security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

gpg: Fix actual leak and possible leaks in the packet parser.

Browse source 
* g10/packet.h (struct parse_packet_ctx_s): Change LAST_PKT deom a
pointer to its struct.
(init_parse_packet): Adjust for LAST_PKT not being a pointer.
* g10/parse-packet.c (parse): Ditto. Free the last packet before
storing a new one in case of a deep link.
(parse_ring_trust): Adjust for LAST_PKT not being a pointer.
* g10/free-packet.c (free_packet): Ditto.
* g10/t-keydb-get-keyblock.c (do_test): Release keyblock.
--

Fixes-commit: afa8680908
Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2017-03-30 16:01:52 +02:00
parent 64665404e4
commit 7bf24e8146
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
5 changed files with 26 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

12
g10/free-packet.c
View file

@ -409,14 +409,15 @@ free_packet (PACKET *pkt, parse_packet_ctx_t parsectx)
{
if (!pkt || !pkt->pkt.generic)
{
if (parsectx && parsectx->last_pkt)
if (parsectx && parsectx->last_pkt.pkt.generic)
{
if (parsectx->free_last_pkt)
{
free_packet (parsectx->last_pkt, NULL);
free_packet (&parsectx->last_pkt, NULL);
parsectx->free_last_pkt = 0;
}
parsectx->last_pkt = NULL;
parsectx->last_pkt.pkttype = 0;
parsectx->last_pkt.pkt.generic = NULL;
}
return;
}
@ -427,8 +428,11 @@ free_packet (PACKET *pkt, parse_packet_ctx_t parsectx)
/* If we have a parser context holding PKT then do not free the
* packet but set a flag that the packet in the parser context is
* now a deep copy. */
if (parsectx && parsectx->last_pkt == pkt && !parsectx->free_last_pkt)
if (parsectx && !parsectx->free_last_pkt
&& parsectx->last_pkt.pkttype == pkt->pkttype
&& parsectx->last_pkt.pkt.generic == pkt->pkt.generic)
{
parsectx->last_pkt = *pkt;
parsectx->free_last_pkt = 1;
pkt->pkt.generic = NULL;
return;