Skip to content

XPKI-1158: libCertifier double free corruption - RDKEMW-11956 #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
relangovan wants to merge 1 commit into
base: master
Choose a base branch
from
Open

XPKI-1158: libCertifier double free corruption - RDKEMW-11956 #59

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions internal_headers/certifier/error.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,9 @@ typedef struct
char * library_error_msg;
} CertifierError;

/* NOTE: After assign_last_error(certifier, &tmp_err), do not call error_clear(&tmp_err) for the message pointers (they no longer belong to tmp_err).
* It’s safe to reuse tmp_err for codes, but not to free its message fields because they were moved.
*/
void error_clear(CertifierError * error);

enum
Expand Down
10 changes: 9 additions & 1 deletion src/certifier.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -845,7 +845,15 @@ void certifier_print_certificate_validity(Certifier * certifier)
static inline void assign_last_error(Certifier * certifier, CertifierError * error)
{
error_clear(&certifier->last_error);
certifier->last_error = *error;
certifier->last_error.application_error_code = error->application_error_code;
certifier->last_error.library_error_code = error->library_error_code;
certifier->last_error.application_error_msg = error->application_error_msg;
certifier->last_error.library_error_msg = error->library_error_msg;
// Prevent double-free by nulling source pointers
error->application_error_msg = NULL;
error->library_error_msg = NULL;
error->application_error_code = 0;
error->library_error_code = 0;
}

/**
Expand Down