Double-free on message signature verify in silc-client - Patch included

This is a multi-part message in MIME format.
--------------020804040509070202070103
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: 7bit

Hi list

While working on a weekend-project I've discovered a
double-silc_pkcs_public_key_free when a message-signature with a
complete public-key-payload is received.

The code which I'm referring to can be found in
"apps/irssi/src/silc/core/client_ops.c" in the function
"verify_message_signature" starting with line 263.

If the calculated fingerprint of the public key is the same as the
fingerprint sent by the server then everything is fine
(strcmp(fingerprint, fingerprint2) returns 0). But if those fingerprints
differ, the double-free takes place and the client reliably crashes.

My proposed solution (found in the attached patch with the funny name)
is to simply leave the function with SILC_MSG_SIGNED_FAILED instead of
executing the rest of the function (which is exactly what that existing
comment says it should do).

Best Regards
Stefan

--------------020804040509070202070103
Content-Type: text/plain;
 name="silc_message_verify_double_free.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename="silc_message_verify_double_free.patch"

diff --git a/apps/irssi/src/silc/core/client_ops.c b/apps/irssi/src/silc/core/client_ops.c
index cfefe32..56fdcc4 100644
--- a/apps/irssi/src/silc/core/client_ops.c
+++ b/apps/irssi/src/silc/core/client_ops.c
@@ -265,7 +265,8 @@ int verify_message_signature(SilcClientEntry sender,
            verification _failed_ */
         silc_pkcs_public_key_free(pk);
         silc_free(fingerprint);
-        ret = SILC_MSG_SIGNED_UNKNOWN;
+        silc_free(fingerprint2);
+        return SILC_MSG_SIGNED_FAILED;
       }
       silc_free(fingerprint2);
     }

--------------020804040509070202070103
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________________________________
Info:    https://lists.silcnet.org/mailman/listinfo/silc-announce
Archive: https://lists.silcnet.org/pipermail/silc-announce
FAQ:     http://silcnet.org/support/faq/
--------------020804040509070202070103--