp, diff --git a/sm/verify.c b/sm/verify.c index d6a6f58e2..e56e0674e 100644 --- a/sm/verify.c +++ b/sm/verify.c @@ -287,7 +287,7 @@ gpgsm_verify (ctrl_t ctrl, estream_t in_fp, estream_t data_fp, char *issuer = NULL; gcry_sexp_t sigval = NULL; ksba_isotime_t sigtime, keyexptime; - ksba_sexp_t serial; + ksba_sexp_t serial = NULL; char *msgdigest = NULL; size_t msgdigestlen; char *ctattr; |