crypt32: Avoid double free in CRYPT_LoadSIP on error path (coverity))
Frédéric Delanoy
frederic.delanoy at gmail.com
Mon Oct 29 03:33:19 CDT 2012
FreeLibrary(temp) can be called twice on error.
CID 714004
---
dlls/crypt32/sip.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/dlls/crypt32/sip.c b/dlls/crypt32/sip.c
index e43ebc7..fa384be 100644
--- a/dlls/crypt32/sip.c
+++ b/dlls/crypt32/sip.c
@@ -634,14 +634,17 @@ static BOOL CRYPT_LoadSIP(const GUID *pgSubject)
if (!sip.pfPut || temp != lib)
goto error;
FreeLibrary(temp);
+ temp = NULL;
sip.pfCreate = CRYPT_LoadSIPFunc(pgSubject, szCreate, &temp);
if (!sip.pfCreate || temp != lib)
goto error;
FreeLibrary(temp);
+ temp = NULL;
sip.pfVerify = CRYPT_LoadSIPFunc(pgSubject, szVerify, &temp);
if (!sip.pfVerify || temp != lib)
goto error;
FreeLibrary(temp);
+ temp = NULL;
sip.pfRemove = CRYPT_LoadSIPFunc(pgSubject, szRemoveSigned, &temp);
if (!sip.pfRemove || temp != lib)
goto error;
@@ -652,7 +655,7 @@ static BOOL CRYPT_LoadSIP(const GUID *pgSubject)
error:
FreeLibrary(lib);
- FreeLibrary(temp);
+ if (temp != NULL) FreeLibrary(temp);
SetLastError(TRUST_E_SUBJECT_FORM_UNKNOWN);
return FALSE;
}
--
1.8.0
More information about the wine-patches
mailing list