Fix use-after-free in key derivation

SciresM · SciresM · commit 5e33b4f57d85 · 2018-04-27T04:33:55.000-06:00
diff --git a/pki.c b/pki.c
@@ -891,7 +891,7 @@ void pki_derive_keys(nca_keyset_t *keyset) {
             continue;
         }
         aes_ctx_t *mac_gen_ctx = new_aes_ctx(&keyset->keyblob_keys[i], 0x10, AES_MODE_ECB);
-        aes_decrypt(sbk_ctx, &keyset->keyblob_mac_keys[i], keyset->keyblob_mac_key_source, 0x10);
+        aes_decrypt(mac_gen_ctx, &keyset->keyblob_mac_keys[i], keyset->keyblob_mac_key_source, 0x10);
         free_aes_ctx(mac_gen_ctx);
     }
     for (unsigned int i = 0; i < 0x20; i++) {

Original file line number	Diff line number	Diff line change
`@@ -891,7 +891,7 @@ void pki_derive_keys(nca_keyset_t *keyset) {`
`891`	`891`	`continue;`
`892`	`892`	`}`
`893`	`893`	`aes_ctx_t *mac_gen_ctx = new_aes_ctx(&keyset->keyblob_keys[i], 0x10, AES_MODE_ECB);`
`894`		`- aes_decrypt(sbk_ctx, &keyset->keyblob_mac_keys[i], keyset->keyblob_mac_key_source, 0x10);`
	`894`	`+ aes_decrypt(mac_gen_ctx, &keyset->keyblob_mac_keys[i], keyset->keyblob_mac_key_source, 0x10);`
`895`	`895`	`free_aes_ctx(mac_gen_ctx);`
`896`	`896`	`}`
`897`	`897`	`for (unsigned int i = 0; i < 0x20; i++) {`