[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 48/88] libcacard: don't free sign buffer while sign
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 48/88] libcacard: don't free sign buffer while sign op is pending |
Date: |
Thu, 8 Jan 2015 11:33:52 -0600 |
From: Ray Strode <address@hidden>
commit 57f97834efe0c208ffadc9d2959f3d3d55580e52 cleaned up
the cac_applet_pki_process_apdu function to have a single
exit point. Unfortunately, that commit introduced a bug
where the sign buffer can get free'd and nullified while
it's still being used.
This commit corrects the bug by introducing a boolean to
track whether or not the sign buffer should be freed in
the function exit path.
Signed-off-by: Ray Strode <address@hidden>
Reviewed-by: Alon Levy <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 81b49e8f892a977f3821f3416ea51aa641d63ac4)
Signed-off-by: Michael Roth <address@hidden>
---
libcacard/cac.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/libcacard/cac.c b/libcacard/cac.c
index ae8c378..f38fdce 100644
--- a/libcacard/cac.c
+++ b/libcacard/cac.c
@@ -115,6 +115,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
VCardAppletPrivate *applet_private;
int size, next;
unsigned char *sign_buffer;
+ bool retain_sign_buffer = FALSE;
vcard_7816_status_t status;
VCardStatus ret = VCARD_FAIL;
@@ -178,6 +179,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
pki_applet->sign_buffer = sign_buffer;
pki_applet->sign_buffer_len = size;
*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
+ retain_sign_buffer = TRUE;
break;
case 0x00:
/* we now have the whole buffer, do the operation, result will be
@@ -200,9 +202,11 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
break;
}
- g_free(sign_buffer);
- pki_applet->sign_buffer = NULL;
- pki_applet->sign_buffer_len = 0;
+ if (!retain_sign_buffer) {
+ g_free(sign_buffer);
+ pki_applet->sign_buffer = NULL;
+ pki_applet->sign_buffer_len = 0;
+ }
ret = VCARD_DONE;
break;
case CAC_READ_BUFFER:
--
1.9.1
- [Qemu-devel] [PATCH 36/88] virtio-rng: use aliases instead of duplicate qdev properties, (continued)
- [Qemu-devel] [PATCH 36/88] virtio-rng: use aliases instead of duplicate qdev properties, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 35/88] virtio-serial: fix virtio-serial child refcount in transports, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 39/88] virtio-9p: use aliases instead of duplicate qdev properties, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 42/88] vmware-vga: CVE-2014-3689: turn off hw accel, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 30/88] virtio-net: use aliases instead of duplicate qdev properties, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 29/88] vhost-scsi: use virtio_ldl_p, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 44/88] vmware-vga: use vmsvga_verify_rect in vmsvga_update_rect, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 43/88] vmware-vga: add vmsvga_verify_rect, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 37/88] virtio-rng: fix virtio-rng child refcount in transports, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 41/88] pc: Fix disabling of vapic for compat PC models, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 48/88] libcacard: don't free sign buffer while sign op is pending,
Michael Roth <=
- [Qemu-devel] [PATCH 46/88] vmware-vga: use vmsvga_verify_rect in vmsvga_fill_rect, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 50/88] vnc: sanitize bits_per_pixel from the client, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 40/88] virtio-9p: fix virtio-9p child refcount in transports, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 45/88] vmware-vga: use vmsvga_verify_rect in vmsvga_copy_rect, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 51/88] virtio-scsi: sense in virtio_scsi_command_complete, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 52/88] tcg/mips: fix store softmmu slow path, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 47/88] qcow2: Do not overflow when writing an L1 sector, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 49/88] Make qemu_shutdown_requested signal-safe, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 54/88] hw/xtensa/xtfpga: treat uImage load address as virtual, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 53/88] hw/core/loader: implement address translation in uimage loader, Michael Roth, 2015/01/08