summaryrefslogtreecommitdiff
path: root/mux.c
diff options
context:
space:
mode:
authordjm@openbsd.org <djm@openbsd.org>2015-08-19 23:18:26 +0000
committerDamien Miller <djm@mindrot.org>2015-08-20 13:07:41 +1000
commit45b0eb752c94954a6de046bfaaf129e518ad4b5b (patch)
treeafb533e748e80b20d87c9022f15809a7bb758b57 /mux.c
parentc837643b93509a3ef538cb6624b678c5fe32ff79 (diff)
upstream commit
fix free() of uninitialised pointer reported by Mateusz Kocielski; ok markus@ Upstream-ID: 519552b050618501a06b7b023de5cb104e2c5663
Diffstat (limited to 'mux.c')
-rw-r--r--mux.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/mux.c b/mux.c
index cdc01bd4f..e6136fd28 100644
--- a/mux.c
+++ b/mux.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: mux.c,v 1.53 2015/05/01 04:03:20 djm Exp $ */ 1/* $OpenBSD: mux.c,v 1.54 2015/08/19 23:18:26 djm Exp $ */
2/* 2/*
3 * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> 3 * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
4 * 4 *
@@ -665,6 +665,8 @@ process_mux_open_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
665 u_int lport, cport; 665 u_int lport, cport;
666 int i, ret = 0, freefwd = 1; 666 int i, ret = 0, freefwd = 1;
667 667
668 memset(&fwd, 0, sizeof(fwd));
669
668 /* XXX - lport/cport check redundant */ 670 /* XXX - lport/cport check redundant */
669 if (buffer_get_int_ret(&ftype, m) != 0 || 671 if (buffer_get_int_ret(&ftype, m) != 0 ||
670 (listen_addr = buffer_get_string_ret(m, NULL)) == NULL || 672 (listen_addr = buffer_get_string_ret(m, NULL)) == NULL ||
@@ -832,6 +834,8 @@ process_mux_close_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
832 int i, ret = 0; 834 int i, ret = 0;
833 u_int lport, cport; 835 u_int lport, cport;
834 836
837 memset(&fwd, 0, sizeof(fwd));
838
835 if (buffer_get_int_ret(&ftype, m) != 0 || 839 if (buffer_get_int_ret(&ftype, m) != 0 ||
836 (listen_addr = buffer_get_string_ret(m, NULL)) == NULL || 840 (listen_addr = buffer_get_string_ret(m, NULL)) == NULL ||
837 buffer_get_int_ret(&lport, m) != 0 || 841 buffer_get_int_ret(&lport, m) != 0 ||