[git] GnuPG - branch, master, updated. gnupg-2.1.1-11-g5a556e4

[by Werner Koch]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  5a556e4e88bcbc926c0922070acaf5f7b25d18fb (commit)
       via  0d5cb55402c44fb5f731ecf85705f845f3091aa7 (commit)
       via  abd5f6752d693b7f313c19604f0723ecec4d39a6 (commit)
      from  bdc8efbdd124d836c36cf482216e375421f72891 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5a556e4e88bcbc926c0922070acaf5f7b25d18fb
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 22 12:34:57 2014 +0100

    dirmngr: Fix memory leak.
    
    * dirmngr/server.c (cmd_ks_search, cmd_ks_get): Fix memory leak.
    
    * dirmngr/ks-engine-hkp.c (ks_hkp_mark_host): Remove double check.
    --
    
    Reported-by: Joshua Rogers <git at internot.info>
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index bd98eed..3c6a003 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -674,7 +674,7 @@ ks_hkp_mark_host (ctrl_t ctrl, const char *name, int alive)
                  member in another pool.  */
               for (idx3=0; idx3 < hosttable_size; idx3++)
                 {
-                  if (hosttable[idx3] && hosttable[idx3]
+                  if (hosttable[idx3]
                       && hosttable[idx3]->pool
                       && idx3 != idx
                       && host_in_pool_p (hosttable[idx3]->pool, n))
diff --git a/dirmngr/server.c b/dirmngr/server.c
index 9b4cdb2..6094bc9 100644
--- a/dirmngr/server.c
+++ b/dirmngr/server.c
@@ -1586,7 +1586,6 @@ cmd_ks_search (assuan_context_t ctx, char *line)
           if (!sl)
             {
               err = gpg_error_from_syserror ();
-              free_strlist (list);
               goto leave;
             }
           sl->flags = 0;
@@ -1607,6 +1606,7 @@ cmd_ks_search (assuan_context_t ctx, char *line)
     }
 
  leave:
+  free_strlist (list);
   return leave_cmd (ctx, err);
 }
 
@@ -1647,7 +1647,6 @@ cmd_ks_get (assuan_context_t ctx, char *line)
           if (!sl)
             {
               err = gpg_error_from_syserror ();
-              free_strlist (list);
               goto leave;
             }
           sl->flags = 0;
@@ -1668,6 +1667,7 @@ cmd_ks_get (assuan_context_t ctx, char *line)
     }
 
  leave:
+  free_strlist (list);
   return leave_cmd (ctx, err);
 }
 

commit 0d5cb55402c44fb5f731ecf85705f845f3091aa7
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 22 12:29:32 2014 +0100

    dirmngr: Remove un-needed check.
    
    * dirmngr/crlfetch.c (crl_fetch): Check that URL is not NULL.
    --
    
    Reported-by: Joshua Rogers <git at internot.info>
    
      "Remove un-needed check. If 'url' were not to be true,
       http_parse_uri(parse_uri(do_parse_uri))) would fail, leaving 'err'
       false."
    
    In addition I added an explicit check for the URL arg not beeing NULL.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/crlfetch.c b/dirmngr/crlfetch.c
index 2471ca2..2c4a247 100644
--- a/dirmngr/crlfetch.c
+++ b/dirmngr/crlfetch.c
@@ -163,10 +163,13 @@ crl_fetch (ctrl_t ctrl, const char *url, ksba_reader_t *reader)
 
   *reader = NULL;
 
+  if (!url)
+    return gpg_error (GPG_ERR_INV_ARG);
+
  once_more:
   err = http_parse_uri (&uri, url, 0);
   http_release_parsed_uri (uri);
-  if (err && url && !strncmp (url, "https:", 6))
+  if (err && !strncmp (url, "https:", 6))
     {
       /* Our HTTP code does not support TLS, thus we can't use this
          scheme and it is frankly not useful for CRL retrieval anyway.

commit abd5f6752d693b7f313c19604f0723ecec4d39a6
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Dec 22 12:16:46 2014 +0100

    dirmngr,gpgsm: Return NULL on fail
    
    * dirmngr/ldapserver.c (ldapserver_parse_one): Set SERVER to NULL.
    * sm/gpgsm.c (parse_keyserver_line): Ditto.
    --
    
    Reported-by: Joshua Rogers <git at internot.info>
    
      "If something inside the ldapserver_parse_one function failed,
       'server' would be freed, then returned, leading to a
       use-after-free.  This code is likely copied from sm/gpgsm.c, which
       was also susceptible to this bug."
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/ldapserver.c b/dirmngr/ldapserver.c
index 20a574c..5808c5b 100644
--- a/dirmngr/ldapserver.c
+++ b/dirmngr/ldapserver.c
@@ -125,6 +125,7 @@ ldapserver_parse_one (char *line,
     {
       log_info (_("%s:%u: skipping this line\n"), filename, lineno);
       ldapserver_list_free (server);
+      server = NULL;
     }
 
   return server;
diff --git a/sm/gpgsm.c b/sm/gpgsm.c
index 3398d17..72bceb4 100644
--- a/sm/gpgsm.c
+++ b/sm/gpgsm.c
@@ -862,6 +862,7 @@ parse_keyserver_line (char *line,
     {
       log_info (_("%s:%u: skipping this line\n"), filename, lineno);
       keyserver_list_free (server);
+      server = NULL;
     }
 
   return server;

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/crlfetch.c      |    5 ++++-
 dirmngr/ks-engine-hkp.c |    2 +-
 dirmngr/ldapserver.c    |    1 +
 dirmngr/server.c        |    4 ++--
 sm/gpgsm.c              |    1 +
 5 files changed, 9 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org