Remove all uses of gnutls_alloca/gnutls_afree.

Use normal gnutls_malloc instead.  One reason is increased portability
to Windows, the other is that several of the uses may be unsafe
because the size of data allocated could be large.  Reported by
Massimo Gaspari <massimo.gaspari@alice.it> in
<http://permalink.gmane.org/gmane.network.gnutls.general/1170>.

13 files changed, 70 insertions, 87 deletions

diff --git a/NEWS b/NEWS
index 7d18c33d7b..2ac7f826dd 100644
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,13 @@ Based on HPUX build hints in
 Reported by Massimo Gaspari <massimo.gaspari@alice.it> in
 <http://permalink.gmane.org/gmane.network.gnutls.general/1170>.
 
+** Remove all uses of gnutls_alloca/gnutls_afree.
+Use normal gnutls_malloc instead.  One reason is increased portability
+to Windows, the other is that several of the uses may be unsafe
+because the size of data allocated could be large.  Reported by
+Massimo Gaspari <massimo.gaspari@alice.it> in
+<http://permalink.gmane.org/gmane.network.gnutls.general/1170>.
+
 ** API and ABI modifications:
 No changes since last version.
 
diff --git a/lib/gnutls_algorithms.c b/lib/gnutls_algorithms.c
index dc32003016..36dd77da12 100644
--- a/lib/gnutls_algorithms.c
+++ b/lib/gnutls_algorithms.c
@@ -1701,14 +1701,14 @@ _gnutls_supported_ciphersuites (gnutls_session_t session,
       return 0;
     }
 
-  tmp_ciphers = gnutls_alloca (count * sizeof (cipher_suite_st));
+  tmp_ciphers = gnutls_malloc (count * sizeof (cipher_suite_st));
   if (tmp_ciphers == NULL)
     return GNUTLS_E_MEMORY_ERROR;
 
   ciphers = gnutls_malloc (count * sizeof (cipher_suite_st));
   if (ciphers == NULL)
     {
-      gnutls_afree (tmp_ciphers);
+      gnutls_free (tmp_ciphers);
       return GNUTLS_E_MEMORY_ERROR;
     }
 
@@ -1767,7 +1767,7 @@ _gnutls_supported_ciphersuites (gnutls_session_t session,
     }
 #endif
 
-  gnutls_afree (tmp_ciphers);
+  gnutls_free (tmp_ciphers);
 
   /* This function can no longer return 0 cipher suites.
    * It returns an error code instead.
diff --git a/lib/gnutls_buffers.c b/lib/gnutls_buffers.c
index 689779b422..2caf266599 100644
--- a/lib/gnutls_buffers.c
+++ b/lib/gnutls_buffers.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation
  *
  * Author: Nikos Mavrogiannopoulos
  *
@@ -430,7 +430,7 @@ _gnutls_io_clear_peeked_data (gnutls_session_t session)
   if (session->internals.have_peeked_data == 0 || RCVLOWAT == 0)
     return 0;
 
-  peekdata = gnutls_alloca (RCVLOWAT);
+  peekdata = gnutls_malloc (RCVLOWAT);
   if (peekdata == NULL)
     {
       gnutls_assert ();
@@ -448,7 +448,7 @@ _gnutls_io_clear_peeked_data (gnutls_session_t session)
   while (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN
 	 || sum < RCVLOWAT);
 
-  gnutls_afree (peekdata);
+  gnutls_free (peekdata);
 
