From: Steve Holme <steve_holme@hotmail.com>
Date: Fri, 26 Dec 2014 11:58:17 +0000 (+0000)
Subject: vtls: Don't set cert info count until memory allocation is successful
X-Git-Tag: curl-7_40_0~87
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cdc1cc22e75bbe6434e9603c91e933171ac9edf2;p=thirdparty%2Fcurl.git

vtls: Don't set cert info count until memory allocation is successful

Otherwise Curl_ssl_init_certinfo() can fail and set the num_of_certs
member variable to the requested count, which could then be used
incorrectly as libcurl closes down.
---

diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
index 165f49b8bf..a53ff4ad6f 100644
--- a/lib/vtls/vtls.c
+++ b/lib/vtls/vtls.c
@@ -593,12 +593,14 @@ void Curl_ssl_free_certinfo(struct SessionHandle *data)
 {
   int i;
   struct curl_certinfo *ci = &data->info.certs;
+
   if(ci->num_of_certs) {
     /* free all individual lists used */
     for(i=0; i<ci->num_of_certs; i++) {
       curl_slist_free_all(ci->certinfo[i]);
       ci->certinfo[i] = NULL;
     }
+
     free(ci->certinfo); /* free the actual array too */
     ci->certinfo = NULL;
     ci->num_of_certs = 0;
@@ -610,13 +612,15 @@ CURLcode Curl_ssl_init_certinfo(struct SessionHandle *data, int num)
   struct curl_certinfo *ci = &data->info.certs;
   struct curl_slist **table;
 
-  /* Initialize the certificate information structures */
+  /* Free any previous certificate information structures */
   Curl_ssl_free_certinfo(data);
-  ci->num_of_certs = num;
+
+  /* Allocate the required certificate information structures */
   table = calloc((size_t) num, sizeof(struct curl_slist *));
   if(!table)
     return CURLE_OUT_OF_MEMORY;
 
+  ci->num_of_certs = num;
   ci->certinfo = table;
 
   return CURLE_OK;