From e888f7af6571ecd3994fd55cc18c9e2df7fd0c60 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Fri, 21 Jul 2017 17:48:40 +0200 Subject: [PATCH] gpg: Fix possible double free of the card serialno. * g10/free-packet.c (copy_public_key): Copy fields serialno and updateurl. -- The PK->serialno is used to get the version of the card to decide whether it does support other algorithms than SHA-1. This value is cached but no deep copy was done when calling copy_public_key. Bug detected by importing some public keys and then importing a secret key which led to a double free. Signed-off-by: Werner Koch --- g10/free-packet.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/g10/free-packet.c b/g10/free-packet.c index cd222a2d6..e15ad3f04 100644 --- a/g10/free-packet.c +++ b/g10/free-packet.c @@ -224,6 +224,12 @@ copy_public_key (PKT_public_key *d, PKT_public_key *s) } else d->revkey = NULL; + + if (s->serialno) + d->serialno = xstrdup (s->serialno); + if (s->updateurl) + d->updateurl = xstrdup (s->updateurl); + return d; }