|
Description
|
KMFPK11_StoreKey enters a wrong branch when store publick/private key because rawkey is not set.
the bug is located in,
lib/libkmf/plugins/kmf_pkcs11/common/pkcs11_spi.c
3759 KMF_KEY_HANDLE *key;
3760 KMF_RAW_KEY_DATA *rawkey; <=== an arbitrary value
...
3781 key = kmf_get_attr_ptr(KMF_PUBKEY_HANDLE_ATTR, attlist, numattr);
3782 if (key == NULL) {
3783 key = kmf_get_attr_ptr(KMF_PRIVKEY_HANDLE_ATTR, attlist,
3784 numattr);
3785 if (key == NULL) <=== if key!=NULL, rawkey is not set
3786 rawkey = kmf_get_attr_ptr(KMF_RAW_KEY_ATTR, attlist ,
3787 numattr);
3788 }
3789 if (key == NULL && rawkey == NULL)
3790 return (KMF_ERR_ATTR_NOT_FOUND);
3791
3792 if (rawkey != NULL) { <=== the un-initialized rawkey caused wrong branch
3793 rv = store_raw_key(handle, attlist, numattr, rawkey);
3794 } else if (key && key->kstype == KMF_KEYSTORE_PK11TOKEN) {
...
|