diff options
| author | Ray Strode <rstrode@redhat.com> | 2014-10-18 22:12:49 -0400 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2014-10-28 11:38:18 +0100 |
| commit | 81b49e8f892a977f3821f3416ea51aa641d63ac4 (patch) | |
| tree | a07966fbb3c6ddf79779b88685636789b776e0ca | |
| parent | 1223bc4cee3fcdbcb1f6a3ff4ff7a3ab1d875b8a (diff) | |
libcacard: don't free sign buffer while sign op is pending
commit 57f97834efe0c208ffadc9d2959f3d3d55580e52 cleaned up
the cac_applet_pki_process_apdu function to have a single
exit point. Unfortunately, that commit introduced a bug
where the sign buffer can get free'd and nullified while
it's still being used.
This commit corrects the bug by introducing a boolean to
track whether or not the sign buffer should be freed in
the function exit path.
Signed-off-by: Ray Strode <rstrode@redhat.com>
Reviewed-by: Alon Levy <alon@pobox.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| -rw-r--r-- | libcacard/cac.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/libcacard/cac.c b/libcacard/cac.c index ae8c3784b9..f38fdceddd 100644 --- a/libcacard/cac.c +++ b/libcacard/cac.c @@ -115,6 +115,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu, VCardAppletPrivate *applet_private; int size, next; unsigned char *sign_buffer; + bool retain_sign_buffer = FALSE; vcard_7816_status_t status; VCardStatus ret = VCARD_FAIL; @@ -178,6 +179,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu, pki_applet->sign_buffer = sign_buffer; pki_applet->sign_buffer_len = size; *response = vcard_make_response(VCARD7816_STATUS_SUCCESS); + retain_sign_buffer = TRUE; break; case 0x00: /* we now have the whole buffer, do the operation, result will be @@ -200,9 +202,11 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu, VCARD7816_STATUS_ERROR_P1_P2_INCORRECT); break; } - g_free(sign_buffer); - pki_applet->sign_buffer = NULL; - pki_applet->sign_buffer_len = 0; + if (!retain_sign_buffer) { + g_free(sign_buffer); + pki_applet->sign_buffer = NULL; + pki_applet->sign_buffer_len = 0; + } ret = VCARD_DONE; break; case CAC_READ_BUFFER: |