Attachment 855752 Details for Bug 1058025 – Proposed fix

[patch] Proposed fix

0001-Fix-potential-segfault-on-free.patch (text/plain), 1.10 KB, created by Simo Sorce on 2014-01-26 18:51:57 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Simo Sorce

Created: 2014-01-26 18:51:57 UTC

Size: 1.10 KB

patch

obsolete

>From 83cc4073e928501f9f5da8e9611c46e7688d3c01 Mon Sep 17 00:00:00 2001
>From: Simo Sorce <simo@redhat.com>
>Date: Sun, 26 Jan 2014 13:49:04 -0500
>Subject: [PATCH] Fix potential segfault on free.
>
>Unfortunately iconv_close() does not follow good practices and blindignly
>dereferences data, even if the passed in pointer is NULL.
>
>So check before calling.
>---
> src/ntlm.c | 13 +++++++++----
> 1 file changed, 9 insertions(+), 4 deletions(-)
>
>diff --git a/src/ntlm.c b/src/ntlm.c
>index af6d57aa25523a4c806801b4eea4ad1eb1c9960a..b0729f148c26524d86def74d6b0c01384fe88568 100644
>--- a/src/ntlm.c
>+++ b/src/ntlm.c
>@@ -193,12 +193,17 @@ int ntlm_free_ctx(struct ntlm_ctx **ctx)
> 
>     if (!ctx || !*ctx) return 0;
> 
>-    ret = iconv_close((*ctx)->from_oem);
>-    if (ret) ret = errno;
>+    if ((*ctx)->from_oem) {
>+        ret = iconv_close((*ctx)->from_oem);
>+        if (ret) goto done;
>+    }
> 
>-    ret = iconv_close((*ctx)->to_oem);
>-    if (ret) ret = errno;
>+    if ((*ctx)->to_oem) {
>+        ret = iconv_close((*ctx)->to_oem);
>+    }
> 
>+done:
>+    if (ret) ret = errno;
>     safefree(*ctx);
>     return ret;
> }
>-- 
>1.8.5.3
>

Actions: View | Diff

Attachments on bug 1058025: 855752 | 855772