]> git.ipfire.org Git - thirdparty/openssl.git/commit
Fix potential double free through SRP_user_pwd_set1_ids()
authorNiels Dossche <7771979+nielsdos@users.noreply.github.com>
Wed, 9 Oct 2024 21:00:13 +0000 (23:00 +0200)
committerTomas Mraz <tomas@openssl.org>
Fri, 11 Oct 2024 12:22:36 +0000 (14:22 +0200)
commit792b2c8da283d4230caa761ea6f5d050cb5795e7
tree577cf3ede9ca0a2b9b097152ef82d2e8158a1d4e
parent38e8392ba0c8dcd975de47a3119d0051cf5e44a1
Fix potential double free through SRP_user_pwd_set1_ids()

If SRP_user_pwd_set1_ids() fails during one of the duplications, or id
is NULL, then the old pointer values are still stored but they are now dangling.
Later when SRP_user_pwd_free() is called these are freed again,
leading to a double free.

Although there are no such uses in OpenSSL as far as I found,
it's still a public API.

CLA: trivial

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25655)
crypto/srp/srp_vfy.c