diff options
| author | Jeff Layton <jlayton@samba.org> | 2013-10-13 21:26:55 -0400 |
|---|---|---|
| committer | Volker Lendecke <vl@samba.org> | 2013-10-14 16:54:34 +0200 |
| commit | fec84112f3f7bdca9088ed7cabfe827bb21b0118 (patch) | |
| tree | 7be92f6f55703383fafd255d721fbf41e26bf565 /lib/util | |
| parent | 13a10d43141c29dad61868b451c0c1dca82360de (diff) | |
| download | samba-fec84112f3f7bdca9088ed7cabfe827bb21b0118.tar.gz | |
asn1: fix use-after-free in asn1_write
On talloc_realloc failure, asn1_write calls talloc_free on an asn1_data
pointer and then tries to immediately set the has_error flag on it.
Skip the free and just set the has_error flag.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Mon Oct 14 16:54:35 CEST 2013 on sn-devel-104
Diffstat (limited to 'lib/util')
| -rw-r--r-- | lib/util/asn1.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/lib/util/asn1.c b/lib/util/asn1.c index 70637a3e065..7e85d4b19a5 100644 --- a/lib/util/asn1.c +++ b/lib/util/asn1.c @@ -44,7 +44,6 @@ bool asn1_write(struct asn1_data *data, const void *p, int len) uint8_t *newp; newp = talloc_realloc(data, data->data, uint8_t, data->ofs+len); if (!newp) { - asn1_free(data); data->has_error = true; return false; } |