From b28b8b5de124828f6987f26fc824a0a989c4f5b7 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Tue, 22 Apr 2014 21:58:09 -0400 Subject: [PATCH] [libfko] fix double free bug in SPA parser This commit fixes a double free condition discovered through the new python SPA payload fuzzer. This bug could be triggered in fwknopd with a malicious SPA payload but only when GnuPG is used. When Rijndael is used for SPA packet encryption, this bug cannot be triggered due to an length/format check towards the end of _rijndael_decrypt(). It should be noted that only a person in possession of the correct encryption and authentication GnuPG keys could trigger this bug. --- lib/fko_decode.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/lib/fko_decode.c b/lib/fko_decode.c index 03d85969..778e1e35 100644 --- a/lib/fko_decode.c +++ b/lib/fko_decode.c @@ -455,20 +455,15 @@ static int parse_rand_val(char *tbuf, char **ndx, int *t_size, fko_ctx_t ctx) { if((*t_size = strcspn(*ndx, ":")) < FKO_RAND_VAL_SIZE) - { - free(tbuf); return(FKO_ERROR_INVALID_DATA_DECODE_RAND_MISSING); - } if(ctx->rand_val != NULL) free(ctx->rand_val); ctx->rand_val = calloc(1, FKO_RAND_VAL_SIZE+1); if(ctx->rand_val == NULL) - { - free(tbuf); return(FKO_ERROR_MEMORY_ALLOCATION); - } + ctx->rand_val = strncpy(ctx->rand_val, *ndx, FKO_RAND_VAL_SIZE); *ndx += *t_size + 1;