Zynq: Use after free in DisplayAuthenicationCertificates

[kylex2]

The header authentication certificate is pushed into aCs, then freed before it is displayed.

bootgen/zynq/src/readimage-zynq.cpp

Lines 264 to 278 in 0e336a0

	/* Authentication Certificates Extraction */
	uint8_t* header_ac = NULL;
	if (iHT->headerAuthCertificateWordOffset != 0)
	{
	header_ac = new uint8_t[sizeof(AuthCertificate2048Structure)];
	if (!(fseek(binFile, 4 * (iHT->headerAuthCertificateWordOffset), SEEK_SET)))
	{
	result = fread(header_ac, 1, sizeof(AuthCertificate2048Structure), binFile);
	if (result != sizeof(AuthCertificate2048Structure))
	{
	LOG_ERROR("Error reading header authentication certificate");
	}
	}
	}
	aCs.push_back(header_ac);

bootgen/zynq/src/readimage-zynq.cpp

Lines 300 to 303 in 0e336a0

	if (header_ac != NULL)
	{
	delete[] header_ac;
	}