From 5835f0d4f6c033bd58806d33fa546908d39825c9 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Mon, 18 Dec 2023 11:09:50 +0100
Subject: [PATCH] authentic: Avoid use after free

Thanks oss-fuzz

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898

CVE: CVE-2024-1454
Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9]

The original patch is adjusted to fit for the current version.

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
---
 src/pkcs15init/pkcs15-authentic.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/pkcs15init/pkcs15-authentic.c b/src/pkcs15init/pkcs15-authentic.c
index c6894dd37..adedd0a04 100644
--- a/src/pkcs15init/pkcs15-authentic.c
+++ b/src/pkcs15init/pkcs15-authentic.c
@@ -858,7 +858,10 @@ authentic_emu_update_tokeninfo(struct sc_profile *profile, struct sc_pkcs15_card
         rv = sc_select_file(p15card->card, &path, &file);
         if (!rv)   {
 		rv = sc_get_challenge(p15card->card, buffer, sizeof(buffer));
-		LOG_TEST_RET(ctx, rv, "Get challenge error");
+		if (rv < 0) {
+			sc_file_free(file);
+			LOG_TEST_RET(ctx, rv, "Get challenge error");
+		}
 
 		len = file->size > sizeof(buffer) ? sizeof(buffer) : file->size;
 	        rv = sc_update_binary(p15card->card, 0, buffer, len, 0);
--
2.34.1