shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 18:04:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

session: Fix a possible use after free in ssh_free().

Browse Source 
We need to cleanup the channels first cause we call ssh_channel_close()
on the channels which still require a working socket and poll context.

Thanks to sh4rm4!
This commit is contained in:
Andreas Schneider
2012-10-22 16:22:09 +02:00
parent 191c0ae2bb
commit 04f1d950b9
1 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
src/session.c
View File

@@ -164,10 +164,20 @@ void ssh_free(ssh_session session) {
return; return;
} }
SAFE_FREE(session->serverbanner); /* delete all channels */
SAFE_FREE(session->clientbanner); while ((it=ssh_list_get_iterator(session->channels)) != NULL) {
SAFE_FREE(session->bindaddr); ssh_channel_free(ssh_iterator_value(ssh_channel,it));
SAFE_FREE(session->banner); ssh_list_remove(session->channels, it);
}
ssh_list_free(session->channels);
session->channels=NULL;
ssh_socket_free(session->socket);
if (session->default_poll_ctx) {
ssh_poll_ctx_free(session->default_poll_ctx);
}
#ifdef WITH_PCAP #ifdef WITH_PCAP
if(session->pcap_ctx){ if(session->pcap_ctx){
ssh_pcap_context_free(session->pcap_ctx); ssh_pcap_context_free(session->pcap_ctx);
@@ -183,17 +193,6 @@ void ssh_free(ssh_session session) {
session->in_buffer=session->out_buffer=NULL; session->in_buffer=session->out_buffer=NULL;
crypto_free(session->current_crypto); crypto_free(session->current_crypto);
crypto_free(session->next_crypto); crypto_free(session->next_crypto);
ssh_socket_free(session->socket);
if(session->default_poll_ctx){
ssh_poll_ctx_free(session->default_poll_ctx);
}
/* delete all channels */
while ((it=ssh_list_get_iterator(session->channels)) != NULL) {
ssh_channel_free(ssh_iterator_value(ssh_channel,it));
ssh_list_remove(session->channels, it);
}
ssh_list_free(session->channels);
session->channels=NULL;
#ifndef _WIN32 #ifndef _WIN32
agent_free(session->agent); agent_free(session->agent);
#endif /* _WIN32 */ #endif /* _WIN32 */
@@ -236,6 +235,11 @@ void ssh_free(ssh_session session) {
ssh_list_free(session->identity); ssh_list_free(session->identity);
} }
SAFE_FREE(session->serverbanner);
SAFE_FREE(session->clientbanner);
SAFE_FREE(session->bindaddr);
SAFE_FREE(session->banner);
/* options */ /* options */
SAFE_FREE(session->username); SAFE_FREE(session->username);
SAFE_FREE(session->host); SAFE_FREE(session->host);