Blame SOURCES/trousers-0.3.14-double-free.patch

efabc7
diff -ur trousers-0.3.14/src/tspi/tsp_auth.c trousers-0.3.14-new/src/tspi/tsp_auth.c
efabc7
--- trousers-0.3.14/src/tspi/tsp_auth.c	2014-07-23 12:42:45.000000000 -0700
efabc7
+++ trousers-0.3.14-new/src/tspi/tsp_auth.c	2019-05-27 13:41:57.316000945 -0700
efabc7
@@ -1221,7 +1221,7 @@
efabc7
 	}
efabc7
 
efabc7
 	*handles = handle;
efabc7
-    handles_track = handles;
efabc7
+	handles_track = handles;
efabc7
 
efabc7
     // Since the call tree of this function can possibly alloc memory 
efabc7
     // (check RPC_ExecuteTransport_TP function), its better to keep track of
efabc7
@@ -1229,9 +1229,11 @@
efabc7
 	result = obj_context_transport_execute(tspContext, TPM_ORD_Terminate_Handle, 0, NULL,
efabc7
 					       NULL, &handlesLen, &handles, NULL, NULL, NULL, NULL);
efabc7
 
efabc7
-	free(handles);
efabc7
-    handles = NULL;
efabc7
-    free(handles_track);
efabc7
+	if (handles != handles_track) {
efabc7
+		free(handles);
efabc7
+	}
efabc7
+
efabc7
+	free(handles_track);
efabc7
 
efabc7
 	return result;
efabc7
 }