intel / intel/confidential-computing.sgx.sdk
Invalid free in SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.cpp
- Dominant language
- C++
- Stars
- 2
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
An uninitialized pointer can be freed in the `test_message_exchange` function in `SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.cpp`. Specifically, [`out_buff`](https://github.com/intel/linux-sgx/blob/73b8b57aea306d1633cc44a2efc40de6f4217364/SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.cpp#L77) is supposed to be initialized by function `send_request_receive_response` whereas this may not happen, when, e.g., memory allocation fails at the line below.
https://github.com/intel/linux-sgx/blob/73b8b57aea306d1633cc44a2efc40de6f4217364/SampleCode/LocalAttestation/EnclaveInitiator/EnclaveMessageExchange.cpp#L188-L190
However, `out_buff` is [freed](https://github.com/intel/linux-sgx/blob/73b8b57aea306d1633cc44a2efc40de6f4217364/SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.cpp#L101) even when it is not initialized.
Contributor guide
Assessment
This issue has not been assessed yet.