security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Releases Activity

dirmngr: Fix use-after-free due to a realloc shrinking. 

* dirmngr/ks-engine-hkp.c (map_host): Do not use original pointer
after realloc.
--

vex01 reported and debugged the problem.

GnuPG-bug-id: 2107
Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2015-10-02 11:31:45 +02:00
parent ddf9dd135a
commit 75c64c2b6d
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dirmngr/ks-engine-hkp.c
View File

@ -383,7 +383,7 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
int n_v6, n_v4; int n_v6, n_v4;
/* First figure out whether this is a pool. For a pool we /* First figure out whether this is a pool. For a pool we
use a different strategy than for a plains erver: We use use a different strategy than for a plain server: We use
the canonical name of the pool as the virtual host along the canonical name of the pool as the virtual host along
with the IP addresses. If it is not a pool, we use the with the IP addresses. If it is not a pool, we use the
specified name. */ specified name. */
@ -512,7 +512,7 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
xfree (reftbl); xfree (reftbl);
return err; return err;
} }
qsort (reftbl, refidx, sizeof *reftbl, sort_hostpool); qsort (hi->pool, refidx, sizeof *reftbl, sort_hostpool);
} }
else else
xfree (reftbl); xfree (reftbl);