generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Function pop_info() returned a dangling pointer

Browse Source 
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Pascal Cuoq 2016-01-10 13:43:37 +01:00 committed by Kurt Roeckx
parent abf81f1f2e
commit 96e25c499b
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
crypto/mem_dbg.c
View File

@ -331,29 +331,31 @@ static unsigned long app_info_hash(const APP_INFO *a)
return (ret); return (ret);
} }
static APP_INFO *pop_info(void) /* returns 1 if there was an info to pop, 0 if the stack was empty. */
static int pop_info(void)
{ {
APP_INFO tmp; APP_INFO tmp;
APP_INFO *ret = NULL; APP_INFO *current = NULL;
if (amih != NULL) { if (amih != NULL) {
CRYPTO_THREADID_current(&tmp.threadid); CRYPTO_THREADID_current(&tmp.threadid);
if ((ret = lh_APP_INFO_delete(amih, &tmp)) != NULL) { if ((current = lh_APP_INFO_delete(amih, &tmp)) != NULL) {
APP_INFO *next = ret->next; APP_INFO *next = current->next;
if (next != NULL) { if (next != NULL) {
next->references++; next->references++;
(void)lh_APP_INFO_insert(amih, next); (void)lh_APP_INFO_insert(amih, next);
} }
if (--(ret->references) <= 0) { if (--(current->references) <= 0) {
ret->next = NULL; current->next = NULL;
if (next != NULL) if (next != NULL)
next->references--; next->references--;
OPENSSL_free(ret); OPENSSL_free(current);
}
return 1;
} }
} }
} return 0;
return (ret);
} }
int CRYPTO_mem_debug_push(const char *info, const char *file, int line) int CRYPTO_mem_debug_push(const char *info, const char *file, int line)
@ -396,7 +398,7 @@ int CRYPTO_mem_debug_pop(void)
if (mem_check_on()) { if (mem_check_on()) {
CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE); CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE);
ret = (pop_info() != NULL); ret = pop_info();
CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE); CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE);
} }
return (ret); return (ret);