ec.c: Fix embarrassing use-after-free in EC point hashing.

The hashed data is sometimes (unpredictably) mangled by freeing causing
hash mismatches, which is annoying.  Also, obviously incorrect.

diff --git a/ec.c b/ec.c
index 0489bc0f33e3b00d4a882b2be9772fdbaf8c0d17..c6034891ef71215c92d497ed2b1d8275c99f7cd7 100644 (file)
--- a/ec.c
+++ b/ec.c
@@ -204,8 +204,8 @@ static long ecpt_pyhash(PyObject *me)
   EC_OUT(ECPT_C(me), &p, ECPT_P(me));
   ec_putraw(ECPT_C(me), &b, &p);
   EC_DESTROY(&p);
   EC_OUT(ECPT_C(me), &p, ECPT_P(me));
   ec_putraw(ECPT_C(me), &b, &p);
   EC_DESTROY(&p);

-  xfree(q);

   h = unihash_hash(&unihash_global, h, BBASE(&b), BLEN(&b));
   h = unihash_hash(&unihash_global, h, BBASE(&b), BLEN(&b));

+  xfree(q);

   return (h % LONG_MAX);
 }
 
   return (h % LONG_MAX);
 }