From fec84112f3f7bdca9088ed7cabfe827bb21b0118 Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Sun, 13 Oct 2013 21:26:55 -0400 Subject: [PATCH] asn1: fix use-after-free in asn1_write On talloc_realloc failure, asn1_write calls talloc_free on an asn1_data pointer and then tries to immediately set the has_error flag on it. Skip the free and just set the has_error flag. Signed-off-by: Jeff Layton Reviewed-by: Volker Lendecke Autobuild-User(master): Volker Lendecke Autobuild-Date(master): Mon Oct 14 16:54:35 CEST 2013 on sn-devel-104 --- lib/util/asn1.c | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/util/asn1.c b/lib/util/asn1.c index 70637a3e06..7e85d4b19a 100644 --- a/lib/util/asn1.c +++ b/lib/util/asn1.c @@ -44,7 +44,6 @@ bool asn1_write(struct asn1_data *data, const void *p, int len) uint8_t *newp; newp = talloc_realloc(data, data->data, uint8_t, data->ofs+len); if (!newp) { - asn1_free(data); data->has_error = true; return false; } -- 2.34.1