   if (ret < 0)
     {
diff --git a/lib/gnutls_constate.c b/lib/gnutls_constate.c
index cbe7a15e74..b929483ae2 100644
--- a/lib/gnutls_constate.c
+++ b/lib/gnutls_constate.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006  Free Software Foundation
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006, 2008  Free Software Foundation
  *
  * Author: Nikos Mavrogiannopoulos
  *
@@ -315,7 +315,7 @@ _gnutls_set_keys (gnutls_session_t session, int hash_size, int IV_size,
     }
   else if (IV_size > 0 && export_flag != 0)
     {
-      opaque *iv_block = gnutls_alloca (IV_size * 2);
+      opaque *iv_block = gnutls_malloc (IV_size * 2);
       if (iv_block == NULL)
 	{
 	  gnutls_assert ();
@@ -333,7 +333,7 @@ _gnutls_set_keys (gnutls_session_t session, int hash_size, int IV_size,
 	    {
 	      gnutls_assert ();
 	      gnutls_free (key_block);
-	      gnutls_afree (iv_block);
+	      gnutls_free (iv_block);
 	      return ret;
 	    }
 
@@ -352,7 +352,7 @@ _gnutls_set_keys (gnutls_session_t session, int hash_size, int IV_size,
       if (ret < 0)
 	{
 	  gnutls_assert ();
-	  gnutls_afree (iv_block);
+	  gnutls_free (iv_block);
 	  gnutls_free (key_block);
 	  return ret;
 	}
@@ -360,7 +360,7 @@ _gnutls_set_keys (gnutls_session_t session, int hash_size, int IV_size,
       if (_gnutls_sset_datum
 	  (&session->cipher_specs.client_write_IV, iv_block, IV_size) < 0)
 	{
-	  gnutls_afree (iv_block);
+	  gnutls_free (iv_block);
 	  gnutls_free (key_block);
 	  return GNUTLS_E_MEMORY_ERROR;
 	}
@@ -369,12 +369,12 @@ _gnutls_set_keys (gnutls_session_t session, int hash_size, int IV_size,
 	  (&session->cipher_specs.server_write_IV,
 	   &iv_block[IV_size], IV_size) < 0)
 	{
-	  gnutls_afree (iv_block);
+	  gnutls_free (iv_block);
 	  gnutls_free (key_block);
 	  return GNUTLS_E_MEMORY_ERROR;
 	}
 
-      gnutls_afree (iv_block);
+      gnutls_free (iv_block);
     }
 
   gnutls_free (key_block);
diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 100900d413..98aa86cb8f 100644
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -933,7 +933,7 @@ _gnutls_send_handshake (gnutls_session_t session, void *i_data,
 
   /* first run */
   datasize = i_datasize + HANDSHAKE_HEADER_SIZE;
-  data = gnutls_alloca (datasize);
+  data = gnutls_malloc (datasize);
   if (data == NULL)
     {
       gnutls_assert ();
@@ -958,7 +958,7 @@ _gnutls_send_handshake (gnutls_session_t session, void *i_data,
 	 _gnutls_handshake_hash_add_sent (session, type, data, datasize)) < 0)
       {
 	gnutls_assert ();
-	gnutls_afree (data);
+	gnutls_free (data);
 	return ret;
       }
 
@@ -968,7 +968,7 @@ _gnutls_send_handshake (gnutls_session_t session, void *i_data,
     _gnutls_handshake_io_send_int (session, GNUTLS_HANDSHAKE, type,
 				   data, datasize);
 
-  gnutls_afree (data);
+  gnutls_free (data);
 
   return ret;
 }
@@ -1918,7 +1918,7 @@ _gnutls_send_server_hello (gnutls_session_t session, int again)
 	  return extdatalen;
 	}
 
-      data = gnutls_alloca (datalen + extdatalen);
+      data = gnutls_malloc (datalen + extdatalen);
       if (data == NULL)
 	{
 	  gnutls_assert ();
@@ -1966,7 +1966,7 @@ _gnutls_send_server_hello (gnutls_session_t session, int again)
   ret =
     _gnutls_send_handshake (session, data, datalen,
 			    GNUTLS_HANDSHAKE_SERVER_HELLO);
-  gnutls_afree (data);
+  gnutls_free (data);
 
   return ret;
 }
diff --git a/lib/gnutls_mem.h b/lib/gnutls_mem.h
index f76081e566..9af8543f3c 100644
--- a/lib/gnutls_mem.h
+++ b/lib/gnutls_mem.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2008 Free Software Foundation
  *
  * Author: Nikos Mavrogiannopoulos
  *
@@ -31,30 +31,6 @@
 
 typedef void svoid;		/* for functions that allocate using gnutls_secure_malloc */
 
