Bug#773520: [Pkg-gnupg-maint] Bug#773520: use-after-free

2015-01-07 Thread NIIBE Yutaka
On 01/07/2015 01:58 PM, NIIBE Yutaka wrote:
 Here is my fix along with other fixes in map_host function.
[...]
 @@ -504,9 +506,11 @@ map_host (ctrl_t ctrl, const char *name, int 
 force_reselect,
hi-pool = xtryrealloc (reftbl, (refidx+1) * sizeof *reftbl);
if (!hi-pool)
  {
 +  err = gpg_error_from_syserror ();
log_error (shrinking index table in map_host failed: %s\n,
   strerror (errno));
xfree (reftbl);
 +  return err;
  }

Changing the call of strerror (errno) above into gpg_strerror (err), I
committed the change into master.
-- 


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#773520: [Pkg-gnupg-maint] Bug#773520: use-after-free

2015-01-06 Thread NIIBE Yutaka
Hello,

Thanks for your reviewing and reporting.  This message is Cc-ed to
gnupg-devel.

On 12/19/2014 09:56 PM, Joshua Rogers wrote:
 Package: gnupg2
 Version: 2.1.1
 Severity: normal
[...]
 In ks-engine-hkp.c on line 509 'reftbl' is freed, but it is then
 used on line 511. I'm guessing this is a missing return;.

Right.

Here is my fix along with other fixes in map_host function.


diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 3c6a003..c13cec9 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -325,6 +325,7 @@ static gpg_error_t
 map_host (ctrl_t ctrl, const char *name, int force_reselect,
   char **r_host, unsigned int *r_httpflags, char **r_poolname)
 {
+  gpg_error_t err = 0;
   hostinfo_t hi;
   int idx;

@@ -361,8 +362,9 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
   idx = create_new_hostinfo (name);
   if (idx == -1)
 {
+  err = gpg_error_from_syserror ();
   xfree (reftbl);
-  return gpg_error_from_syserror ();
+  return err;
 }
   hi = hosttable[idx];

@@ -504,9 +506,11 @@ map_host (ctrl_t ctrl, const char *name, int 
force_reselect,
   hi-pool = xtryrealloc (reftbl, (refidx+1) * sizeof *reftbl);
   if (!hi-pool)
 {
+  err = gpg_error_from_syserror ();
   log_error (shrinking index table in map_host failed: %s\n,
  strerror (errno));
   xfree (reftbl);
+  return err;
 }
   qsort (reftbl, refidx, sizeof *reftbl, sort_hostpool);
 }
@@ -570,12 +574,13 @@ map_host (ctrl_t ctrl, const char *name, int 
force_reselect,
   *r_host = xtrystrdup (hi-name);
   if (!*r_host)
 {
+  err = gpg_error_from_syserror ();
   if (r_poolname)
 {
   xfree (*r_poolname);
   *r_poolname = NULL;
 }
-  return gpg_error_from_syserror ();
+  return err;
 }
   return 0;
 }
-- 


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org