mirror of
https://github.com/openssl/openssl.git
synced 2024-11-30 21:44:16 +08:00
db78c84eb2
In function int_ts_RESP_verify_token, if (flags & TS_VFY_DATA) is true, function ts_compute_imprint() will be called at line 299. In the implementation of ts_compute_imprint, it allocates md_alg at line 406. But after the allocation, if the execution goto err, then md_alg will be freed in the first time by X509_ALGOR_free at line 439. After that, ts_compute_imprint returns 0 and the execution goto err branch of int_ts_RESP_verify_token. In the err branch, md_alg will be freed in the second time at line 320. Bug reported by @Yunlongs Fixes #14914 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14921) |
||
|---|---|---|
| .. | ||
| build.info | ||
| ts_asn1.c | ||
| ts_conf.c | ||
| ts_err.c | ||
| ts_lib.c | ||
| ts_local.h | ||
| ts_req_print.c | ||
| ts_req_utils.c | ||
| ts_rsp_print.c | ||
| ts_rsp_sign.c | ||
| ts_rsp_utils.c | ||
| ts_rsp_verify.c | ||
| ts_verify_ctx.c | ||