From 87a1a05456e9c44e028879ee5d52c1662698caa2 Mon Sep 17 00:00:00 2001
From: Ben Kibbey <bjk@luxsci.net>
Date: Sun, 1 Jan 2017 11:39:17 -0500
Subject: [PATCH] Fix potential invalid free().

---
 src/commands.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/src/commands.c b/src/commands.c
index 2dea2542..1d74f854 100644
--- a/src/commands.c
+++ b/src/commands.c
@@ -355,7 +355,8 @@ update_checksum (struct client_s *client, unsigned char *from_crc,
     }
 
   xfree (client->crc);
-  client->crc = crc;
+  client->crc = xmalloc (len);
+  memcpy (client->crc, crc, len);
   cdata = cache_get_data (client->filename, NULL);
   if (cdata)
     {
@@ -384,12 +385,12 @@ validate_checksum (struct client_s *client, const char *filename,
   if (rc)
     return rc;
 
-  if (cdata)
-    n = memcmp (cdata->crc, crc, len);
-
-  if (!n && client->crc)
+  if (client->crc)
     n = memcmp (client->crc, crc, len);
 
+  if (!n && cdata)
+    n = memcmp (cdata->crc, crc, len);
+
   if (!n && r_crc)
     {
       *r_crc = crc;
@@ -1289,10 +1290,8 @@ save_command (assuan_context_t ctx, char *line)
                 }
             }
 
-          pthread_cleanup_pop (0);
-          if (rc)
-            xfree (crc);
-          else
+          pthread_cleanup_pop (1);
+          if (!rc)
             client->did_cow = 0;
         }
     }
-- 
2.11.4.GIT