-/* Use gnutls_afree() when calling alloca, or
- * memory leaks may occur in systems which do not
- * support alloca.
- */
-#ifdef USE_EFENCE
-# define gnutls_alloca gnutls_malloc
-# define gnutls_afree gnutls_free
-#endif
-
-#ifdef HAVE_ALLOCA
-# ifdef HAVE_ALLOCA_H
-#  include <alloca.h>
-# endif
-# ifndef gnutls_alloca
-#  define gnutls_alloca alloca
-#  define gnutls_afree(x)
-# endif
-#else
-# ifndef gnutls_alloca
-#  define gnutls_alloca gnutls_malloc
-#  define gnutls_afree gnutls_free
-# endif
-#endif /* HAVE_ALLOCA */
-
 extern int (*_gnutls_is_secure_memory) (const void *);
 
 /* this realloc function will return ptr if size==0, and
diff --git a/lib/gnutls_mpi.c b/lib/gnutls_mpi.c
index 0d807a1864..eec2c1be78 100644
--- a/lib/gnutls_mpi.c
+++ b/lib/gnutls_mpi.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2008 Free Software Foundation
  *
  * Author: Nikos Mavrogiannopoulos
  *
@@ -209,7 +209,7 @@ _gnutls_x509_read_int (ASN1_TYPE node, const char *value, mpi_t * ret_mpi)
       return _gnutls_asn2err (result);
     }
 
-  tmpstr = gnutls_alloca (tmpstr_size);
+  tmpstr = gnutls_malloc (tmpstr_size);
   if (tmpstr == NULL)
     {
       gnutls_assert ();
@@ -220,7 +220,7 @@ _gnutls_x509_read_int (ASN1_TYPE node, const char *value, mpi_t * ret_mpi)
   if (result != ASN1_SUCCESS)
     {
       gnutls_assert ();
-      gnutls_afree (tmpstr);
+      gnutls_free (tmpstr);
       return _gnutls_asn2err (result);
     }
 
@@ -228,11 +228,11 @@ _gnutls_x509_read_int (ASN1_TYPE node, const char *value, mpi_t * ret_mpi)
   if (_gnutls_mpi_scan (ret_mpi, tmpstr, &s_len) != 0)
     {
       gnutls_assert ();
-      gnutls_afree (tmpstr);
+      gnutls_free (tmpstr);
       return GNUTLS_E_MPI_SCAN_FAILED;
     }
 
-  gnutls_afree (tmpstr);
+  gnutls_free (tmpstr);
 
   return 0;
 }
@@ -252,7 +252,7 @@ _gnutls_x509_write_int (ASN1_TYPE node, const char *value, mpi_t mpi, int lz)
   else
     result = _gnutls_mpi_print (NULL, &s_len, mpi);
 
-  tmpstr = gnutls_alloca (s_len);
+  tmpstr = gnutls_malloc (s_len);
   if (tmpstr == NULL)
     {
       gnutls_assert ();
@@ -267,13 +267,13 @@ _gnutls_x509_write_int (ASN1_TYPE node, const char *value, mpi_t mpi, int lz)
   if (result != 0)
     {
       gnutls_assert ();
-      gnutls_afree (tmpstr);
+      gnutls_free (tmpstr);
       return GNUTLS_E_MPI_PRINT_FAILED;
     }
 
   result = asn1_write_value (node, value, tmpstr, s_len);
 
-  gnutls_afree (tmpstr);
+  gnutls_free (tmpstr);
 
   if (result != ASN1_SUCCESS)
     {
diff --git a/lib/gnutls_pk.c b/lib/gnutls_pk.c
index f9f4d4d499..5e31804419 100644
--- a/lib/gnutls_pk.c
+++ b/lib/gnutls_pk.c
@@ -75,7 +75,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
       return GNUTLS_E_PK_ENCRYPTION_FAILED;
     }
 
