Overview
| Comment: | Fix a use after free() bug in XMPPSCRAMAuth |
|---|---|
| Downloads: | Tarball | ZIP archive | SQL archive |
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA3-256: |
aa2fb6642fa34793597c6f4d693dee66 |
| User & Date: | florob@babelmonkeys.de on 2013-03-26 18:11:15 |
| Other Links: | manifest | tags |
Context
|
2013-03-27
| ||
| 00:30 | XMPPMulticastDelegate: Handle modifications of the delegates array check-in: 1ee9a1a87a user: florob@babelmonkeys.de tags: trunk | |
|
2013-03-26
| ||
| 18:11 | Fix a use after free() bug in XMPPSCRAMAuth check-in: aa2fb6642f user: florob@babelmonkeys.de tags: trunk | |
|
2013-03-24
| ||
| 15:33 | DiscoEntity: Answer to requests send to the caps node check-in: 31e88fde56 user: florob@babelmonkeys.de tags: trunk | |
Changes
Modified src/XMPPSCRAMAuth.m from [204b73b7fc] to [f160b76a65].
| ︙ | ︙ | |||
501 502 503 504 505 506 507 |
uOld = [self XMPP_HMACWithKey: str
data: salty];
for (j = 0; j < digestSize; j++)
result[j] ^= uOld[j];
for (j = 0; j < i - 1; j++) {
| | > > > < < | 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 |
uOld = [self XMPP_HMACWithKey: str
data: salty];
for (j = 0; j < digestSize; j++)
result[j] ^= uOld[j];
for (j = 0; j < i - 1; j++) {
tmp = [OFDataArray new];
[tmp addItems: uOld
count: digestSize];
[pool releaseObjects]; // releases uOld and previous tmp
[tmp autorelease];
u = [self XMPP_HMACWithKey: str
data: tmp];
for (k = 0; k < digestSize; k++)
result[k] ^= u[k];
uOld = u;
}
ret = [OFDataArray dataArray];
[ret addItems: result
count: digestSize];
} @finally {
[self freeMemory: result];
|
| ︙ | ︙ |