Page MenuHome GnuPG

double keydb_release() in error handling path of g10/import.c : import_revoke_cert
Closed, ResolvedPublic

Description

Around line 3750 there is this code:

rc = keydb_lock (hd);
if (rc)
  {
    keydb_release (hd);
    goto leave;
  }

which jumps to the leave label, which does this:

leave: 
 if ((options & IMPORT_SHOW))
   list_standalone_revocation (ctrl, node->pkt->pkt.signature, sigrc);
       
 keydb_release (hd);

so this is a double call on keydb_release() which is probably causing a use-after-free.

Details

Version
2.5.21