generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Avoid using a dangling pointer when removing the last item

Browse Source 
When it's the last item that is removed int_thread_hash == hash and we would
still call int_thread_release(&hash) while hash is already freed.  So
int_thread_release would compare that dangling pointer to NULL which is
undefined behaviour.  Instead do already what int_thread_release() would do,
and make the call do nothing instead.

Reviewed-by: Rich Salz <rsalz@openssl.org>

RT: #4155, MR: #1519
This commit is contained in:
Kurt Roeckx 2015-12-22 13:11:59 +01:00
parent c849c6d9d3
commit 933d108516
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
crypto/err/err.c
View File

@ -399,8 +399,10 @@ static void int_thread_del_item(const ERR_STATE *d)
if (int_thread_hash_references == 1
&& int_thread_hash
&& lh_ERR_STATE_num_items(int_thread_hash) == 0) {
int_thread_hash_references = 0;
lh_ERR_STATE_free(int_thread_hash);
int_thread_hash = NULL;
hash = NULL;
}
}
CRYPTO_w_unlock(CRYPTO_LOCK_ERR);