Attachment 2377 Details for Bug 2175 – use_after_free fix

use_after_free fix

use_after_free.c (text/plain), 1.08 KB, created by Loganaden Velvindron on 2013-12-01 04:09:51 AEDT

(hide)

Description:

Filename:

MIME Type:

Creator: Loganaden Velvindron

Created: 2013-12-01 04:09:51 AEDT

Size: 1.08 KB

patch

obsolete

>Index: key.c
>===================================================================
>RCS file: /cvs/openssh/key.c,v
>retrieving revision 1.113
>diff -u -p -r1.113 key.c
>--- key.c	10 Nov 2013 01:38:43 -0000	1.113
>+++ key.c	30 Nov 2013 17:06:07 -0000
>@@ -1587,6 +1587,9 @@ to_blob(const Key *key, u_char **blobp, 
> 	Buffer b;
> 	int len, type;
> 
>+	if (blobp)
>+		*blobp = NULL;
>+
> 	if (key == NULL) {
> 		error("key_to_blob: key == NULL");
> 		return 0;
>Index: ssh-pkcs11-helper.c
>===================================================================
>RCS file: /cvs/openssh/ssh-pkcs11-helper.c,v
>retrieving revision 1.11
>diff -u -p -r1.11 ssh-pkcs11-helper.c
>--- ssh-pkcs11-helper.c	1 Jun 2013 21:31:19 -0000	1.11
>+++ ssh-pkcs11-helper.c	30 Nov 2013 17:06:07 -0000
>@@ -127,7 +127,8 @@ process_add(void)
> 		buffer_put_char(&msg, SSH2_AGENT_IDENTITIES_ANSWER);
> 		buffer_put_int(&msg, nkeys);
> 		for (i = 0; i < nkeys; i++) {
>-			key_to_blob(keys[i], &blob, &blen);
>+			if (key_to_blob(keys[i], &blob, &blen) == 0)
>+				continue;
> 			buffer_put_string(&msg, blob, blen);
> 			buffer_put_cstring(&msg, name);
> 			free(blob);

Actions: View

Attachments on bug 2175: 2377