diff options
-rw-r--r-- | ChangeLog | 5 | ||||
-rw-r--r-- | mux.c | 12 |
2 files changed, 14 insertions, 3 deletions
@@ -11,6 +11,11 @@ | |||
11 | Add options to specify starting line number and number of lines to process | 11 | Add options to specify starting line number and number of lines to process |
12 | when screening moduli candidates. This allows processing of different | 12 | when screening moduli candidates. This allows processing of different |
13 | parts of a candidate moduli file in parallel. man page help jmc@, ok djm@ | 13 | parts of a candidate moduli file in parallel. man page help jmc@, ok djm@ |
14 | - djm@cvs.openbsd.org 2012/07/06 01:37:21 | ||
15 | [mux.c] | ||
16 | fix memory leak of passed-in environment variables and connection | ||
17 | context when new session message is malformed; bz#2003 from Bert.Wesarg | ||
18 | AT googlemail.com | ||
14 | 19 | ||
15 | 20120704 | 20 | 20120704 |
16 | - (dtucker) [configure.ac openbsd-compat/bsd-misc.h] Add setlinebuf for | 21 | - (dtucker) [configure.ac openbsd-compat/bsd-misc.h] Add setlinebuf for |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: mux.c,v 1.35 2012/06/01 01:01:22 djm Exp $ */ | 1 | /* $OpenBSD: mux.c,v 1.36 2012/07/06 01:37:21 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> | 3 | * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> |
4 | * | 4 | * |
@@ -316,6 +316,8 @@ process_mux_new_session(u_int rid, Channel *c, Buffer *m, Buffer *r) | |||
316 | cctx->term = NULL; | 316 | cctx->term = NULL; |
317 | cctx->rid = rid; | 317 | cctx->rid = rid; |
318 | cmd = reserved = NULL; | 318 | cmd = reserved = NULL; |
319 | cctx->env = NULL; | ||
320 | env_len = 0; | ||
319 | if ((reserved = buffer_get_string_ret(m, NULL)) == NULL || | 321 | if ((reserved = buffer_get_string_ret(m, NULL)) == NULL || |
320 | buffer_get_int_ret(&cctx->want_tty, m) != 0 || | 322 | buffer_get_int_ret(&cctx->want_tty, m) != 0 || |
321 | buffer_get_int_ret(&cctx->want_x_fwd, m) != 0 || | 323 | buffer_get_int_ret(&cctx->want_x_fwd, m) != 0 || |
@@ -329,16 +331,19 @@ process_mux_new_session(u_int rid, Channel *c, Buffer *m, Buffer *r) | |||
329 | xfree(cmd); | 331 | xfree(cmd); |
330 | if (reserved != NULL) | 332 | if (reserved != NULL) |
331 | xfree(reserved); | 333 | xfree(reserved); |
334 | for (j = 0; j < env_len; j++) | ||
335 | xfree(cctx->env[j]); | ||
336 | if (env_len > 0) | ||
337 | xfree(cctx->env); | ||
332 | if (cctx->term != NULL) | 338 | if (cctx->term != NULL) |
333 | xfree(cctx->term); | 339 | xfree(cctx->term); |
340 | xfree(cctx); | ||
334 | error("%s: malformed message", __func__); | 341 | error("%s: malformed message", __func__); |
335 | return -1; | 342 | return -1; |
336 | } | 343 | } |
337 | xfree(reserved); | 344 | xfree(reserved); |
338 | reserved = NULL; | 345 | reserved = NULL; |
339 | 346 | ||
340 | cctx->env = NULL; | ||
341 | env_len = 0; | ||
342 | while (buffer_len(m) > 0) { | 347 | while (buffer_len(m) > 0) { |
343 | #define MUX_MAX_ENV_VARS 4096 | 348 | #define MUX_MAX_ENV_VARS 4096 |
344 | if ((cp = buffer_get_string_ret(m, &len)) == NULL) | 349 | if ((cp = buffer_get_string_ret(m, &len)) == NULL) |
@@ -413,6 +418,7 @@ process_mux_new_session(u_int rid, Channel *c, Buffer *m, Buffer *r) | |||
413 | xfree(cctx->env); | 418 | xfree(cctx->env); |
414 | } | 419 | } |
415 | buffer_free(&cctx->cmd); | 420 | buffer_free(&cctx->cmd); |
421 | xfree(cctx); | ||
416 | return 0; | 422 | return 0; |
417 | } | 423 | } |
418 | 424 | ||