From 9c19ba7f332f5a5423ac86a5a4994190b443dc3a Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Wed, 28 Jun 2023 12:14:43 +0200 Subject: [PATCH] channels: Avoid out-of-bounds writes CID 1470005 Thanks coverity Signed-off-by: Jakub Jelen Reviewed-by: Norbert Pocs --- src/channels.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/channels.c b/src/channels.c index 2cfe1fbd..9f5a1ce9 100644 --- a/src/channels.c +++ b/src/channels.c @@ -3584,9 +3584,15 @@ int ssh_channel_select(ssh_channel *readchans, ssh_channel *writechans, firstround=0; } while(1); - memcpy(readchans, rchans, (count_ptrs(rchans) + 1) * sizeof(ssh_channel )); - memcpy(writechans, wchans, (count_ptrs(wchans) + 1) * sizeof(ssh_channel )); - memcpy(exceptchans, echans, (count_ptrs(echans) + 1) * sizeof(ssh_channel )); + if (readchans != &dummy) { + memcpy(readchans, rchans, (count_ptrs(rchans) + 1) * sizeof(ssh_channel)); + } + if (writechans != &dummy) { + memcpy(writechans, wchans, (count_ptrs(wchans) + 1) * sizeof(ssh_channel)); + } + if (exceptchans != &dummy) { + memcpy(exceptchans, echans, (count_ptrs(echans) + 1) * sizeof(ssh_channel)); + } SAFE_FREE(rchans); SAFE_FREE(wchans); SAFE_FREE(echans);