So close. Allthough mval is now freed, the allocation is still not
checked and might result in a null dereference. See
http://marc.info/?l=openssl-dev&m=135212325625499

Dominik

On Mon, Dec 3, 2012 at 4:33 PM, Dr. Stephen Henson <[email protected]> wrote:
>   OpenSSL CVS Repository
>   http://cvs.openssl.org/
>   ____________________________________________________________________________
>
>   Server: cvs.openssl.org                  Name:   Dr. Stephen Henson
>   Root:   /v/openssl/cvs                   Email:  [email protected]
>   Module: openssl                          Date:   03-Dec-2012 17:33:54
>   Branch: OpenSSL_0_9_8-stable             Handle: 2012120316335400
>
>   Modified files:           (Branch: OpenSSL_0_9_8-stable)
>     openssl/apps            apps.c
>
>   Log:
>     fix leak
>
>   Summary:
>     Revision    Changes     Path
>     1.91.2.17   +3  -0      openssl/apps/apps.c
>   ____________________________________________________________________________
>
>   patch -p0 <<'@@ .'
>   Index: openssl/apps/apps.c
>   ============================================================================
>   $ cvs diff -u -r1.91.2.16 -r1.91.2.17 apps.c
>   --- openssl/apps/apps.c       12 Jun 2010 13:18:44 -0000      1.91.2.16
>   +++ openssl/apps/apps.c       3 Dec 2012 16:33:54 -0000       1.91.2.17
>   @@ -2156,6 +2156,7 @@
>         OPENSSL_free(ne_values);
>         OPENSSL_free(ne_types);
>         OPENSSL_free(buf);
>   +     OPENSSL_free(mval);
>         return n;
>
>    error:
>   @@ -2164,6 +2165,8 @@
>                 OPENSSL_free(ne_values);
>         if (ne_types)
>                 OPENSSL_free(ne_types);
>   +     if (mval)
>   +             OPENSSL_free(mval);
>         if (buf)
>                 OPENSSL_free(buf);
>         return NULL;
>   @@ .
> ______________________________________________________________________
> OpenSSL Project                                 http://www.openssl.org
> CVS Repository Commit List                     [email protected]
> Automated List Manager                           [email protected]
______________________________________________________________________
OpenSSL Project                                 http://www.openssl.org
Development Mailing List                       [email protected]
Automated List Manager                           [email protected]

Reply via email to