-  edata = gnutls_alloca (k);
+  edata = gnutls_malloc (k);
   if (edata == NULL)
     {
       gnutls_assert ();
@@ -98,7 +98,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
       if (params_len < RSA_PUBLIC_PARAMS)
 	{
 	  gnutls_assert ();
-	  gnutls_afree (edata);
+	  gnutls_free (edata);
 	  return GNUTLS_E_INTERNAL_ERROR;
 	}
 
@@ -106,7 +106,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
       if ( ret < 0)
 	{
 	  gnutls_assert ();
-	  gnutls_afree (edata);
+	  gnutls_free (edata);
 	  return ret;
 	}
       for (i = 0; i < psize; i++)
@@ -116,7 +116,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
 	    if (ret < 0)
 	      {
 		gnutls_assert ();
-		gnutls_afree (edata);
+		gnutls_free (edata);
 		return ret;
 	      }
 	  }
@@ -127,7 +127,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
       if (params_len < RSA_PRIVATE_PARAMS)
 	{
 	  gnutls_assert ();
-	  gnutls_afree (edata);
+	  gnutls_free (edata);
 	  return GNUTLS_E_INTERNAL_ERROR;
 	}
 
@@ -136,7 +136,7 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
       break;
     default:
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       return GNUTLS_E_INTERNAL_ERROR;
     }
 
@@ -146,10 +146,10 @@ _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
   if (_gnutls_mpi_scan_nz (&m, edata, &k) != 0)
     {
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       return GNUTLS_E_MPI_SCAN_FAILED;
     }
-  gnutls_afree (edata);
+  gnutls_free (edata);
 
   if (btype == 2)		/* encrypt */
     ret = _gnutls_pk_encrypt (GCRY_PK_RSA, &res, m, params, params_len);
@@ -256,7 +256,7 @@ _gnutls_pkcs1_rsa_decrypt (gnutls_datum_t * plaintext,
     }
 
   _gnutls_mpi_print (NULL, &esize, res);
-  edata = gnutls_alloca (esize + 1);
+  edata = gnutls_malloc (esize + 1);
   if (edata == NULL)
     {
       gnutls_assert ();
@@ -283,7 +283,7 @@ _gnutls_pkcs1_rsa_decrypt (gnutls_datum_t * plaintext,
   if (edata[0] != 0 || edata[1] != btype)
     {
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       return GNUTLS_E_DECRYPTION_FAILED;
     }
 
@@ -319,7 +319,7 @@ _gnutls_pkcs1_rsa_decrypt (gnutls_datum_t * plaintext,
       break;
     default:
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       break;
     }
   i++;
@@ -327,18 +327,18 @@ _gnutls_pkcs1_rsa_decrypt (gnutls_datum_t * plaintext,
   if (ret < 0)
     {
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       return GNUTLS_E_DECRYPTION_FAILED;
     }
 
   if (_gnutls_sset_datum (plaintext, &edata[i], esize - i) < 0)
     {
       gnutls_assert ();
-      gnutls_afree (edata);
+      gnutls_free (edata);
       return GNUTLS_E_MEMORY_ERROR;
     }
 
-  gnutls_afree (edata);
+  gnutls_free (edata);
 
   return 0;
 }
diff --git a/lib/x509/crl.c b/lib/x509/crl.c
index 4beea257ad..5f130c1ec0 100644
--- a/lib/x509/crl.c
+++ b/lib/x509/crl.c
@@ -669,7 +669,7 @@ _gnutls_x509_crl_cpy (gnutls_x509_crl_t dest, gnutls_x509_crl_t src)
       return ret;
     }
 
-  der = gnutls_alloca (der_size);
+  der = gnutls_malloc (der_size);
   if (der == NULL)
     {
       gnutls_assert ();
@@ -680,7 +680,7 @@ _gnutls_x509_crl_cpy (gnutls_x509_crl_t dest, gnutls_x509_crl_t src)
   if (ret < 0)
     {
       gnutls_assert ();
-      gnutls_afree (der);
+      gnutls_free (der);
       return ret;
     }
 
