security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-04-11 22:01:08 +02:00
Code Activity

g10: Fix keybox-related memory leaks.

Browse Source 
* g10/keydb.c (keydb_release): Clear keyblock cache.
(keydb_get_keyblock): Revert previous change.
* kbx/keybox-blob.c (create_blob_finish): Free previous buffer, free
fixups after applying them.
(_keybox_release_blob): Free buffer.  Currently, the buffer has been
extracted before the keybox is released, but this is the right thing
to do here.

Fixes-commit: c57501cc
Signed-off-by: Justus Winter <justus@g10code.com>
This commit is contained in:
Justus Winter 2016-06-30 17:09:59 +02:00
parent 5869f518cb
commit 29beea6462
2 changed files with 25 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
g10/keydb.c
View File

@ -937,6 +937,7 @@ keydb_release (KEYDB_HANDLE hd)
} }
} }
keyblock_cache_clear (hd);
xfree (hd); xfree (hd);
} }
@ -1387,8 +1388,11 @@ keydb_get_keyblock (KEYDB_HANDLE hd, KBNODE *ret_kb)
hd->keyblock_cache.pk_no = pk_no; hd->keyblock_cache.pk_no = pk_no;
hd->keyblock_cache.uid_no = uid_no; hd->keyblock_cache.uid_no = uid_no;
} }
xfree (sigstatus); else
iobuf_close (iobuf); {
xfree (sigstatus);
iobuf_close (iobuf);
}
} }
} }
break; break;

24
kbx/keybox-blob.c
View File

@ -661,18 +661,24 @@ create_blob_finish (KEYBOXBLOB blob)
/* do the fixups */ /* do the fixups */
if (blob->fixup_out_of_core) if (blob->fixup_out_of_core)
return gpg_error (GPG_ERR_ENOMEM); {
xfree (p);
return gpg_error (GPG_ERR_ENOMEM);
}
{ {
struct fixup_list *fl; struct fixup_list *fl, *next;
for (fl = blob->fixups; fl; fl = fl->next) for (fl = blob->fixups; fl; fl = next)
{ {
assert (fl->off+4 <= n); assert (fl->off+4 <= n);
p[fl->off+0] = fl->val >> 24; p[fl->off+0] = fl->val >> 24;
p[fl->off+1] = fl->val >> 16; p[fl->off+1] = fl->val >> 16;
p[fl->off+2] = fl->val >> 8; p[fl->off+2] = fl->val >> 8;
p[fl->off+3] = fl->val; p[fl->off+3] = fl->val;
next = fl->next;
xfree (fl);
} }
blob->fixups = NULL;
} }
/* Compute and store the SHA-1 checksum. */ /* Compute and store the SHA-1 checksum. */
@ -680,8 +686,12 @@ create_blob_finish (KEYBOXBLOB blob)
pp = xtrymalloc (n); pp = xtrymalloc (n);
if ( !pp ) if ( !pp )
return gpg_error_from_syserror (); {
xfree (p);
return gpg_error_from_syserror ();
}
memcpy (pp , p, n); memcpy (pp , p, n);
xfree (p);
blob->blob = pp; blob->blob = pp;
blob->bloblen = n; blob->bloblen = n;
@ -1000,7 +1010,11 @@ _keybox_release_blob (KEYBOXBLOB blob)
int i; int i;
if (!blob) if (!blob)
return; return;
/* hmmm: release membuf here?*/ if (blob->buf)
{
size_t len;
xfree (get_membuf (blob->buf, &len));
}
xfree (blob->keys ); xfree (blob->keys );
xfree (blob->serialbuf); xfree (blob->serialbuf);
for (i=0; i < blob->nuids; i++) for (i=0; i < blob->nuids; i++)