[Pkg-gnupg-commit] [gnupg2] 129/241: gpg: Fix regression in --locate-keys (in 2.1.9).
Daniel Kahn Gillmor
dkg at fifthhorseman.net
Wed Dec 9 20:32:05 UTC 2015
This is an automated email from the git hooks/post-receive script.
dkg pushed a commit to branch master
in repository gnupg2.
commit 7e59fb21f728b5f54468cd35b1415a2f86003d4f
Author: Werner Koch <wk at gnupg.org>
Date: Fri Nov 13 12:56:13 2015 +0100
gpg: Fix regression in --locate-keys (in 2.1.9).
* g10/getkey.c (getkey_ctx_s): Add field "extra_list".
(get_pubkey_byname): Store strings in the context.
(getkey_end): Free EXTRA_LIST.
--
This fixes a use-after-free bug. It showed up with:
gpg --auto-key-locate local --locate-key wk at gnupg.org
The key was shown but also all other following keys in the keyring.
Bisecting showed d47e84946ee010917cfc3501062721b74afbb771 as culprit
but the actual cause was a part of:
Regression-due-to: b06f96ba4f57f55194efcd37a0e3a2aa5450b974
Signed-off-by: Werner Koch <wk at gnupg.org>
---
g10/getkey.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/g10/getkey.c b/g10/getkey.c
index 9e123ee..7238bc3 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -77,6 +77,10 @@ struct getkey_ctx_s
released using getkey_end()). */
int not_allocated;
+ /* This variable is used as backing store for strings which have
+ their address used in ITEMS. */
+ strlist_t extra_list;
+
/* Part of the search criteria: The low-level search specification
as passed to keydb_search. */
int nitems;
@@ -1028,7 +1032,14 @@ get_pubkey_byname (ctrl_t ctrl, GETKEY_CTX * retctx, PKT_public_key * pk,
*retctx = NULL;
}
- free_strlist (namelist);
+ if (retctx && *retctx)
+ {
+ assert (!(*retctx)->extra_list);
+ (*retctx)->extra_list = namelist;
+ }
+ else
+ free_strlist (namelist);
+
return rc;
}
@@ -1279,6 +1290,7 @@ getkey_end (getkey_ctx_t ctx)
if (ctx)
{
keydb_release (ctx->kr_handle);
+ free_strlist (ctx->extra_list);
if (!ctx->not_allocated)
xfree (ctx);
}
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-gnupg/gnupg2.git
More information about the Pkg-gnupg-commit
mailing list