summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeff Layton <jlayton@samba.org>2013-10-13 21:26:55 -0400
committerVolker Lendecke <vl@samba.org>2013-10-14 16:54:34 +0200
commitfec84112f3f7bdca9088ed7cabfe827bb21b0118 (patch)
tree7be92f6f55703383fafd255d721fbf41e26bf565
parent13a10d43141c29dad61868b451c0c1dca82360de (diff)
downloadsamba-fec84112f3f7bdca9088ed7cabfe827bb21b0118.tar.gz
samba-fec84112f3f7bdca9088ed7cabfe827bb21b0118.tar.bz2
samba-fec84112f3f7bdca9088ed7cabfe827bb21b0118.zip
asn1: fix use-after-free in asn1_write
On talloc_realloc failure, asn1_write calls talloc_free on an asn1_data pointer and then tries to immediately set the has_error flag on it. Skip the free and just set the has_error flag. Signed-off-by: Jeff Layton <jlayton@redhat.com> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Mon Oct 14 16:54:35 CEST 2013 on sn-devel-104
-rw-r--r--lib/util/asn1.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/lib/util/asn1.c b/lib/util/asn1.c
index 70637a3e06..7e85d4b19a 100644
--- a/lib/util/asn1.c
+++ b/lib/util/asn1.c
@@ -44,7 +44,6 @@ bool asn1_write(struct asn1_data *data, const void *p, int len)
uint8_t *newp;
newp = talloc_realloc(data, data->data, uint8_t, data->ofs+len);
if (!newp) {
- asn1_free(data);
data->has_error = true;
return false;
}