moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-12-23 16:48:49 -05:00
Code Issues Releases Wiki Activity

ngtcp2+gnutls: clear credentials when freed

Browse Source 
... to avoid double-free.

Reported-by: Kenneth Davidson
Fixes #6824
Closes #6856
This commit is contained in:
Daniel Stenberg 2021-04-06 17:24:31 +02:00
parent 4b4401e26a
commit 33ddef3617
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/vquic/ngtcp2.c
View File

@ -873,8 +873,10 @@ static void qs_disconnect(struct quicsocket *qs)
#endif #endif
qs->ssl = NULL; qs->ssl = NULL;
#ifdef USE_GNUTLS #ifdef USE_GNUTLS
if(qs->cred) if(qs->cred) {
gnutls_certificate_free_credentials(qs->cred); gnutls_certificate_free_credentials(qs->cred);
qs->cred = NULL;
}
#endif #endif
for(i = 0; i < 3; i++) for(i = 0; i < 3; i++)
Curl_safefree(qs->crypto_data[i].buf); Curl_safefree(qs->crypto_data[i].buf);