shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 09:54:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

Add memory error checking for packet functions.

Browse Source 
git-svn-id: svn+ssh://svn.berlios.de/svnroot/repos/libssh/trunk@323 7dcaeef0-15fb-0310-b436-a5af3365683c
This commit is contained in:
Andreas Schneider
2009-04-01 19:59:17 +00:00
parent 8bcd65193c
commit 2c3e423480
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
libssh/packet.c
View File

@@ -101,9 +101,14 @@ static int packet_read2(SSH_SESSION *session){
ret=ssh_socket_wait_for_data(session->socket,session,to_be_read); ret=ssh_socket_wait_for_data(session->socket,session,to_be_read);
if(ret!=SSH_OK){ if(ret!=SSH_OK){
leave_function(); leave_function();
return ret; return ret;
}
packet = malloc(to_be_read);
if (packet == NULL) {
ssh_set_error(session, SSH_FATAL, "No space left");
leave_function();
return SSH_ERROR;
} }
packet=malloc(to_be_read);
ssh_socket_read(session->socket,packet,to_be_read-current_macsize); ssh_socket_read(session->socket,packet,to_be_read-current_macsize);
ssh_log(session,SSH_LOG_PACKET,"Read a %d bytes packet",len); ssh_log(session,SSH_LOG_PACKET,"Read a %d bytes packet",len);
buffer_add_data(session->in_buffer,packet,to_be_read-current_macsize); buffer_add_data(session->in_buffer,packet,to_be_read-current_macsize);
@@ -207,7 +212,12 @@ static int packet_read1(SSH_SESSION *session){
padding=8-(len % 8); padding=8-(len % 8);
to_be_read=len+padding; to_be_read=len+padding;
/* it is *not* possible that to_be_read be < 8. */ /* it is *not* possible that to_be_read be < 8. */
packet=malloc(to_be_read); packet = malloc(to_be_read);
if (packet == NULL) {
ssh_set_error(session, SSH_FATAL,"No space left");
leave_function();
return SSH_ERROR;
}
ret=ssh_socket_read(session->socket,packet,to_be_read); ret=ssh_socket_read(session->socket,packet,to_be_read);
if(ret != SSH_OK){ if(ret != SSH_OK){
free(packet); free(packet);