ComodoSecurity / openedr

Open EDR public repository
Other
2.19k stars 434 forks source link

Bug: curl_lib func:Curl_pin_peer_pubkey() may cause a memory leak #26

Open coolc4 opened 2 years ago

coolc4 commented 2 years ago

edrav2/eprj/curl/lib/vtls/vtls.c:

CURLcode Curl_pin_peer_pubkey(struct Curl_easy data, const char pinnedpubkey, const unsigned char *pubkey, size_t pubkeylen) { ........

/* compute sha256sum of public key */
sha256sumdigest = malloc(CURL_SHA256_DIGEST_LENGTH);
if(!sha256sumdigest)
  return CURLE_OUT_OF_MEMORY;

//sha256sumdigest malloc ok

encode = Curl_ssl->sha256sum(pubkey, pubkeylen,
                    sha256sumdigest, CURL_SHA256_DIGEST_LENGTH);

if(encode != CURLE_OK)
  return encode;
**// here  maybe memleak**

encode = Curl_base64_encode(data, (char *)sha256sumdigest,
                            CURL_SHA256_DIGEST_LENGTH, &encoded,
                            &encodedlen);
Curl_safefree(sha256sumdigest);

if(encode)
  return encode;

.....

coolc4 commented 2 years ago

And I fixed the bug by th patch: curl_vtls_pubkey_memleak.txt