moparisthebest
/
curl
mirror of https://github.com/moparisthebest/curl
1
0
Fork 0
Code Issues Releases Wiki Activity

security:read_data fix bad realloc() 

... that could end up a double-free

CVE-2019-5481
Bug: https://curl.haxx.se/docs/CVE-2019-5481.html
This commit is contained in:
Daniel Stenberg 2019-09-03 22:59:32 +02:00
parent facb0e4662
commit 9069838b30
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/security.c
View File

@ -191,7 +191,6 @@ static CURLcode read_data(struct connectdata *conn,
struct krb5buffer *buf)
{
int len;
void *tmp = NULL;
CURLcode result;
result = socket_read(fd, &len, sizeof(len));
@ -201,12 +200,11 @@ static CURLcode read_data(struct connectdata *conn,
if(len) {
/* only realloc if there was a length */
len = ntohl(len);
tmp = Curl_saferealloc(buf->data, len);
buf->data = Curl_saferealloc(buf->data, len);
}
if(tmp == NULL)
if(!len || !buf->data)
return CURLE_OUT_OF_MEMORY;
buf->data = tmp;
result = socket_read(fd, buf->data, len);
if(result)
return result;