ntp/backport-CVE-2020-15025.patch
liuyumeng1 2b8de35cf5 fix CVE-2020-15025
(cherry picked from commit feecf86c9f79b67eaa691d57406807ebd15dc435)
2022-03-11 09:34:11 +08:00

40 lines
861 B
Diff

Subject: [PATCH] memory leak with AES128CMAC keys
Reference:https://archive.ntp.org/ntp4/ntp-4.2/ntp-4.2.8p15.tar.gz
---
libntp/a_md5encrypt.c | 2 +-
sntp/crypto.c | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/libntp/a_md5encrypt.c b/libntp/a_md5encrypt.c
index 8c046f4..57100de 100644
--- a/libntp/a_md5encrypt.c
+++ b/libntp/a_md5encrypt.c
@@ -93,7 +93,7 @@ make_mac(
}
cmac_fail:
if (ctx)
- CMAC_CTX_cleanup(ctx);
+ CMAC_CTX_free(ctx);
}
else
# endif /*ENABLE_CMAC*/
diff --git a/sntp/crypto.c b/sntp/crypto.c
index 8ffe006..8a47ede 100644
--- a/sntp/crypto.c
+++ b/sntp/crypto.c
@@ -70,7 +70,8 @@ compute_mac(
}
len = (u_int)slen;
- CMAC_CTX_cleanup(ctx);
+ if (ctx)
+ CMAC_CTX_free(ctx);
/* Test our AES-128-CMAC implementation */
} else /* MD5 MAC handling */
--
1.8.3.1