diff options
| author | Andreas Schneider <asn@cryptomilk.org> | 2012-10-05 14:39:51 +0200 |
|---|---|---|
| committer | Andreas Schneider <asn@cryptomilk.org> | 2012-11-14 17:11:03 +0100 |
| commit | 6236001ff4f9017c9f842d6548baba9760c95f5c (patch) | |
| tree | a96e4e4be3320d1bc9c4b8582418b0b3c63364d3 | |
| parent | 1471f2c67a23602898e783c97b65aea9cc6356a4 (diff) | |
| download | libssh-6236001ff4f9017c9f842d6548baba9760c95f5c.tar.gz libssh-6236001ff4f9017c9f842d6548baba9760c95f5c.tar.xz libssh-6236001ff4f9017c9f842d6548baba9760c95f5c.zip | |
CVE-2012-4559: Ensure that we don't free req twice.
| -rw-r--r-- | src/channels.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/channels.c b/src/channels.c index ad989d78..214485c9 100644 --- a/src/channels.c +++ b/src/channels.c @@ -1417,6 +1417,7 @@ static int channel_request(ssh_channel channel, const char *request, buffer_add_ssh_string(session->out_buffer, req) < 0 || buffer_add_u8(session->out_buffer, reply == 0 ? 0 : 1) < 0) { ssh_set_error_oom(session); + ssh_string_free(req); goto error; } ssh_string_free(req); @@ -1476,7 +1477,6 @@ static int channel_request(ssh_channel channel, const char *request, return rc; error: buffer_reinit(session->out_buffer); - ssh_string_free(req); leave_function(); return rc; |