diff options
author | djm@openbsd.org <djm@openbsd.org> | 2015-08-19 23:18:26 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2015-08-20 13:07:41 +1000 |
commit | 45b0eb752c94954a6de046bfaaf129e518ad4b5b (patch) | |
tree | afb533e748e80b20d87c9022f15809a7bb758b57 /mux.c | |
parent | c837643b93509a3ef538cb6624b678c5fe32ff79 (diff) |
upstream commit
fix free() of uninitialised pointer reported by Mateusz
Kocielski; ok markus@
Upstream-ID: 519552b050618501a06b7b023de5cb104e2c5663
Diffstat (limited to 'mux.c')
-rw-r--r-- | mux.c | 6 |
1 files changed, 5 insertions, 1 deletions
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: mux.c,v 1.53 2015/05/01 04:03:20 djm Exp $ */ | 1 | /* $OpenBSD: mux.c,v 1.54 2015/08/19 23:18:26 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> | 3 | * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> |
4 | * | 4 | * |
@@ -665,6 +665,8 @@ process_mux_open_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r) | |||
665 | u_int lport, cport; | 665 | u_int lport, cport; |
666 | int i, ret = 0, freefwd = 1; | 666 | int i, ret = 0, freefwd = 1; |
667 | 667 | ||
668 | memset(&fwd, 0, sizeof(fwd)); | ||
669 | |||
668 | /* XXX - lport/cport check redundant */ | 670 | /* XXX - lport/cport check redundant */ |
669 | if (buffer_get_int_ret(&ftype, m) != 0 || | 671 | if (buffer_get_int_ret(&ftype, m) != 0 || |
670 | (listen_addr = buffer_get_string_ret(m, NULL)) == NULL || | 672 | (listen_addr = buffer_get_string_ret(m, NULL)) == NULL || |
@@ -832,6 +834,8 @@ process_mux_close_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r) | |||
832 | int i, ret = 0; | 834 | int i, ret = 0; |
833 | u_int lport, cport; | 835 | u_int lport, cport; |
834 | 836 | ||
837 | memset(&fwd, 0, sizeof(fwd)); | ||
838 | |||
835 | if (buffer_get_int_ret(&ftype, m) != 0 || | 839 | if (buffer_get_int_ret(&ftype, m) != 0 || |
836 | (listen_addr = buffer_get_string_ret(m, NULL)) == NULL || | 840 | (listen_addr = buffer_get_string_ret(m, NULL)) == NULL || |
837 | buffer_get_int_ret(&lport, m) != 0 || | 841 | buffer_get_int_ret(&lport, m) != 0 || |