aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorArtyom V. Poptsov <poptsov.artyom@gmail.com>2021-08-15 22:50:33 +0300
committerJakub Jelen <jjelen@redhat.com>2021-09-15 11:04:45 +0200
commit1ab2340644109442f933b1fb47dee927bed29f8e (patch)
tree269a50be86cb37e91336072d8d5213732c51ca29 /src
parent76b7e0e9b54bed74f3d9be75583e56960405847d (diff)
downloadlibssh-1ab2340644109442f933b1fb47dee927bed29f8e.tar.gz
libssh-1ab2340644109442f933b1fb47dee927bed29f8e.tar.xz
libssh-1ab2340644109442f933b1fb47dee927bed29f8e.zip
channels: Fix segfaults when the channel data is freed
Calling some channel procedures on a freed channel is always resulting in segmentation fault errors. The reason is that when a channel is freed with 'ssh_channel_do_free' procedure, its 'session' field is set to NULL; then when a channel procedure tries to access any field of 'channel->session' structure it is effectively dereferencing a NULL pointer. The change fixes that behavior by adding a check which ensures that a channel state is not SSH_CHANNEL_FLAG_FREED_LOCAL before accessing its parent session. Also the test suite is updated to check for the fixed errors, and the Doxygen documentation updated accordingly. There was a bug introduced in b0fb7d15: 'ssh_channel_poll', 'ssh_channel_poll_timeout' and 'ssh_channel_get_exit_status' would compare the channel state to the 'SSH_CHANNEL_FLAG_FREED_LOCAL' constant to check if the channel is alive. But the procedures must check the channel flags for the presence of 'SSH_CHANNEL_FLAG_FREED_LOCAL' bits instead. This change fixes the bug. Signed-off-by: Artyom V. Poptsov <poptsov.artyom@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
Diffstat (limited to 'src')
-rw-r--r--src/channels.c15
1 files changed, 10 insertions, 5 deletions
diff --git a/src/channels.c b/src/channels.c
index 8d812477..6e9fcfc1 100644
--- a/src/channels.c
+++ b/src/channels.c
@@ -878,7 +878,7 @@ SSH_PACKET_CALLBACK(channel_rcv_request) {
#else
SSH_LOG(SSH_LOG_WARNING, "Unhandled channel request %s", request);
#endif
-
+
SAFE_FREE(request);
return SSH_PACKET_USED;
@@ -3086,6 +3086,8 @@ int ssh_channel_read_nonblocking(ssh_channel channel,
*
* @return The number of bytes available for reading, 0 if nothing
* is available or SSH_ERROR on error.
+ * When a channel is freed the function returns
+ * SSH_ERROR immediately.
*
* @warning When the channel is in EOF state, the function returns SSH_EOF.
*
@@ -3094,7 +3096,7 @@ int ssh_channel_read_nonblocking(ssh_channel channel,
int ssh_channel_poll(ssh_channel channel, int is_stderr){
ssh_buffer stdbuf;
- if(channel == NULL) {
+ if ((channel == NULL) || (channel->flags & SSH_CHANNEL_FLAG_FREED_LOCAL)) {
return SSH_ERROR;
}
@@ -3140,6 +3142,7 @@ int ssh_channel_poll(ssh_channel channel, int is_stderr){
* SSH_ERROR on error.
*
* @warning When the channel is in EOF state, the function returns SSH_EOF.
+ * When a channel is freed the function returns SSH_ERROR immediately.
*
* @see ssh_channel_is_eof()
*/
@@ -3151,7 +3154,7 @@ int ssh_channel_poll_timeout(ssh_channel channel, int timeout, int is_stderr)
size_t len;
int rc;
- if (channel == NULL) {
+ if ((channel == NULL) || (channel->flags & SSH_CHANNEL_FLAG_FREED_LOCAL)) {
return SSH_ERROR;
}
@@ -3233,6 +3236,8 @@ static int ssh_channel_exit_status_termination(void *c){
* (yet), or SSH_ERROR on error.
* @warning This function may block until a timeout (or never)
* if the other side is not willing to close the channel.
+ * When a channel is freed the function returns
+ * SSH_ERROR immediately.
*
* If you're looking for an async handling of this register a callback for the
* exit status.
@@ -3241,7 +3246,7 @@ static int ssh_channel_exit_status_termination(void *c){
*/
int ssh_channel_get_exit_status(ssh_channel channel) {
int rc;
- if(channel == NULL) {
+ if ((channel == NULL) || (channel->flags & SSH_CHANNEL_FLAG_FREED_LOCAL)) {
return SSH_ERROR;
}
rc = ssh_handle_packets_termination(channel->session,
@@ -3590,7 +3595,7 @@ error:
* forward the content of a socket to the channel. You still have to
* use channel_read and channel_write for this.
*/
-int ssh_channel_open_x11(ssh_channel channel,
+int ssh_channel_open_x11(ssh_channel channel,
const char *orig_addr, int orig_port) {
ssh_session session;
ssh_buffer payload = NULL;