security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-04-13 22:21:09 +02:00
Code Activity

gpg: Fix recently introduced use after free.

Browse Source 
* g10/mainproc.c (proc_plaintext): Do not use freed memory.
--

GnuPG-bug-id: 4407
Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2019-03-15 08:55:06 +01:00
parent bdda31a26b
commit 3e1f3df618
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
g10/mainproc.c
View File

@ -946,9 +946,6 @@ proc_plaintext( CTX c, PACKET *pkt )
if (rc) if (rc)
log_error ("handle plaintext failed: %s\n", gpg_strerror (rc)); log_error ("handle plaintext failed: %s\n", gpg_strerror (rc));
free_packet (pkt, NULL);
c->last_was_session_key = 0;
/* We add a marker control packet instead of the plaintext packet. /* We add a marker control packet instead of the plaintext packet.
* This is so that we can later detect invalid packet sequences. * This is so that we can later detect invalid packet sequences.
* The apcket is further used to convey extra data from the * The apcket is further used to convey extra data from the
@ -974,6 +971,9 @@ proc_plaintext( CTX c, PACKET *pkt )
extrahash[extrahashlen++] = pt->timestamp ; extrahash[extrahashlen++] = pt->timestamp ;
} }
free_packet (pkt, NULL);
c->last_was_session_key = 0;
n = new_kbnode (create_gpg_control (CTRLPKT_PLAINTEXT_MARK, n = new_kbnode (create_gpg_control (CTRLPKT_PLAINTEXT_MARK,
extrahash, extrahashlen)); extrahash, extrahashlen));
xfree (extrahash); xfree (extrahash);