Fix use-after-free bug in prepare_push_reply()

This was introduced by commit dfd3513e, which changes the push_cipher memory allocation from the options gc to a temporary gc. For the ciphername in the options structure, which has to be available longer, change this back to using the options gc.

Apologies for not spotting this during patch review.

---
 src/openvpn/push.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 54726e7..f86bdd3 100644
@@ -366,7 +366,7 @@ prepare_push_reply (struct context *c, struct gc_arena *gc,
 	{
 	  /* Push the first cipher from --ncp-ciphers to the client.
 	   * TODO: actual negotiation, instead of server dictatorship. */
-	  char *push_cipher = string_alloc(o->ncp_ciphers, gc);
+	  char *push_cipher = string_alloc(o->ncp_ciphers, &o->gc);
 	  o->ciphername = strtok (push_cipher, ":");
 	  push_option_fmt(gc, push_list, M_USAGE, "cipher %s", o->ciphername);
 	}

2.7.4

Your patch has been applied to the master branch.

commit 83fdae3e9c482a3d3ceca484d96e1241359a0450

Author: Steffan Karger
Date:   Wed Oct 19 21:24:20 2016 +0200

     Fix use-after-free bug in prepare_push_reply()

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://www.mail-archive.com/search?l=mid&[email protected]...
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

Uh... re-sending. Too late.

*ACK* - patch totally matches explanation, and both make sense.

Your patch has been applied to the master branch.

commit 83fdae3e9c482a3d3ceca484d96e1241359a0450

Author: Steffan Karger
Date:   Wed Oct 19 21:24:20 2016 +0200

     Fix use-after-free bug in prepare_push_reply()

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://www.mail-archive.com/search?l=mid&[email protected]...
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering