diff options
| author | Bernd Edlinger <bernd.edlinger@hotmail.de> | 2019-01-30 16:20:31 +0100 |
|---|---|---|
| committer | Bernd Edlinger <bernd.edlinger@hotmail.de> | 2019-01-31 20:03:29 +0100 |
| commit | 152abc5522d869668f50deeb99cd0d948d0df4c1 (patch) | |
| tree | dcfab12924af0d63f68420ecad4e1325ca78fc48 /crypto/x509/x_pubkey.c | |
| parent | 47c55f881ffef8aa5fafcb88d4230700bb279449 (diff) | |
Fix a crash in reuse of d2i_X509_PUBKEY
If the second PUBKEY is malformed there is use after free.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/8135)
Diffstat (limited to 'crypto/x509/x_pubkey.c')
| -rw-r--r-- | crypto/x509/x_pubkey.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/crypto/x509/x_pubkey.c b/crypto/x509/x_pubkey.c index cc692834d1..03271cbe97 100644 --- a/crypto/x509/x_pubkey.c +++ b/crypto/x509/x_pubkey.c @@ -36,6 +36,7 @@ static int pubkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, /* Attempt to decode public key and cache in pubkey structure. */ X509_PUBKEY *pubkey = (X509_PUBKEY *)*pval; EVP_PKEY_free(pubkey->pkey); + pubkey->pkey = NULL; /* * Opportunistically decode the key but remove any non fatal errors * from the queue. Subsequent explicit attempts to decode/use the key |