Fix double-free when failing to parse a forwarding specification given

using ~C (closes: #505330; forwarded upstream as
https://bugzilla.mindrot.org/show_bug.cgi?id=1539).

1 files changed, 6 insertions, 2 deletions

diff --git a/readconf.c b/readconf.c
index 7ad5a8e18..043673ced 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1334,9 +1334,13 @@ parse_forward(Forward *fwd, const char *fwdspec)
         return (i);
 
  fail_free:
-        if (fwd->connect_host != NULL)
+        if (fwd->connect_host != NULL) {
                 xfree(fwd->connect_host);
-        if (fwd->listen_host != NULL)
+                fwd->connect_host = NULL;
+        }
+        if (fwd->listen_host != NULL) {
                 xfree(fwd->listen_host);
+                fwd->connect_host = NULL;
+        }
         return (0);
 }