diff options
| author | Stefan Sørensen <stefan.sorensen@spectralink.com> | 2016-08-08 13:31:14 +0200 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2016-08-08 15:50:53 +0200 |
| commit | 096848ddf8699350aa964f694a74e319961f8c22 (patch) | |
| tree | ddccc3f56fe6f685b9fe2444e16c057a32d47fbf | |
| parent | a30a5359f9dd55e31d97925dfcf45f12ecaae37c (diff) | |
| download | gnutls-096848ddf8699350aa964f694a74e319961f8c22.tar.gz | |
Fix invalid pointer operation in gnutls_certificate_get_x509_crt
The access to the allocated crt_list variable was missing a pointer
dereference, leading to memory corruption for any certificate list with more
than one element.
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
| -rw-r--r-- | lib/x509.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/x509.c b/lib/x509.c index 7412557b12..e6d58de15b 100644 --- a/lib/x509.c +++ b/lib/x509.c @@ -1263,10 +1263,10 @@ gnutls_certificate_get_x509_crt(gnutls_certificate_credentials_t res, } for (i = 0; i < res->certs[index].cert_list_length; ++i) { - ret = gnutls_pcert_export_x509(&res->certs[index].cert_list[i], crt_list[i]); + ret = gnutls_pcert_export_x509(&res->certs[index].cert_list[i], &(*crt_list)[i]); if (ret < 0) { while (i--) - gnutls_x509_crt_deinit(*crt_list[i]); + gnutls_x509_crt_deinit((*crt_list)[i]); gnutls_free(*crt_list); *crt_list = NULL; |