In case of an error in efi_sigstore_parse_siglist() function efi_sigstore_free() is called. Currently it fails to free allocated data because siglist->sig_data_list is not set on the error path.
Always update siglist->sig_data_list when a struct efi_sig_data is allocated. Suggested-by: Ilias Apalodimas <[email protected]> Signed-off-by: Heinrich Schuchardt <[email protected]> --- v2: Update siglist->sig_data_list inside loop. --- lib/efi_loader/efi_signature.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/lib/efi_loader/efi_signature.c b/lib/efi_loader/efi_signature.c index f99a0c29d2b..c2be5cb61b3 100644 --- a/lib/efi_loader/efi_signature.c +++ b/lib/efi_loader/efi_signature.c @@ -647,7 +647,7 @@ static struct efi_signature_store * efi_sigstore_parse_siglist(struct efi_signature_list *esl) { struct efi_signature_store *siglist = NULL; - struct efi_sig_data *sig_data, *sig_data_next; + struct efi_sig_data *sig_data; struct efi_signature_data *esd; size_t left; @@ -690,7 +690,6 @@ efi_sigstore_parse_siglist(struct efi_signature_list *esl) memcpy(&siglist->sig_type, &esl->signature_type, sizeof(efi_guid_t)); /* Go through the list */ - sig_data_next = NULL; left = esl->signature_list_size - (sizeof(*esl) + esl->signature_header_size); esd = (struct efi_signature_data *) @@ -709,6 +708,9 @@ efi_sigstore_parse_siglist(struct efi_signature_list *esl) goto err; } + sig_data->next = siglist->sig_data_list; + siglist->sig_data_list = sig_data; + /* Append signature data */ memcpy(&sig_data->owner, &esd->signature_owner, sizeof(efi_guid_t)); @@ -721,15 +723,11 @@ efi_sigstore_parse_siglist(struct efi_signature_list *esl) } memcpy(sig_data->data, esd->signature_data, sig_data->size); - sig_data->next = sig_data_next; - sig_data_next = sig_data; - /* Next */ esd = (struct efi_signature_data *) ((u8 *)esd + esl->signature_size); left -= esl->signature_size; } - siglist->sig_data_list = sig_data_next; return siglist; -- 2.53.0
