equal
deleted
inserted
replaced
|
1 From 91239f7040b1f026d4d15765e7e3f58e92e93761 Mon Sep 17 00:00:00 2001 |
|
2 From: Daniel Stenberg <[email protected]> |
|
3 Date: Wed, 28 Sep 2016 12:56:02 +0200 |
|
4 Subject: [PATCH] krb5: avoid realloc(0) |
|
5 |
|
6 If the requested size is zero, bail out with error instead of doing a |
|
7 realloc() that would cause a double-free: realloc(0) acts as a free() |
|
8 and then there's a second free in the cleanup path. |
|
9 |
|
10 CVE-2016-8619 |
|
11 |
|
12 Bug: https://curl.haxx.se/docs/adv_20161102E.html |
|
13 Reported-by: Cure53 |
|
14 --- |
|
15 lib/security.c | 9 ++++++--- |
|
16 1 file changed, 6 insertions(+), 3 deletions(-) |
|
17 |
|
18 --- lib/security.c |
|
19 +++ lib/security.c |
|
20 @@ -190,19 +190,22 @@ socket_write(struct connectdata *conn, curl_socket_t fd, const void *to, |
|
21 static CURLcode read_data(struct connectdata *conn, |
|
22 curl_socket_t fd, |
|
23 struct krb5buffer *buf) |
|
24 { |
|
25 int len; |
|
26 - void* tmp; |
|
27 + void *tmp = NULL; |
|
28 CURLcode result; |
|
29 |
|
30 result = socket_read(fd, &len, sizeof(len)); |
|
31 if(result) |
|
32 return result; |
|
33 |
|
34 - len = ntohl(len); |
|
35 - tmp = realloc(buf->data, len); |
|
36 + if(len) { |
|
37 + /* only realloc if there was a length */ |
|
38 + len = ntohl(len); |
|
39 + tmp = realloc(buf->data, len); |
|
40 + } |
|
41 if(tmp == NULL) |
|
42 return CURLE_OUT_OF_MEMORY; |
|
43 |
|
44 buf->data = tmp; |
|
45 result = socket_read(fd, buf->data, len); |
|
46 -- |
|
47 2.9.3 |
|
48 |