Package: libcanlock2
Version: 2b-4
Severity: minor
Tags: patch
below is a _untested_ patch which should fix several memleaks in
libcanlock2, please review carefully befor applying.
diff -Nur include/canlock.h include/canlock.h
--- include/canlock.h 2008-12-11 20:31:24.000000000 +0100
+++ include/canlock.h 2009-03-19 21:29:49.975475417 +0100
@@ -4,5 +4,5 @@
const unsigned char *message, size_t msglen);
int sha_verify(const char *key, const char *lock);
-char *lock_strip_alpha(const char *key, char *type);
-char *lock_strip(const char *key, char *type);
+char *lock_strip_alpha(char *key, char *type);
+char *lock_strip(char *key, char *type);
diff -Nur src/canlock.c src/canlock.c
--- src/canlock.c 2008-12-11 20:31:24.000000000 +0100
+++ src/canlock.c 2009-03-19 21:30:23.540492221 +0100
@@ -47,9 +47,9 @@
* type is set to the lock type, else zero on failure.
*/
char *
-lock_strip_alpha(const char *key, char *type)
+lock_strip_alpha(char *key, char *type)
{
- char *ret;
+ char *ret, *p = key;
int offset;
do {
*type = tolower(*key);
@@ -59,19 +59,20 @@
*type = '\0';
key++;
+ free(p);
ret = strdup (key);
/* Strip the "Clue-string", no longer part of the lastest
* draft but could still be present */
offset = 0;
while (ret[offset] && ret[offset] != ':')
- offset++;
+ offset++;
ret[offset] = '\0';
return ret;
}
char *
-lock_strip(const char *key, char *type)
+lock_strip(char *key, char *type)
{
return lock_strip_alpha(key, type);
}
@@ -129,10 +130,15 @@
sha_key(secret, seclen, message, msglen), junk);
if (!cankey)
return NULL;
- if (sha_init(&hash_ctx))
+ if (sha_init(&hash_ctx)) {
+ free(cankey);
return NULL;
- if (sha_update(&hash_ctx, cankey, strlen((char *) cankey)))
+ }
+ if (sha_update(&hash_ctx, cankey, strlen((char *) cankey))) {
+ free(cankey);
return NULL;
+ }
+ free(cankey);
if (sha_digest(&hash_ctx, hmacbuff))
return NULL;
locksize = base64_encode(hmacbuff, SHA_DIGESTSIZE, canlock);
diff -Nur src/hmac_sha1.c src/hmac_sha1.c
--- src/hmac_sha1.c 2008-12-11 20:31:24.000000000 +0100
+++ src/hmac_sha1.c 2009-03-19 20:24:11.979149316 +0100
@@ -95,10 +95,15 @@
memcpy(&step2[SHA_DATASIZE], T, Tlen);
- if (sha_init(&hash_ctx))
+ if (sha_init(&hash_ctx)) {
+ free(step2);
return NULL;
- if (sha_update(&hash_ctx, step2, SHA_DATASIZE + Tlen))
+ }
+ if (sha_update(&hash_ctx, step2, SHA_DATASIZE + Tlen)) {
+ free(step2);
return NULL;
+ }
+ free(step2);
if (sha_digest(&hash_ctx, step4))
return NULL;
@@ -108,12 +113,18 @@
if (!hmac_out)
return NULL;
- if (sha_init(&hash_ctx))
+ if (sha_init(&hash_ctx)) {
+ free(hmac_out);
return NULL;
- if (sha_update(&hash_ctx, step5, SHA_DATASIZE + SHA_DIGESTSIZE))
- return NULL;
- if (sha_digest(&hash_ctx, hmac_out))
+ }
+ if (sha_update(&hash_ctx, step5, SHA_DATASIZE + SHA_DIGESTSIZE)) {
+ free(hmac_out);
+ return NULL;
+ }
+ if (sha_digest(&hash_ctx, hmac_out)) {
+ free(hmac_out);
return NULL;
+ }
return hmac_out;
}
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
