From 5dc8e7fd347d2ae16b9a17cd7d8d62fdd59165ad Mon Sep 17 00:00:00 2001
From: Patrick Monnerat <patrick@monnerat.net>
Date: Mon, 22 Jan 2024 08:49:47 +0100
Subject: [PATCH] Fix a use-after-free crash

When requesting revocation AND deletion of certificates while renewing
them, revocation occurs after deletion, causing a use-after-free
error/crash.

This commit delays the certificates deletion after they have been
revoked.
---
 lib/db_x509.cpp | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/lib/db_x509.cpp b/lib/db_x509.cpp
index 6c997e35..dad14901 100644
--- a/lib/db_x509.cpp
+++ b/lib/db_x509.cpp
@@ -765,13 +765,15 @@ void db_x509::certRenewal(QModelIndexList indexes)
 			newcert->sign(signkey, oldcert->getDigest());
 			newcert = dynamic_cast<pki_x509 *>(insert(newcert));
 			createSuccess(newcert);
-
-			// delete old certificate if requested
-			if (doReplace)
-				deletePKI(idx);
 		}
 		if (doRevoke)
 			do_revoke(indexes, r);
+
+		// delete old certificates if requested
+		if (doReplace)
+			foreach(idx, indexes)
+				if (fromIndex<pki_x509>(idx))
+					deletePKI(idx);
 	}
 	catch (errorEx &err) {
 		XCA_ERROR(err);