espressif/mbedtls
1
0
Fork 0
mirror of https://github.com/espressif/mbedtls.git synced 2026-10-01 22:57:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix dangling freed pointer on error in pkcs7_get_signers_info_set

Browse Source 
This fixes a use-after-free in PKCS#7 parsing when the signer data is
malformed.

Credit to OSS-Fuzz (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53798).

Signed-off-by: Gilles Peskine <[email protected]>
This commit is contained in:
Gilles Peskine
2022-11-27 21:55:29 +01:00
parent 590ae5363d
commit 290f01b3f5
3 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
library/pkcs7.c
+3 -2
View File
@@ -430,15 +430,16 @@ static int pkcs7_get_signers_info_set( unsigned char **p, unsigned char *end,
goto out;
cleanup:
signer = signers_set->next;
pkcs7_free_signer_info( signers_set );
while( signer )
signer = signers_set->next;
while( signer != NULL )
{
prev = signer;
signer = signer->next;
pkcs7_free_signer_info( prev );
mbedtls_free( prev );
}
signers_set->next = NULL;
out:
return( ret );