[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 3/5] libcacard: don't free sign buffer while sign op
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 3/5] libcacard: don't free sign buffer while sign op is pending |
Date: |
Tue, 28 Oct 2014 11:50:20 +0100 |
From: Ray Strode <address@hidden>
commit 57f97834efe0c208ffadc9d2959f3d3d55580e52 cleaned up
the cac_applet_pki_process_apdu function to have a single
exit point. Unfortunately, that commit introduced a bug
where the sign buffer can get free'd and nullified while
it's still being used.
This commit corrects the bug by introducing a boolean to
track whether or not the sign buffer should be freed in
the function exit path.
Signed-off-by: Ray Strode <address@hidden>
Reviewed-by: Alon Levy <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
---
libcacard/cac.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/libcacard/cac.c b/libcacard/cac.c
index ae8c378..f38fdce 100644
--- a/libcacard/cac.c
+++ b/libcacard/cac.c
@@ -115,6 +115,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
VCardAppletPrivate *applet_private;
int size, next;
unsigned char *sign_buffer;
+ bool retain_sign_buffer = FALSE;
vcard_7816_status_t status;
VCardStatus ret = VCARD_FAIL;
@@ -178,6 +179,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
pki_applet->sign_buffer = sign_buffer;
pki_applet->sign_buffer_len = size;
*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
+ retain_sign_buffer = TRUE;
break;
case 0x00:
/* we now have the whole buffer, do the operation, result will be
@@ -200,9 +202,11 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
break;
}
- g_free(sign_buffer);
- pki_applet->sign_buffer = NULL;
- pki_applet->sign_buffer_len = 0;
+ if (!retain_sign_buffer) {
+ g_free(sign_buffer);
+ pki_applet->sign_buffer = NULL;
+ pki_applet->sign_buffer_len = 0;
+ }
ret = VCARD_DONE;
break;
case CAC_READ_BUFFER:
--
1.8.3.1
- [Qemu-devel] [PULL 0/5] usb patch queue., Gerd Hoffmann, 2014/10/28
- [Qemu-devel] [PULL 3/5] libcacard: don't free sign buffer while sign op is pending,
Gerd Hoffmann <=
- [Qemu-devel] [PULL 1/5] libcacard: introduce new vcard_emul_logout, Gerd Hoffmann, 2014/10/28
- [Qemu-devel] [PULL 4/5] xhci: add property to turn on/off streams support, Gerd Hoffmann, 2014/10/28
- [Qemu-devel] [PULL 2/5] libcacard: Lock NSS cert db when selecting an applet on an emulated card, Gerd Hoffmann, 2014/10/28
- [Qemu-devel] [PULL 5/5] uhci: remove useless DEBUG, Gerd Hoffmann, 2014/10/28
- Re: [Qemu-devel] [PULL 0/5] usb patch queue., Peter Maydell, 2014/10/31