shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-09 18:04:25 +09:00
Code Issues Packages Projects Releases Wiki Activity

Fix doublefree bug found by Cyril

Browse Source
This commit is contained in:
Aris Adamantiadis
2009-06-21 19:25:51 +02:00
parent 77cd4795c5
commit bab8508eba
1 changed files with 20 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
libssh/client.c
View File

@@ -221,6 +221,7 @@ static int dh_handshake(SSH_SESSION *session) {
} }
string_burn(e); string_burn(e);
string_free(e); string_free(e);
e=NULL;
rc = packet_send(session); rc = packet_send(session);
if (rc == SSH_ERROR) { if (rc == SSH_ERROR) {
@@ -261,7 +262,7 @@ static int dh_handshake(SSH_SESSION *session) {
} }
string_burn(f); string_burn(f);
string_free(f); string_free(f);
f=NULL;
signature = buffer_get_ssh_string(session->in_buffer); signature = buffer_get_ssh_string(session->in_buffer);
if (signature == NULL) { if (signature == NULL) {
ssh_set_error(session, SSH_FATAL, "No signature in packet"); ssh_set_error(session, SSH_FATAL, "No signature in packet");
@@ -332,13 +333,14 @@ static int dh_handshake(SSH_SESSION *session) {
/* forget it for now ... */ /* forget it for now ... */
string_burn(signature); string_burn(signature);
string_free(signature); string_free(signature);
signature=NULL;
/* /*
* Once we got SSH2_MSG_NEWKEYS we can switch next_crypto and * Once we got SSH2_MSG_NEWKEYS we can switch next_crypto and
* current_crypto * current_crypto
*/ */
if (session->current_crypto) { if (session->current_crypto) {
crypto_free(session->current_crypto); crypto_free(session->current_crypto);
session->current_crypto=NULL;
} }
/* FIXME later, include a function to change keys */ /* FIXME later, include a function to change keys */
@@ -364,14 +366,22 @@ static int dh_handshake(SSH_SESSION *session) {
/* not reached */ /* not reached */
error: error:
string_burn(e); if(e != NULL){
string_free(e); string_burn(e);
string_burn(f); string_free(e);
string_free(f); }
string_burn(pubkey); if(f != NULL){
string_free(pubkey); string_burn(f);
string_burn(signature); string_free(f);
string_free(signature); }
if(pubkey != NULL){
string_burn(pubkey);
string_free(pubkey);
}
if(signature != NULL){
string_burn(signature);
string_free(signature);
}
leave_function(); leave_function();
return rc; return rc;