aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJon Simons <jon@jonsimons.org>2019-01-29 20:17:20 -0500
committerAndreas Schneider <asn@cryptomilk.org>2019-01-30 13:22:59 +0100
commit3334443089c56f1d4a2922fe34c6204528ad9bd3 (patch)
treeaec0e8ec5bd071f3045ad156554275ba5e0b63a7
parentb44987a164c6bec176bbc3ac395cd0c29c701b5c (diff)
downloadlibssh-3334443089c56f1d4a2922fe34c6204528ad9bd3.tar.gz
libssh-3334443089c56f1d4a2922fe34c6204528ad9bd3.tar.xz
libssh-3334443089c56f1d4a2922fe34c6204528ad9bd3.zip
dh: plug pubkey_blob leak in ssh_server_dh_process_init
Ensure to `SSH_STRING_FREE` the pubkey_blob local in `ssh_server_dh_process_init`. The leak can be seen with valgrind and the pkd tests with: valgrind \ --leak-check=full \ --show-leak-kinds=definite \ ./pkd_hello -i1 -t torture_pkd_openssh_rsa_rsa_diffie_hellman_group14_sha1 Signed-off-by: Jon Simons <jon@jonsimons.org> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
-rw-r--r--src/dh.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/src/dh.c b/src/dh.c
index 9deea8d5..b4b988d9 100644
--- a/src/dh.c
+++ b/src/dh.c
@@ -690,7 +690,8 @@ int ssh_server_dh_process_init(ssh_session session, ssh_buffer packet)
pubkey_blob,
session->next_crypto->f,
sig_blob);
- ssh_string_free(sig_blob);
+ SSH_STRING_FREE(sig_blob);
+ SSH_STRING_FREE(pubkey_blob);
if(rc != SSH_OK) {
ssh_set_error_oom(session);
ssh_buffer_reinit(session->out_buffer);
@@ -717,6 +718,8 @@ error:
if (!bignum_ctx_invalid(ctx)) {
bignum_ctx_free(ctx);
}
+ SSH_STRING_FREE(sig_blob);
+ SSH_STRING_FREE(pubkey_blob);
session->session_state = SSH_SESSION_STATE_ERROR;
ssh_dh_cleanup(session->next_crypto);