Re: Double-free on message signature verify in silc-client - Patch included

: If the calculated fingerprint of the public key is the same as the
: fingerprint sent by the server then everything is fine
: (strcmp(fingerprint, fingerprint2) returns 0). But if those fingerprints
: differ, the double-free takes place and the client reliably crashes.
: 
: My proposed solution (found in the attached patch with the funny name)
: is to simply leave the function with SILC_MSG_SIGNED_FAILED instead of
: executing the rest of the function (which is exactly what that existing
: comment says it should do).
: 
Thanks for reporting.  I fixed it the same way except I return UNKNOWN 
instead of FAILED.  We don't want to do the verification in that case at 
all and the signature status is UNKNOWN.

	Pekka
________________________________________________________________________
 Pekka Riikonen                                 priikone at silcnet.org
 Secure Internet Live Conferencing (SILC)       http://silcnet.org/
_______________________________________________________________________
Info:    https://lists.silcnet.org/mailman/listinfo/silc-announce
Archive: https://lists.silcnet.org/pipermail/silc-announce
FAQ:     http://silcnet.org/support/faq/