mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-27 05:21:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential double free through SRP_user_pwd_set1_ids()

Browse Source 
If SRP_user_pwd_set1_ids() fails during one of the duplications, or id
is NULL, then the old pointer values are still stored but they are now dangling.
Later when SRP_user_pwd_free() is called these are freed again,
leading to a double free.

Although there are no such uses in OpenSSL as far as I found,
it's still a public API.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25655)
This commit is contained in:
Niels Dossche 2024-10-09 23:00:13 +02:00 committed by Tomas Mraz
parent 38e8392ba0
commit 792b2c8da2
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
crypto/srp/srp_vfy.c
View File

@ -214,6 +214,8 @@ int SRP_user_pwd_set1_ids(SRP_user_pwd *vinfo, const char *id,
{ {
OPENSSL_free(vinfo->id); OPENSSL_free(vinfo->id);
OPENSSL_free(vinfo->info); OPENSSL_free(vinfo->info);
vinfo->id = NULL;
vinfo->info = NULL;
if (id != NULL && NULL == (vinfo->id = OPENSSL_strdup(id))) if (id != NULL && NULL == (vinfo->id = OPENSSL_strdup(id)))
return 0; return 0;
return (info == NULL || NULL != (vinfo->info = OPENSSL_strdup(info))); return (info == NULL || NULL != (vinfo->info = OPENSSL_strdup(info)));