diff options
| author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-11-15 10:31:00 +0100 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-11-15 10:33:16 +0100 |
| commit | a39dde8ce5247c6bdbed91ebea254c07be0dc925 (patch) | |
| tree | b764929f6b79c3198a1b56808d883689c7bcd113 | |
| parent | 4ef5efeac76f5880cddf49bd3162fd601c7b78bf (diff) | |
| download | gnutls-a39dde8ce5247c6bdbed91ebea254c07be0dc925.tar.gz | |
gnutls_x509_ext_import_proxy: corrected memory leak
Also added reproducer for the memory leak found.
Issue found using oss-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3159
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| -rw-r--r-- | fuzz/gnutls_x509_parser_fuzzer.repro/leak-45ceff5162bae741d1048cede0d5dfe6b677761d | bin | 0 -> 1596 bytes | |||
| -rw-r--r-- | lib/x509/x509_ext.c | 16 |
2 files changed, 8 insertions, 8 deletions
diff --git a/fuzz/gnutls_x509_parser_fuzzer.repro/leak-45ceff5162bae741d1048cede0d5dfe6b677761d b/fuzz/gnutls_x509_parser_fuzzer.repro/leak-45ceff5162bae741d1048cede0d5dfe6b677761d Binary files differnew file mode 100644 index 0000000000..ded50c8ab4 --- /dev/null +++ b/fuzz/gnutls_x509_parser_fuzzer.repro/leak-45ceff5162bae741d1048cede0d5dfe6b677761d diff --git a/lib/x509/x509_ext.c b/lib/x509/x509_ext.c index 99e0a43f30..58c3263d1e 100644 --- a/lib/x509/x509_ext.c +++ b/lib/x509/x509_ext.c @@ -1520,9 +1520,9 @@ int gnutls_x509_ext_export_basic_constraints(unsigned int ca, int pathlen, * * Since: 3.3.0 **/ -int gnutls_x509_ext_import_proxy(const gnutls_datum_t * ext, int *pathlen, - char **policyLanguage, char **policy, - size_t * sizeof_policy) +int gnutls_x509_ext_import_proxy(const gnutls_datum_t *ext, int *pathlen, + char **policyLanguage, char **policy, + size_t *sizeof_policy) { ASN1_TYPE c2 = ASN1_TYPE_EMPTY; int result; @@ -1563,11 +1563,6 @@ int gnutls_x509_ext_import_proxy(const gnutls_datum_t * ext, int *pathlen, goto cleanup; } - if (policyLanguage) { - *policyLanguage = (char *)value1.data; - value1.data = NULL; - } - result = _gnutls_x509_read_value(c2, "proxyPolicy.policy", &value2); if (result == GNUTLS_E_ASN1_ELEMENT_NOT_FOUND) { if (policy) @@ -1586,6 +1581,11 @@ int gnutls_x509_ext_import_proxy(const gnutls_datum_t * ext, int *pathlen, *sizeof_policy = value2.size; } + if (policyLanguage) { + *policyLanguage = (char *)value1.data; + value1.data = NULL; + } + result = 0; cleanup: gnutls_free(value1.data); |