From 698e36ad21d7892bd6be80256e0c3d5603d6d44e Mon Sep 17 00:00:00 2001 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com> Date: Wed, 9 Oct 2024 23:00:13 +0200 Subject: [PATCH] Fix potential double free through SRP_user_pwd_set1_ids() If SRP_user_pwd_set1_ids() fails during one of the duplications, or id is NULL, then the old pointer values are still stored but they are now dangling. Later when SRP_user_pwd_free() is called these are freed again, leading to a double free. Although there are no such uses in OpenSSL as far as I found, it's still a public API. CLA: trivial Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/25655) (cherry picked from commit 792b2c8da283d4230caa761ea6f5d050cb5795e7) --- crypto/srp/srp_vfy.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/srp/srp_vfy.c b/crypto/srp/srp_vfy.c index 96d511ffe63..4b842dfd912 100644 --- a/crypto/srp/srp_vfy.c +++ b/crypto/srp/srp_vfy.c @@ -216,6 +216,8 @@ int SRP_user_pwd_set1_ids(SRP_user_pwd *vinfo, const char *id, { OPENSSL_free(vinfo->id); OPENSSL_free(vinfo->info); + vinfo->id = NULL; + vinfo->info = NULL; if (id != NULL && NULL == (vinfo->id = OPENSSL_strdup(id))) return 0; return (info == NULL || NULL != (vinfo->info = OPENSSL_strdup(info))); -- 2.47.2