security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Activity

g10: Fix use-after-free. 

* g10/getkey.c (pubkey_cmp): Make a copy of the user id.
(get_best_pubkey_byname): Free the user ids.

Signed-off-by: Justus Winter <justus@g10code.com>
This commit is contained in:
Justus Winter 2016-11-15 15:06:28 +01:00
parent 26c7c1d72c
commit bd60742925
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
g10/getkey.c
View File

@ -1541,7 +1541,7 @@ pubkey_cmp (ctrl_t ctrl, const char *name, struct pubkey_cmp_cookie *old,
if (! match)
continue;
new->uid = uid;
new->uid = scopy_user_id (uid);
new->validity =
get_validity (ctrl, &new->key, uid, NULL, 0) & TRUST_MASK;
new->valid = 1;
@ -1602,21 +1602,29 @@ get_best_pubkey_byname (ctrl_t ctrl, GETKEY_CTX *retctx, PKT_public_key *pk,
{
/* New key is better. */
release_public_key_parts (&best.key);
if (best.uid)
free_user_id (best.uid);
best = new;
}
else if (diff > 0)
{
/* Old key is better. */
release_public_key_parts (&new.key);
if (new.uid)
free_user_id (new.uid);
}
else
{
/* A tie. Keep the old key. */
release_public_key_parts (&new.key);
if (new.uid)
free_user_id (new.uid);
}
}
getkey_end (ctx);
ctx = NULL;
if (best.uid)
free_user_id (best.uid);
if (best.valid)
{