openssh unix dev - Jan 2013 - null pointer dereference in krl.c?

Hi,

In ssh_krl_from_blob(), krl.c:984,

  /* Record keys used to sign the KRL */
  xrealloc(ca_used, nca_used + 1, sizeof(*ca_used));
  ca_used[nca_used++] = key;

The result of `xrealloc' is never assigned to `ca_used', which remains
a null pointer.  Will ca_used[...] crash?.  Did I miss anything?

Thanks.

- xi

On Sun, 27 Jan 2013, Xi Wang wrote:
> Hi,
> 
> In ssh_krl_from_blob(), krl.c:984,
> 
>   /* Record keys used to sign the KRL */
>   xrealloc(ca_used, nca_used + 1, sizeof(*ca_used));
>   ca_used[nca_used++] = key;
> 
> The result of `xrealloc' is never assigned to `ca_used', which
remains
> a null pointer.  Will ca_used[...] crash?.  Did I miss anything?
Yes, I'll commit a fix.

-d