create a copy of the sig data so that it can be freed later

diff --git a/ext/repo_pubkey.c b/ext/repo_pubkey.c
index 281feed6c1eba4c2b87d3ce0f92492d69810d9dc..3b0e4029ec2dbf58838d45426aab25ba66e5bcfe 100644 (file)
--- a/ext/repo_pubkey.c
+++ b/ext/repo_pubkey.c
@@ -877,7 +877,7 @@ solv_parse_sig(FILE *fp, unsigned char **sigpkgp, int *sigpkglp, char *keyidstr)
        }
     }
   hl = parsepkgheader(sig, sigl, &tag, &pktl);
-  if (!hl || tag != 2)
+  if (!hl || tag != 2 || !pktl)
     {
       solv_free(sig);
       return 0;
@@ -892,11 +892,11 @@ solv_parse_sig(FILE *fp, unsigned char **sigpkgp, int *sigpkglp, char *keyidstr)
     }
   if (sigpkgp)
     {
-      *sigpkgp = sig + hl;
+      *sigpkgp = solv_malloc(pktl);
+      memcpy(*sigpkgp, sig + hl, pktl);
       *sigpkglp = pktl;
     }
-  else
-    solv_free(sig);
+  solv_free(sig);
   if (keyidstr)
     solv_bin2hex(pgpsig.issuer, 8, keyidstr);
   return htype;