crypto: drbg - set freed buffers to NULL

During freeing of the internal buffers used by the DRBG, set the pointer to NULL. It is possible that the context with the freed buffers is reused. In case of an error during initialization where the pointers do not yet point to allocated memory, the NULL value prevents a double free. Cc: [email protected] Fixes: 3cfc3b9 ("crypto: drbg - use aligned buffers") Signed-off-by: Stephan Mueller <[email protected]> Reported-by: [email protected] Signed-off-by: Herbert Xu <[email protected]>
ambv · Apr 20, 2018 · eea0d3e · eea0d3e
1 parent b346e49
commit eea0d3e
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/crypto/drbg.c b/crypto/drbg.c
@@ -1134,8 +1134,10 @@ static inline void drbg_dealloc_state(struct drbg_state *drbg)
 	if (!drbg)
 		return;
 	kzfree(drbg->Vbuf);
+	drbg->Vbuf = NULL;
 	drbg->V = NULL;
 	kzfree(drbg->Cbuf);
+	drbg->Cbuf = NULL;
 	drbg->C = NULL;
 	kzfree(drbg->scratchpadbuf);
 	drbg->scratchpadbuf = NULL;