fix memory corruption caused by use-after-free
authorDaniel Golle <daniel@makrotopia.org>
Thu, 7 Jun 2018 23:15:26 +0000 (01:15 +0200)
committerDaniel Golle <daniel@makrotopia.org>
Thu, 14 Jun 2018 16:51:22 +0000 (18:51 +0200)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This work was sponsored by WIO (wiowireless.com)

ucert.c

diff --git a/ucert.c b/ucert.c
index 7e419d4..49d39e9 100644 (file)
--- a/ucert.c
+++ b/ucert.c
@@ -156,8 +156,15 @@ static int cert_load(const char *certfile, struct list_head *chain) {
                else
                        pos += blob_pad_len(bufpt);
 
+               if (!certtb[CERT_ATTR_SIGNATURE])
+                       /* no signature -> drop */
+                       break;
+
                cobj = calloc(1, sizeof(*cobj));
-               memcpy(cobj->cert, &certtb, sizeof(certtb));
+               cobj->cert[CERT_ATTR_SIGNATURE] = blob_memdup(certtb[CERT_ATTR_SIGNATURE]);
+               if (certtb[CERT_ATTR_PAYLOAD])
+                       cobj->cert[CERT_ATTR_PAYLOAD] = blob_memdup(certtb[CERT_ATTR_PAYLOAD]);
+
                list_add_tail(&cobj->list, chain);
                ret += pret;
                bufpt = blob_next(bufpt);