fixed misuse of realloc

if called with size 0, realloc frees the buffer, which may eventually
lead to a double free corruption.
This commit is contained in:
Frank Morgner
2019-01-17 15:04:35 +01:00
parent 3209ef2261
commit c63cc40c34
6 changed files with 44 additions and 32 deletions

View File

@@ -102,12 +102,14 @@ int picc_decode_apdu(const char *inbuf, size_t inlen,
}
end++;
p = realloc(*outbuf, length);
if (!p) {
RELAY_ERROR("Error allocating memory for decoded C-APDU\n");
return 0;
if (length != 0) {
p = realloc(*outbuf, length);
if (!p) {
RELAY_ERROR("Error allocating memory for decoded C-APDU\n");
return 0;
}
*outbuf = p;
}
*outbuf = p;
pos = 0;
while(inbuf+inlen > end && length > pos) {