Skip to content

Commit c354501

Browse files
popovecJakuje
authored andcommitted
Fix Heap-use-after-free in iasecc_delete_file
Patch 773fcc6 unfortunately introduced a new bug. Here is a fix for both the old and the new bug. Thanks oss-fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65562 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65684
1 parent 773fcc6 commit c354501

File tree

1 file changed

+3
-6
lines changed

1 file changed

+3
-6
lines changed

src/libopensc/card-iasecc.c

+3-6
Original file line numberDiff line numberDiff line change
@@ -1544,7 +1544,6 @@ iasecc_delete_file(struct sc_card *card, const struct sc_path *path)
15441544
struct sc_apdu apdu;
15451545
struct sc_file *file = NULL;
15461546
int rv;
1547-
unsigned int file_id;
15481547

15491548
LOG_FUNC_CALLED(ctx);
15501549
sc_print_cache(card);
@@ -1555,19 +1554,17 @@ iasecc_delete_file(struct sc_card *card, const struct sc_path *path)
15551554
LOG_TEST_RET(ctx, rv, "Cannot select file to delete");
15561555

15571556
entry = sc_file_get_acl_entry(file, SC_AC_OP_DELETE);
1558-
1559-
file_id = file->id;
1560-
sc_file_free(file);
1561-
15621557
if (!entry)
15631558
LOG_TEST_RET(ctx, SC_ERROR_OBJECT_NOT_FOUND, "Cannot delete file: no 'DELETE' acl");
15641559

15651560
sc_log(ctx, "DELETE method/reference %X/%X", entry->method, entry->key_ref);
15661561
if (entry->method == SC_AC_SCB && (entry->key_ref & IASECC_SCB_METHOD_SM)) {
15671562
unsigned char se_num = entry->key_ref & IASECC_SCB_METHOD_MASK_REF;
1568-
rv = iasecc_sm_delete_file(card, se_num, file_id);
1563+
rv = iasecc_sm_delete_file(card, se_num, file->id);
1564+
sc_file_free(file);
15691565
}
15701566
else {
1567+
sc_file_free(file);
15711568
sc_format_apdu(card, &apdu, SC_APDU_CASE_1, 0xE4, 0x00, 0x00);
15721569

15731570
rv = sc_transmit_apdu(card, &apdu);

0 commit comments

Comments
 (0)