Skip to content
Commit 697fe059 authored by Peter Wu's avatar Peter Wu Committed by Ludovic Rousseau
Browse files

SCardReleaseContext: prevent use-after-free of cardsList

Once MSGRemoveContext is invoked (via SCARD_RELEASE_CONTEXT),
cardsList is freed. A repeated invocation of SCARD_RELEASE_CONTEXT (with
an empty context handle) results in a use-after-free followed by a
double-free.

After MSGRemoveContext, invocation of SCardEstablishContext enable
further use-after-free of cardsList in MSGCheckHandleAssociation,
MSGRemoveContext, MSGAddHandle, MSGRemoveHandle.

To avoid this problem, destroy the list only when the client connection
is terminated.
parent c10dac9c
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment