From 48bcfc3366aeec7e35e9686fed95d5670d94c09a Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 23 May 2022 09:36:27 +0200 Subject: [PATCH] zkey-kmip: Fix possible use after free MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Ingo Franzki Signed-off-by: Jan Höppner --- zkey/kmip/profiles.c | 13 ++++++++++--- zkey/kmip/zkey-kmip.c | 3 ++- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/zkey/kmip/profiles.c b/zkey/kmip/profiles.c index 9ed93acf..7afc9a36 100644 --- a/zkey/kmip/profiles.c +++ b/zkey/kmip/profiles.c @@ -161,6 +161,7 @@ int profile_read(struct plugin_handle *ph, const char *profile_dir, } } free(val); + val = NULL; val = properties_get(props, KMIP_PROFILES_TRANSPORT); if (val == NULL) @@ -178,7 +179,7 @@ int profile_read(struct plugin_handle *ph, const char *profile_dir, goto out; } free(val); - + val = NULL; val = properties_get(props, KMIP_PROFILES_ENCODING); if (val == NULL) @@ -212,6 +213,7 @@ int profile_read(struct plugin_handle *ph, const char *profile_dir, goto out; } free(val); + val = NULL; val = properties_get(props, KMIP_PROFILES_HTTPS_URI); switch (prof->transport) { @@ -245,6 +247,7 @@ int profile_read(struct plugin_handle *ph, const char *profile_dir, goto out; } free(val); + val = NULL; val = properties_get(props, KMIP_PROFILES_WRAP_KEY_ALGORITHM); if (val == NULL) @@ -260,6 +263,7 @@ int profile_read(struct plugin_handle *ph, const char *profile_dir, goto out; } free(val); + val = NULL; val = properties_get(props, KMIP_PROFILES_WRAP_KEY_PARAMS); if (prof->wrap_key_algo == KMIP_CRYPTO_ALGO_RSA) { @@ -284,6 +288,7 @@ int profile_read(struct plugin_handle *ph, const char *profile_dir, KMIP_PROFILES_WRAP_KEY_PARAMS, val); } free(val); + val = NULL; val = properties_get(props, KMIP_PROFILES_WRAP_KEY_FORMAT); switch (prof->wrap_key_algo) { @@ -316,6 +321,7 @@ int profile_read(struct plugin_handle *ph, const char *profile_dir, break; } free(val); + val = NULL; val = properties_get(props, KMIP_PROFILES_WRAP_PADDING_METHOD); switch (prof->wrap_key_algo) { @@ -345,6 +351,7 @@ int profile_read(struct plugin_handle *ph, const char *profile_dir, break; } free(val); + val = NULL; val = properties_get(props, KMIP_PROFILES_WRAP_HASHING_ALOGRITHM); switch (prof->wrap_padding_method) { @@ -374,6 +381,7 @@ int profile_read(struct plugin_handle *ph, const char *profile_dir, break; } free(val); + val = NULL; rc = profile_get_bool(ph, props, file_name, KMIP_PROFILES_SUPPORTS_LINK_ATTR, false, @@ -409,6 +417,7 @@ int profile_read(struct plugin_handle *ph, const char *profile_dir, goto out; } free(val); + val = NULL; rc = profile_get_bool(ph, props, file_name, KMIP_PROFILES_SUPPORTS_SENSITIVE_ATTR, false, @@ -422,8 +431,6 @@ int profile_read(struct plugin_handle *ph, const char *profile_dir, if (rc != 0) goto out; - val = NULL; - out: properties_free(props); if (file_name != NULL) diff --git a/zkey/kmip/zkey-kmip.c b/zkey/kmip/zkey-kmip.c index fd816107..5d071832 100644 --- a/zkey/kmip/zkey-kmip.c +++ b/zkey/kmip/zkey-kmip.c @@ -786,11 +786,12 @@ kms_handle_t kms_initialize(const char *config_path, bool verbose) apqn_type = properties_get(ph->pd.properties, KMIP_CONFIG_APQN_TYPE); if (apqn_type != NULL) { ph->card_type = _card_type_from_str(apqn_type); - free(apqn_type); if (ph->card_type == CARD_TYPE_ANY) { pr_verbose(&ph->pd, "APQN type invalid: %s", apqn_type); + free(apqn_type); goto error; } + free(apqn_type); } ph->identity_secure_key = properties_get(ph->pd.properties,