Fix potential double free through SRP_user_pwd_set1_ids()

If SRP_user_pwd_set1_ids() fails during one of the duplications, or id is NULL, then the old pointer values are still stored but they are now dangling. Later when SRP_user_pwd_free() is called these are freed again, leading to a double free. Although there are no such uses in OpenSSL as far as I found, it's still a public API. CLA: trivial Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from openssl#25655) (cherry picked from commit 792b2c8)
siemens · Oct 11, 2024 · 3f560b2 · 3f560b2
1 parent 24a0aa4
commit 3f560b2
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/crypto/srp/srp_vfy.c b/crypto/srp/srp_vfy.c
@@ -214,6 +214,8 @@ int SRP_user_pwd_set1_ids(SRP_user_pwd *vinfo, const char *id,
 {
     OPENSSL_free(vinfo->id);
     OPENSSL_free(vinfo->info);
+    vinfo->id = NULL;
+    vinfo->info = NULL;
     if (id != NULL && NULL == (vinfo->id = OPENSSL_strdup(id)))
         return 0;
     return (info == NULL || NULL != (vinfo->info = OPENSSL_strdup(info)));