From b6d54f1196d5f110fd94dfd661e74dbc60ca9811 Mon Sep 17 00:00:00 2001
From: NIIBE Yutaka <gniibe@fsij.org>
Date: Tue, 27 Aug 2013 10:23:09 +0900
Subject: [PATCH] scd: fix parsing login-data DO.

* scd/app-openpgp.c (parse_login_data): Release RELPTR.  Fix parsing.

--

Signed-off-by: NIIBE Yutaka
---
 scd/app-openpgp.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index 673570d3f..011c24840 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -660,7 +660,11 @@ parse_login_data (app_t app)
     if (*buffer == '\n')
       break;
   if (buflen < 2 || buffer[1] != '\x14')
-    return; /* No control sequences.  */
+    {
+      xfree (relptr);
+      return; /* No control sequences.  */
+    }
+
   buflen--;
   buffer++;
   do
@@ -707,14 +711,11 @@ parse_login_data (app_t app)
                       m = strtol (q, &q, 10);
                     }
 
-                  buffer = q;
                   if (buflen < ((unsigned char *)q - buffer))
-                    {
-                      buflen = 0;
-                      break;
-                    }
-                  else
-                    buflen -= ((unsigned char *)q - buffer);
+                    break;
+
+                  buflen -= ((unsigned char *)q - buffer);
+                  buffer = q;
 
                   if (buflen && !(*buffer == '\n' || *buffer == '\x18'))
                     goto next;
@@ -725,11 +726,11 @@ parse_login_data (app_t app)
             }
         }
     next:
-      for (; buflen && *buffer != '\x18'; buflen--, buffer++)
-        if (*buffer == '\n')
-          buflen = 1;
+      /* Skip to FS (0x18) or LF (\n).  */
+      for (; buflen && *buffer != '\x18' && *buffer != '\n'; buflen--)
+        buffer++;
     }
-  while (buflen);
+  while (buflen && *buffer != '\n');
 
   xfree (relptr);
 }