aboutsummaryrefslogtreecommitdiff
path: root/libcacard
diff options
context:
space:
mode:
authorRay Strode <rstrode@redhat.com>2014-10-18 22:12:49 -0400
committerGerd Hoffmann <kraxel@redhat.com>2014-10-28 11:38:18 +0100
commit81b49e8f892a977f3821f3416ea51aa641d63ac4 (patch)
treea07966fbb3c6ddf79779b88685636789b776e0ca /libcacard
parent1223bc4cee3fcdbcb1f6a3ff4ff7a3ab1d875b8a (diff)
downloadqemu-81b49e8f892a977f3821f3416ea51aa641d63ac4.zip
qemu-81b49e8f892a977f3821f3416ea51aa641d63ac4.tar.gz
qemu-81b49e8f892a977f3821f3416ea51aa641d63ac4.tar.bz2
libcacard: don't free sign buffer while sign op is pending
commit 57f97834efe0c208ffadc9d2959f3d3d55580e52 cleaned up the cac_applet_pki_process_apdu function to have a single exit point. Unfortunately, that commit introduced a bug where the sign buffer can get free'd and nullified while it's still being used. This commit corrects the bug by introducing a boolean to track whether or not the sign buffer should be freed in the function exit path. Signed-off-by: Ray Strode <rstrode@redhat.com> Reviewed-by: Alon Levy <alon@pobox.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'libcacard')
-rw-r--r--libcacard/cac.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/libcacard/cac.c b/libcacard/cac.c
index ae8c378..f38fdce 100644
--- a/libcacard/cac.c
+++ b/libcacard/cac.c
@@ -115,6 +115,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
VCardAppletPrivate *applet_private;
int size, next;
unsigned char *sign_buffer;
+ bool retain_sign_buffer = FALSE;
vcard_7816_status_t status;
VCardStatus ret = VCARD_FAIL;
@@ -178,6 +179,7 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
pki_applet->sign_buffer = sign_buffer;
pki_applet->sign_buffer_len = size;
*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
+ retain_sign_buffer = TRUE;
break;
case 0x00:
/* we now have the whole buffer, do the operation, result will be
@@ -200,9 +202,11 @@ cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
break;
}
- g_free(sign_buffer);
- pki_applet->sign_buffer = NULL;
- pki_applet->sign_buffer_len = 0;
+ if (!retain_sign_buffer) {
+ g_free(sign_buffer);
+ pki_applet->sign_buffer = NULL;
+ pki_applet->sign_buffer_len = 0;
+ }
ret = VCARD_DONE;
break;
case CAC_READ_BUFFER: