From e57954ed278cb5e6e725005b1ecaf7ce70006ce0 Mon Sep 17 00:00:00 2001 From: Andre Heinecke Date: Thu, 18 Apr 2019 13:19:05 +0200 Subject: [PATCH] g10: Fix double free when locating by mbox * g10/getkey.c (get_best_pubkey_byname): Set new.uid always to NULL after use. -- pubkey_cmp is not guranteed to set new.uid. So if the diff < 0 case is reached best is set to new. If then diff > 0 is reached without modifying new.uid e.g. if the key has no matching mboxes. new.uid is free'd even though the uid is still referenced in best. GnuPG-Bug-Id: T4462 --- g10/getkey.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/g10/getkey.c b/g10/getkey.c index 34bc4bf0e..1e7334307 100644 --- a/g10/getkey.c +++ b/g10/getkey.c @@ -1388,15 +1388,14 @@ get_best_pubkey_byname (ctrl_t ctrl, GETKEY_CTX *retctx, PKT_public_key *pk, /* Old key is better. */ release_public_key_parts (&new.key); free_user_id (new.uid); - new.uid = NULL; } else { /* A tie. Keep the old key. */ release_public_key_parts (&new.key); free_user_id (new.uid); - new.uid = NULL; } + new.uid = NULL; } getkey_end (ctrl, ctx); ctx = NULL;