denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libtls: Fix double-free for untrusted peer certificates

Browse Source 
`public` is returned, but previously only if a trusted key was found.
We obviously don't want to return untrusted keys and since the reference
was correctly destroyed after determining the key type, this later caused
a double-free.

Fixes: 63fd718915 ("libtls: call create_public_enumerator() with key_type")
This commit is contained in:
Tobias Brunner
2023-02-17 15:11:43 +01:00
parent 0de42047a9
commit 4d3fc90caf
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_server.c
+4 -4
View File
@@ -183,11 +183,11 @@ public_key_t *tls_find_public_key(auth_cfg_t *peer_auth, identification_t *id)
cert = peer_auth->get(peer_auth, AUTH_HELPER_SUBJECT_CERT); cert = peer_auth->get(peer_auth, AUTH_HELPER_SUBJECT_CERT);
if (cert) if (cert)
{ {
public = cert->get_public_key(cert); current = cert->get_public_key(cert);
if (public) if (current)
{ {
key_type = public->get_type(public); key_type = current->get_type(current);
public->destroy(public); current->destroy(current);
} }
enumerator = lib->credmgr->create_public_enumerator(lib->credmgr, enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
key_type, id, peer_auth, TRUE); key_type, id, peer_auth, TRUE);