From: Michael Tremer <michael.tremer@ipfire.org>
Date: Fri, 6 Oct 2023 14:37:02 +0000 (+0000)
Subject: util: Fix double free in base64 encoder
X-Git-Tag: 0.9.30~1532
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e85bed8d118625bea6905594d27fc87c2a52c3de;p=pakfire.git

util: Fix double free in base64 encoder

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/libpakfire/util.c b/src/libpakfire/util.c
index c06bf59ee..8f3c68a45 100644
--- a/src/libpakfire/util.c
+++ b/src/libpakfire/util.c
@@ -926,7 +926,7 @@ int pakfire_b64encode(struct pakfire* pakfire, char** output,
 	char error[OPENSSL_ERROR_MAX];
 	BIO* b64 = NULL;
 	BIO* bio = NULL;
-	char* p = NULL;
+	const char* p = NULL;
 	int r;
 
 	// Initialize the base64 encoder
@@ -939,9 +939,6 @@ int pakfire_b64encode(struct pakfire* pakfire, char** output,
 		goto ERROR;
 	}
 
-	// Disable line breaks and a trailing newline
-	BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
-
 	// Initialize a memory buffer
 	bio = BIO_new(BIO_s_mem());
 	if (!bio) {
@@ -953,10 +950,13 @@ int pakfire_b64encode(struct pakfire* pakfire, char** output,
 	}
 
 	// Connect both things
-	b64 = BIO_push(b64, bio);
+	bio = BIO_push(b64, bio);
+
+	// Disable line breaks and a trailing newline
+	BIO_set_flags(bio, BIO_FLAGS_BASE64_NO_NL);
 
 	// Write the input
-	r = BIO_write(b64, buffer, length);
+	r = BIO_write(bio, buffer, length);
 	if (r < 1) {
 		ERR_error_string_n(ERR_get_error(), error, sizeof(error));
 
@@ -966,10 +966,10 @@ int pakfire_b64encode(struct pakfire* pakfire, char** output,
 	}
 
 	// Flush
-	BIO_flush(b64);
+	BIO_flush(bio);
 
 	// Fetch a pointer to the output and determine its length
-	const size_t l = BIO_get_mem_data(b64, &p);
+	const size_t l = BIO_get_mem_data(bio, &p);
 
 	// Copy the output to the heap
 	*output = strndup(p, l);
@@ -983,12 +983,8 @@ int pakfire_b64encode(struct pakfire* pakfire, char** output,
 	r = 0;
 
 ERROR:
-	if (p)
-		free(p);
 	if (bio)
-		BIO_free(bio);
-	if (b64)
-		BIO_free(b64);
+		BIO_free_all(bio);
 
 	return r;
 }