diff options
| author | Ray Strode <rstrode@redhat.com> | 2014-10-18 22:12:49 -0400 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2015-01-06 18:13:49 -0600 |
| commit | 90de7a03bbc24d559971248c5530631d9bc27250 (patch) | |
| tree | 4ede56ab707db5f73215dc3e341426e3e2810fab | |
| parent | 57248587af8090ca0bc7bd0cd672ff15e2ebf8b9 (diff) | |
| download | qemu-90de7a03bbc24d559971248c5530631d9bc27250.tar.gz | |
libcacard: don't free sign buffer while sign op is pending
commit 57f97834efe0c208ffadc9d2959f3d3d55580e52 cleaned up
the cac_applet_pki_process_apdu function to have a single
exit point. Unfortunately, that commit introduced a bug
where the sign buffer can get free'd and nullified while
it's still being used.
This commit corrects the bug by introducing a boolean to
track whether or not the sign buffer should be freed in
the function exit path.
Signed-off-by: Ray Strode <rstrode@redhat.com>
Reviewed-by: Alon Levy <alon@pobox.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 81b49e8f892a977f3821f3416ea51aa641d63ac4)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | libcacard/cac.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/libcacard/cac.c b/libcacard/cac.c index ae8c3784b9..f38fdceddd 100644 --- a/libcacard/cac.c +++ b/libcacard/cac.c @@ -115,6 +115,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu, VCardAppletPrivate *applet_private; int size, next; unsigned char *sign_buffer; + bool retain_sign_buffer = FALSE; vcard_7816_status_t status; VCardStatus ret = VCARD_FAIL; @@ -178,6 +179,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu, pki_applet->sign_buffer = sign_buffer; pki_applet->sign_buffer_len = size; *response = vcard_make_response(VCARD7816_STATUS_SUCCESS); + retain_sign_buffer = TRUE; break; case 0x00: /* we now have the whole buffer, do the operation, result will be @@ -200,9 +202,11 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu, VCARD7816_STATUS_ERROR_P1_P2_INCORRECT); break; } - g_free(sign_buffer); - pki_applet->sign_buffer = NULL; - pki_applet->sign_buffer_len = 0; + if (!retain_sign_buffer) { + g_free(sign_buffer); + pki_applet->sign_buffer = NULL; + pki_applet->sign_buffer_len = 0; + } ret = VCARD_DONE; break; case CAC_READ_BUFFER: |