diff options
Diffstat (limited to 'channels.c')
-rw-r--r-- | channels.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/channels.c b/channels.c index 8e66265a3..9efe89c9c 100644 --- a/channels.c +++ b/channels.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: channels.c,v 1.328 2013/12/19 01:04:36 djm Exp $ */ | 1 | /* $OpenBSD: channels.c,v 1.331 2014/02/26 20:29:29 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -423,7 +423,7 @@ channel_free(Channel *c) | |||
423 | if (cc->abandon_cb != NULL) | 423 | if (cc->abandon_cb != NULL) |
424 | cc->abandon_cb(c, cc->ctx); | 424 | cc->abandon_cb(c, cc->ctx); |
425 | TAILQ_REMOVE(&c->status_confirms, cc, entry); | 425 | TAILQ_REMOVE(&c->status_confirms, cc, entry); |
426 | bzero(cc, sizeof(*cc)); | 426 | explicit_bzero(cc, sizeof(*cc)); |
427 | free(cc); | 427 | free(cc); |
428 | } | 428 | } |
429 | if (c->filter_cleanup != NULL && c->filter_ctx != NULL) | 429 | if (c->filter_cleanup != NULL && c->filter_ctx != NULL) |
@@ -1072,6 +1072,9 @@ channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset) | |||
1072 | buffer_get(&c->input, (char *)&s4_req.dest_addr, 4); | 1072 | buffer_get(&c->input, (char *)&s4_req.dest_addr, 4); |
1073 | have = buffer_len(&c->input); | 1073 | have = buffer_len(&c->input); |
1074 | p = buffer_ptr(&c->input); | 1074 | p = buffer_ptr(&c->input); |
1075 | if (memchr(p, '\0', have) == NULL) | ||
1076 | fatal("channel %d: decode socks4: user not nul terminated", | ||
1077 | c->self); | ||
1075 | len = strlen(p); | 1078 | len = strlen(p); |
1076 | debug2("channel %d: decode socks4: user %s/%d", c->self, p, len); | 1079 | debug2("channel %d: decode socks4: user %s/%d", c->self, p, len); |
1077 | len++; /* trailing '\0' */ | 1080 | len++; /* trailing '\0' */ |
@@ -2671,7 +2674,7 @@ channel_input_status_confirm(int type, u_int32_t seq, void *ctxt) | |||
2671 | return; | 2674 | return; |
2672 | cc->cb(type, c, cc->ctx); | 2675 | cc->cb(type, c, cc->ctx); |
2673 | TAILQ_REMOVE(&c->status_confirms, cc, entry); | 2676 | TAILQ_REMOVE(&c->status_confirms, cc, entry); |
2674 | bzero(cc, sizeof(*cc)); | 2677 | explicit_bzero(cc, sizeof(*cc)); |
2675 | free(cc); | 2678 | free(cc); |
2676 | } | 2679 | } |
2677 | 2680 | ||
@@ -3304,9 +3307,7 @@ channel_connect_ctx_free(struct channel_connect *cctx) | |||
3304 | free(cctx->host); | 3307 | free(cctx->host); |
3305 | if (cctx->aitop) | 3308 | if (cctx->aitop) |
3306 | freeaddrinfo(cctx->aitop); | 3309 | freeaddrinfo(cctx->aitop); |
3307 | bzero(cctx, sizeof(*cctx)); | 3310 | memset(cctx, 0, sizeof(*cctx)); |
3308 | cctx->host = NULL; | ||
3309 | cctx->ai = cctx->aitop = NULL; | ||
3310 | } | 3311 | } |
3311 | 3312 | ||
3312 | /* Return CONNECTING channel to remote host, port */ | 3313 | /* Return CONNECTING channel to remote host, port */ |