diff options
author | semarie@openbsd.org <semarie@openbsd.org> | 2020-06-26 11:26:01 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2020-06-27 20:23:27 +1000 |
commit | 14beca57ac92d62830c42444c26ba861812dc837 (patch) | |
tree | c1b21ebb914ebdd5eb7a976d77e8df2c75a111e3 /packet.c | |
parent | 598c3a5e3885080ced0d7c40fde00f1d5cdbb32b (diff) |
upstream: backout 1.293 fix kex mem-leak in ssh_packet_close at markus
request
the change introduced a NULL deref in sshpkt_vfatal() (uses of ssh->kex after
calling ssh_packet_clear_keys())
OpenBSD-Commit-ID: 9c9a6721411461b0b1c28dc00930d7251a798484
Diffstat (limited to 'packet.c')
-rw-r--r-- | packet.c | 4 |
1 files changed, 1 insertions, 3 deletions
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: packet.c,v 1.293 2020/06/24 15:12:09 markus Exp $ */ | 1 | /* $OpenBSD: packet.c,v 1.294 2020/06/26 11:26:01 semarie Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -616,8 +616,6 @@ ssh_packet_close_internal(struct ssh *ssh, int do_close) | |||
616 | state->newkeys[mode] = NULL; | 616 | state->newkeys[mode] = NULL; |
617 | ssh_clear_newkeys(ssh, mode); /* next keys */ | 617 | ssh_clear_newkeys(ssh, mode); /* next keys */ |
618 | } | 618 | } |
619 | kex_free(ssh->kex); | ||
620 | ssh->kex = NULL; | ||
621 | #ifdef WITH_ZLIB | 619 | #ifdef WITH_ZLIB |
622 | /* compression state is in shared mem, so we can only release it once */ | 620 | /* compression state is in shared mem, so we can only release it once */ |
623 | if (do_close && state->compression_buffer) { | 621 | if (do_close && state->compression_buffer) { |