moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-12-21 23:58:49 -05:00
Code Issues Releases Wiki Activity

krb5: avoid realloc(0)

Browse Source 
If the requested size is zero, bail out with error instead of doing a
realloc() that would cause a double-free: realloc(0) acts as a free()
and then there's a second free in the cleanup path.

CVE-2016-8619

Bug: https://curl.haxx.se/docs/adv_20161102E.html
Reported-by: Cure53
This commit is contained in:
Daniel Stenberg 2016-09-28 12:56:02 +02:00
parent 8732ec40db
commit 3d6460edee
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
lib/security.c
View File

@ -192,15 +192,18 @@ static CURLcode read_data(struct connectdata *conn,
struct krb5buffer *buf) struct krb5buffer *buf)
{ {
int len; int len;
void* tmp; void *tmp = NULL;
CURLcode result; CURLcode result;
result = socket_read(fd, &len, sizeof(len)); result = socket_read(fd, &len, sizeof(len));
if(result) if(result)
return result; return result;
len = ntohl(len); if(len) {
tmp = realloc(buf->data, len); /* only realloc if there was a length */
len = ntohl(len);
tmp = realloc(buf->data, len);
}
if(tmp == NULL) if(tmp == NULL)
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;