lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-28 00:21:48 +03:00
Code Activity

Fix dangling freed pointer on error in pkcs7_get_signers_info_set

Browse Source 
This fixes a use-after-free in PKCS#7 parsing when the signer data is
malformed.

Credit to OSS-Fuzz (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53798).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine
2022-11-27 21:28:31 +01:00
parent 590ae5363d
commit 290f01b3f5
3 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
library/pkcs7.c
View File

@ -430,15 +430,16 @@ static int pkcs7_get_signers_info_set( unsigned char **p, unsigned char *end,
goto out;
cleanup:
signer = signers_set->next;
pkcs7_free_signer_info( signers_set );
while( signer )
signer = signers_set->next;
while( signer != NULL )
{
prev = signer;
signer = signer->next;
pkcs7_free_signer_info( prev );
mbedtls_free( prev );
}
signers_set->next = NULL;
out:
return( ret );