commit 430ffbe564b2175ced031bea0ea544fad1bdfc9e
author Paul Bakker <p.j.bakker@polarssl.org> Tue May 01 08:14:20 2012 +0000
committer Paul Bakker <p.j.bakker@polarssl.org> Tue May 01 08:14:20 2012 +0000
tree ae834c1db6ff2e3bf34017421ff1e407f74ed0ec
parent aec37cb65370768a9e9223fa1662ca0efae4b26a

 -  Fixed potential heap corruption in x509_name allocation

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 790ac41..c1be440 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -23,6 +23,7 @@
 Bugfix
    * Fixed handling error in mpi_cmp_mpi() on longer B values (found by
      Hui Dong)
+   * Fixed potential heap corruption in x509_name allocation
 
 Security
    * Fixed potential memory corruption on miscrafted client messages (found by

library/x509parse.c

diff --git a/library/x509parse.c b/library/x509parse.c
index 9d01a65..07fc439 100644
--- a/library/x509parse.c
+++ b/library/x509parse.c
@@ -305,6 +305,8 @@
     if( cur->next == NULL )
         return( POLARSSL_ERR_X509_MALLOC_FAILED );
 
+    memset( cur->next, 0, sizeof( x509_name ) );
+
     return( x509_get_name( p, end2, cur->next ) );
 }