Changeset 286 for trunk/lib/winsec.c

Timestamp:

08/23/15 00:09:08 (9 years ago)

Author:

tim

Message:

Fixed a NULL pointer dereference and one dangling pointer, triggered by corrupt security descriptors.
Thanks AFL!

File:

• trunk/lib/winsec.c (modified) (1 diff)

trunk/lib/winsec.c

@@ -413 +413 @@
   uint32_t i, size = WINSEC_MAX_SUBAUTHS*11 + 24;
   uint32_t left = size;
-  uint8_t comps = sid->num_auths;
-  char* ret_val = malloc(size);
-  
+  uint8_t comps;
+  char* ret_val;
+
+  if(sid == NULL)
+    return NULL;
+  comps = sid->num_auths;
+
+  ret_val = malloc(size);
   if(ret_val == NULL)
     return NULL;