@@ -688,7 +688,7 @@ _gnutls_x509_crl_cpy (gnutls_x509_crl_t dest, gnutls_x509_crl_t src)
   tmp.size = der_size;
   ret = gnutls_x509_crl_import (dest, &tmp, GNUTLS_X509_FMT_DER);
 
-  gnutls_afree (der);
+  gnutls_free (der);
 
   if (ret < 0)
     {
diff --git a/lib/x509/mpi.c b/lib/x509/mpi.c
index 74334aa1e8..247ea543c1 100644
--- a/lib/x509/mpi.c
+++ b/lib/x509/mpi.c
@@ -588,7 +588,7 @@ _gnutls_x509_read_uint (ASN1_TYPE node, const char *value, unsigned int *ret)
       return _gnutls_asn2err (result);
     }
 
-  tmpstr = gnutls_alloca (len);
+  tmpstr = gnutls_malloc (len);
   if (tmpstr == NULL)
     {
       gnutls_assert ();
@@ -600,7 +600,7 @@ _gnutls_x509_read_uint (ASN1_TYPE node, const char *value, unsigned int *ret)
   if (result != ASN1_SUCCESS)
     {
       gnutls_assert ();
-      gnutls_afree (tmpstr);
+      gnutls_free (tmpstr);
       return _gnutls_asn2err (result);
     }
 
@@ -615,11 +615,11 @@ _gnutls_x509_read_uint (ASN1_TYPE node, const char *value, unsigned int *ret)
   else
     {
       gnutls_assert ();
-      gnutls_afree (tmpstr);
+      gnutls_free (tmpstr);
       return GNUTLS_E_INTERNAL_ERROR;
     }
 
-  gnutls_afree (tmpstr);
+  gnutls_free (tmpstr);
 
   return 0;
 }
diff --git a/lib/x509/privkey_pkcs8.c b/lib/x509/privkey_pkcs8.c
index ec5e7ea336..0f5989d47a 100644
--- a/lib/x509/privkey_pkcs8.c
+++ b/lib/x509/privkey_pkcs8.c
@@ -1477,7 +1477,7 @@ decrypt_data (schema_id schema, ASN1_TYPE pkcs8_asn,
   else
     key_size = kdf_params->key_size;
 
-  key = gnutls_alloca (key_size);
+  key = gnutls_malloc (key_size);
   if (key == NULL)
     {
       gnutls_assert ();
@@ -1524,7 +1524,7 @@ decrypt_data (schema_id schema, ASN1_TYPE pkcs8_asn,
   d_iv.size = enc_params->iv_size;
   result = _gnutls_cipher_init (&ch, enc_params->cipher, &dkey, &d_iv);
 
-  gnutls_afree (key);
+  gnutls_free (key);
   key = NULL;
 
   if (result < 0)
@@ -1555,7 +1555,7 @@ decrypt_data (schema_id schema, ASN1_TYPE pkcs8_asn,
 
 error:
   gnutls_free (data);
-  gnutls_afree (key);
+  gnutls_free (key);
   if (ch_init != 0)
     _gnutls_cipher_deinit (&ch);
   return result;
diff --git a/lib/x509/sign.c b/lib/x509/sign.c
index ff87573614..0337ffdb2b 100644
--- a/lib/x509/sign.c
+++ b/lib/x509/sign.c
@@ -268,7 +268,7 @@ _gnutls_x509_sign_tbs (ASN1_TYPE cert, const char *tbs_name,
   buf_size = 0;
   asn1_der_coding (cert, tbs_name, NULL, &buf_size, NULL);
 
