ObjXMPP  Check-in [aa2fb6642f]

Overview
Comment:Fix a use after free() bug in XMPPSCRAMAuth
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: aa2fb6642fa34793597c6f4d693dee66b3a162b9298b05e3011fa9b7550dec0a
User & Date: florob@babelmonkeys.de on 2013-03-26 18:11:15
Other Links: manifest | tags
Context
2013-03-27
00:30
XMPPMulticastDelegate: Handle modifications of the delegates array check-in: 1ee9a1a87a user: florob@babelmonkeys.de tags: trunk
2013-03-26
18:11
Fix a use after free() bug in XMPPSCRAMAuth check-in: aa2fb6642f user: florob@babelmonkeys.de tags: trunk
2013-03-24
15:33
DiscoEntity: Answer to requests send to the caps node check-in: 31e88fde56 user: florob@babelmonkeys.de tags: trunk
Changes
Hide Diffs Side-by-Side Diffs Ignore Whitespace Patch

Modified src/XMPPSCRAMAuth.m from [204b73b7fc] to [f160b76a65].

︙
501
502
503
504
505
506
507
508

509
510



511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527

501
502
503
504
505
506
507

508
509
510
511
512
513
514
515
516
517
518
519
520
521


522
523
524
525
526
527
528








-
+


+
+
+








-
-








		uOld = [self XMPP_HMACWithKey: str
					 data: salty];

		for (j = 0; j < digestSize; j++)
			result[j] ^= uOld[j];

		for (j = 0; j < i - 1; j++) {
			tmp = [OFDataArray dataArray];
			tmp = [OFDataArray new];
			[tmp addItems: uOld
				count: digestSize];

			[pool releaseObjects]; // releases uOld and previous tmp
			[tmp autorelease];

			u = [self XMPP_HMACWithKey: str
					      data: tmp];

			for (k = 0; k < digestSize; k++)
				result[k] ^= u[k];

			uOld = u;

			[pool releaseObjects];
		}

		ret = [OFDataArray dataArray];
		[ret addItems: result
			count: digestSize];
	} @finally {
		[self freeMemory: result];
︙