From ade0d9c658fdfc68d8046935f6908f033fe7a529 Mon Sep 17 00:00:00 2001 From: Patrick Steinhardt Date: Mon, 13 Feb 2017 13:46:17 +0100 Subject: commit: avoid possible use-after-free When extracting a commit's signature, we first free the object and only afterwards put its signature contents into the result buffer. This works in most cases - the free'd object will normally be cached anyway, so we only end up decrementing its reference count without actually freeing its contents. But in some more exotic setups, where caching is disabled, this can definitly be a problem, as we might be the only instance currently holding a reference to this object. Fix this issue by first extracting the contents and freeing the object afterwards only. --- src/commit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/commit.c') diff --git a/src/commit.c b/src/commit.c index 89a4db115..05b70a983 100644 --- a/src/commit.c +++ b/src/commit.c @@ -766,8 +766,9 @@ int git_commit_extract_signature(git_buf *signature, git_buf *signed_data, git_r if (git_buf_oom(signature)) goto oom; + error = git_buf_puts(signed_data, eol+1); git_odb_object_free(obj); - return git_buf_puts(signed_data, eol+1); + return error; } giterr_set(GITERR_OBJECT, "this commit is not signed"); -- cgit v1.2.1