-  buf = gnutls_alloca (buf_size);
+  buf = gnutls_malloc (buf_size);
   if (buf == NULL)
     {
       gnutls_assert ();
@@ -280,7 +280,7 @@ _gnutls_x509_sign_tbs (ASN1_TYPE cert, const char *tbs_name,
   if (result != ASN1_SUCCESS)
     {
       gnutls_assert ();
-      gnutls_afree (buf);
+      gnutls_free (buf);
       return _gnutls_asn2err (result);
     }
 
@@ -288,7 +288,7 @@ _gnutls_x509_sign_tbs (ASN1_TYPE cert, const char *tbs_name,
   tbs.size = buf_size;
 
   result = _gnutls_x509_sign (&tbs, hash, signer, signature);
-  gnutls_afree (buf);
+  gnutls_free (buf);
 
   return result;
 }
diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index 6b79560d27..572dd667c0 100644
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -92,7 +92,7 @@ _gnutls_x509_crt_cpy (gnutls_x509_crt_t dest, gnutls_x509_crt_t src)
       return ret;
     }
 
-  der = gnutls_alloca (der_size);
+  der = gnutls_malloc (der_size);
   if (der == NULL)
     {
       gnutls_assert ();
@@ -103,7 +103,7 @@ _gnutls_x509_crt_cpy (gnutls_x509_crt_t dest, gnutls_x509_crt_t src)
   if (ret < 0)
     {
       gnutls_assert ();
-      gnutls_afree (der);
+      gnutls_free (der);
       return ret;
     }
 
@@ -111,7 +111,7 @@ _gnutls_x509_crt_cpy (gnutls_x509_crt_t dest, gnutls_x509_crt_t src)
   tmp.size = der_size;
   ret = gnutls_x509_crt_import (dest, &tmp, GNUTLS_X509_FMT_DER);
 
-  gnutls_afree (der);
+  gnutls_free (der);
 
   if (ret < 0)
     {
@@ -1962,7 +1962,7 @@ gnutls_x509_crt_get_fingerprint (gnutls_x509_crt_t cert,
   cert_buf_size = 0;
   asn1_der_coding (cert->cert, "", NULL, &cert_buf_size, NULL);
 
-  cert_buf = gnutls_alloca (cert_buf_size);
+  cert_buf = gnutls_malloc (cert_buf_size);
   if (cert_buf == NULL)
     {
       gnutls_assert ();
@@ -1974,7 +1974,7 @@ gnutls_x509_crt_get_fingerprint (gnutls_x509_crt_t cert,
   if (result != ASN1_SUCCESS)
     {
       gnutls_assert ();
-      gnutls_afree (cert_buf);
+      gnutls_free (cert_buf);
       return _gnutls_asn2err (result);
     }
 
@@ -1982,7 +1982,7 @@ gnutls_x509_crt_get_fingerprint (gnutls_x509_crt_t cert,
   tmp.size = cert_buf_size;
 
   result = gnutls_fingerprint (algo, &tmp, buf, sizeof_buf);
-  gnutls_afree (cert_buf);
+  gnutls_free (cert_buf);
 
   return result;
 }
@@ -2157,7 +2157,7 @@ gnutls_x509_crt_get_key_id (gnutls_x509_crt_t crt, unsigned int flags,
       return _gnutls_asn2err (result);
     }
 
-  pubkey.data = gnutls_alloca (pubkey.size);
+  pubkey.data = gnutls_malloc (pubkey.size);
   if (pubkey.data == NULL)
     {
       gnutls_assert ();
@@ -2169,14 +2169,14 @@ gnutls_x509_crt_get_key_id (gnutls_x509_crt_t crt, unsigned int flags,
   if (result != ASN1_SUCCESS)
     {
       gnutls_assert ();
-      gnutls_afree (pubkey.data);
+      gnutls_free (pubkey.data);
       return _gnutls_asn2err (result);
     }
 
   result = gnutls_fingerprint (GNUTLS_DIG_SHA1, &pubkey,
 			       output_data, output_data_size);
 
-  gnutls_afree (pubkey.data);
+  gnutls_free (pubkey.data);
 
   return result;
 }