diff options
| author | Michael Vetter <jubalh@iodoru.org> | 2019-07-08 16:33:58 +0200 |
|---|---|---|
| committer | Michael Vetter <jubalh@iodoru.org> | 2019-07-08 16:36:05 +0200 |
| commit | 7af85d0fe0fdebb48928385e2afacbdac91bb420 (patch) | |
| tree | 7e51dbfe3d23ef6d94f93d9177e92a54c7accd47 /src | |
| parent | b3bb62dcbdac29ebe1669419a86da060d5be619b (diff) | |
| download | profani-tty-7af85d0fe0fdebb48928385e2afacbdac91bb420.tar.gz | |
Fix double free in omemo_start_device_session_handle_bundle()
omemo_key_free() was called to free the key. It free the key->data too. But in same cases this was not set yet. So we need to set the data to NULL (or use calloc) at initialization so that omemo_key_free() only frees it if it was actually allocated. Regards https://github.com/profanity-im/profanity/issues/1148
Diffstat (limited to 'src')
| -rw-r--r-- | src/xmpp/omemo.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/xmpp/omemo.c b/src/xmpp/omemo.c index e44cc00e..99f4785d 100644 --- a/src/xmpp/omemo.c +++ b/src/xmpp/omemo.c @@ -165,6 +165,7 @@ omemo_start_device_session_handle_bundle(xmpp_stanza_t *const stanza, void *cons xmpp_stanza_t *prekey; for (prekey = xmpp_stanza_get_children(prekeys); prekey != NULL; prekey = xmpp_stanza_get_next(prekey)) { omemo_key_t *key = malloc(sizeof(omemo_key_t)); + key->data = NULL; const char *prekey_id_text = xmpp_stanza_get_attribute(prekey, "preKeyId"); if (!prekey_id_text) { |