Bug 1526523

Description of problem:

  The function `static int registration_challenge_json()` in u2f-server/core.c
  of the u2f-server binary frees an unowned pointer to a json_object, which
  gets added (an thus transfers the ownership of that object to the new
  parent object) to another json_object.


Version-Release number of selected component (if applicable):

  All built versions of libu2f-server are affected.


How reproducible:

  100%


Steps to Reproduce:

  1.  Just run a registration process with u2f-server.


Actual results:

  Triggers unknown behaviour and memory corruption.  Valgrind reports
  invalid reads to free'd memory regions at the end of the function.


Expected results:

  The co-ownership of the json_object must be kept properly by the instance,
  which gets created inside of the function so it doesn't get free'd when
  it's parent json_object is passed to json_object_put() at the end of
  the function call.


Additional info:

  I recently discovered this undefined behaviour when doing the rebuilds for
  json-c 0.13 and fixed it with a set upstream(ed) patches [1,2] in Rawhide.

  I strongly recommend to backport this to all supported releases of Fedora
  and EPEL, where libu2f-server has been built for.

  If you don't object within a week, I'll merge down the master branch and
  do the builds myself.

  [1]  https://github.com/Yubico/libu2f-server/commit/5d74f88b278ca1df6c69d7328be2a8035ca7976c
  [2]  https://github.com/Yubico/libu2f-server/pull/31